--- /dev/null
+From 45abd4dde042d6054365d3a3880f5be42daf9547 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Oct 2023 11:03:02 +0800
+Subject: 9p/net: fix possible memory leak in p9_check_errors()
+
+From: Hangyu Hua <hbh25y@gmail.com>
+
+[ Upstream commit ce07087964208eee2ca2f9ee4a98f8b5d9027fe6 ]
+
+When p9pdu_readf() is called with "s?d" attribute, it allocates a pointer
+that will store a string. But when p9pdu_readf() fails while handling "d"
+then this pointer will not be freed in p9_check_errors().
+
+Fixes: 51a87c552dfd ("9p: rework client code to use new protocol support functions")
+Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
+Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
+Message-ID: <20231027030302.11927-1-hbh25y@gmail.com>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/9p/client.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/9p/client.c b/net/9p/client.c
+index af59c3f2ec2e7..a96e127ca4883 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -537,12 +537,14 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
+ return 0;
+
+ if (!p9_is_proto_dotl(c)) {
+- char *ename;
++ char *ename = NULL;
+
+ err = p9pdu_readf(&req->rc, c->proto_version, "s?d",
+ &ename, &ecode);
+- if (err)
++ if (err) {
++ kfree(ename);
+ goto out_err;
++ }
+
+ if (p9_is_proto_dotu(c) && ecode < 512)
+ err = -ecode;
+--
+2.42.0
+
--- /dev/null
+From 999aaaa8d80a8e6212310580a3dbe2032ffbbd93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jul 2023 13:02:59 -0700
+Subject: ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window
+
+From: Alison Schofield <alison.schofield@intel.com>
+
+[ Upstream commit 8f1004679987302b155f14b966ca6d4335814fcb ]
+
+Commit fd49f99c1809 ("ACPI: NUMA: Add a node and memblk for each
+CFMWS not in SRAT") did not account for the case where the BIOS
+only partially describes a CFMWS Window in the SRAT. That means
+the omitted address ranges, of a partially described CFMWS Window,
+do not get assigned to a NUMA node.
+
+Replace the call to phys_to_target_node() with numa_add_memblks().
+Numa_add_memblks() searches an HPA range for existing memblk(s)
+and extends those memblk(s) to fill the entire CFMWS Window.
+
+Extending the existing memblks is a simple strategy that reuses
+SRAT defined proximity domains from part of a window to fill out
+the entire window, based on the knowledge* that all of a CFMWS
+window is of a similar performance class.
+
+*Note that this heuristic will evolve when CFMWS Windows present
+a wider range of characteristics. The extension of the proximity
+domain, implemented here, is likely a step in developing a more
+sophisticated performance profile in the future.
+
+There is no change in behavior when the SRAT does not describe
+the CFMWS Window at all. In that case, a new NUMA node with a
+single memblk covering the entire CFMWS Window is created.
+
+Fixes: fd49f99c1809 ("ACPI: NUMA: Add a node and memblk for each CFMWS not in SRAT")
+Reported-by: Derick Marks <derick.w.marks@intel.com>
+Suggested-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Alison Schofield <alison.schofield@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Tested-by: Derick Marks <derick.w.marks@intel.com>
+Link: https://lore.kernel.org/all/eaa0b7cffb0951a126223eef3cbe7b55b8300ad9.1689018477.git.alison.schofield%40intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/numa/srat.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/numa/srat.c b/drivers/acpi/numa/srat.c
+index 1f4fc5f8a819d..12f330b0eac01 100644
+--- a/drivers/acpi/numa/srat.c
++++ b/drivers/acpi/numa/srat.c
+@@ -310,11 +310,16 @@ static int __init acpi_parse_cfmws(union acpi_subtable_headers *header,
+ start = cfmws->base_hpa;
+ end = cfmws->base_hpa + cfmws->window_size;
+
+- /* Skip if the SRAT already described the NUMA details for this HPA */
+- node = phys_to_target_node(start);
+- if (node != NUMA_NO_NODE)
++ /*
++ * The SRAT may have already described NUMA details for all,
++ * or a portion of, this CFMWS HPA range. Extend the memblks
++ * found for any portion of the window to cover the entire
++ * window.
++ */
++ if (!numa_fill_memblks(start, end))
+ return 0;
+
++ /* No SRAT description. Create a new node. */
+ node = acpi_map_pxm_to_node(*fake_pxm);
+
+ if (node == NUMA_NO_NODE) {
+--
+2.42.0
+
--- /dev/null
+From 5565c7d18c78219ea3c7d389abb41faaf8f2941f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Oct 2023 16:46:29 +0300
+Subject: ACPI: property: Allow _DSD buffer data only for byte accessors
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 046ece773cc77ef5d2a1431b188ac3d0840ed150 ]
+
+In accordance with ACPI specificication and _DSD data buffer
+representation the data there is an array of bytes. Hence,
+accessing it with something longer will create a sparse data
+which is against of how device property APIs work in general
+and also not defined in the ACPI specification (see [1]).
+Fix the code to emit an error if non-byte accessor is used to
+retrieve _DSD buffer data.
+
+Fixes: 369af6bf2c28 ("ACPI: property: Read buffer properties as integers")
+Link: https://uefi.org/specs/ACPI/6.5/19_ASL_Reference.html#buffer-declare-buffer-object # [1]
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+[ rjw: Add missing braces ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/property.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index b8d9eb9a433ed..0565c18c2ee31 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -1114,25 +1114,26 @@ static int acpi_data_prop_read(const struct acpi_device_data *data,
+ switch (proptype) {
+ case DEV_PROP_STRING:
+ break;
+- case DEV_PROP_U8 ... DEV_PROP_U64:
++ default:
+ if (obj->type == ACPI_TYPE_BUFFER) {
+ if (nval > obj->buffer.length)
+ return -EOVERFLOW;
+- break;
++ } else {
++ if (nval > obj->package.count)
++ return -EOVERFLOW;
+ }
+- fallthrough;
+- default:
+- if (nval > obj->package.count)
+- return -EOVERFLOW;
+ break;
+ }
+ if (nval == 0)
+ return -EINVAL;
+
+- if (obj->type != ACPI_TYPE_BUFFER)
+- items = obj->package.elements;
+- else
++ if (obj->type == ACPI_TYPE_BUFFER) {
++ if (proptype != DEV_PROP_U8)
++ return -EPROTO;
+ items = obj;
++ } else {
++ items = obj->package.elements;
++ }
+
+ switch (proptype) {
+ case DEV_PROP_U8:
+--
+2.42.0
+
--- /dev/null
+From 3971880ef99fafa7bcad0cc774c1addfad0461e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Oct 2023 20:32:54 +0200
+Subject: ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 48cf49d31994ff97b33c4044e618560ec84d35fb ]
+
+snprintf() does not return negative values on error.
+
+To know if the buffer was too small, the returned value needs to be
+compared with the length of the passed buffer. If it is greater or
+equal, the output has been truncated, so add checks for the truncation
+to create_pnp_modalias() and create_of_modalias(). Also make them
+return -ENOMEM in that case, as they already do that elsewhere.
+
+Moreover, the remaining size of the buffer used by snprintf() needs to
+be updated after the first write to avoid out-of-bounds access as
+already done correctly in create_pnp_modalias(), but not in
+create_of_modalias(), so change the latter accordingly.
+
+Fixes: 8765c5ba1949 ("ACPI / scan: Rework modalias creation when "compatible" is present")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+[ rjw: Merge two patches into one, combine changelogs, add subject ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/device_sysfs.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
+index 120873dad2cc5..c727fb320eeea 100644
+--- a/drivers/acpi/device_sysfs.c
++++ b/drivers/acpi/device_sysfs.c
+@@ -158,8 +158,8 @@ static int create_pnp_modalias(struct acpi_device *acpi_dev, char *modalias,
+ return 0;
+
+ len = snprintf(modalias, size, "acpi:");
+- if (len <= 0)
+- return len;
++ if (len >= size)
++ return -ENOMEM;
+
+ size -= len;
+
+@@ -212,8 +212,10 @@ static int create_of_modalias(struct acpi_device *acpi_dev, char *modalias,
+ len = snprintf(modalias, size, "of:N%sT", (char *)buf.pointer);
+ ACPI_FREE(buf.pointer);
+
+- if (len <= 0)
+- return len;
++ if (len >= size)
++ return -ENOMEM;
++
++ size -= len;
+
+ of_compatible = acpi_dev->data.of_compatible;
+ if (of_compatible->type == ACPI_TYPE_PACKAGE) {
+--
+2.42.0
+
--- /dev/null
+From d3ac41fa64e9d75cd1f2a8592a0311dd98926d8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 22:20:55 +0200
+Subject: =?UTF-8?q?ACPI:=20video:=20Add=20acpi=5Fbacklight=3Dvendor=20quir?=
+ =?UTF-8?q?k=20for=20Toshiba=20Port=C3=A9g=C3=A9=20R100?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ondrej Zary <linux@zary.sk>
+
+[ Upstream commit 35a341c9b25da6a479bd8013bcb11a680a7233e3 ]
+
+Toshiba Portégé R100 has both acpi_video and toshiba_acpi vendor
+backlight driver working. But none of them gets activated as it has
+a VGA with no kernel driver (Trident CyberBlade XP4m32).
+
+The DMI strings are very generic ("Portable PC") so add a custom
+callback function to check for Trident CyberBlade XP4m32 PCI device
+before enabling the vendor backlight driver (better than acpi_video
+as it has more brightness steps).
+
+Fixes: 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for creating ACPI backlight by default")
+Signed-off-by: Ondrej Zary <linux@zary.sk>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 073d26ddb6c21..60b0128a10e86 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -130,6 +130,16 @@ static int video_detect_force_native(const struct dmi_system_id *d)
+ return 0;
+ }
+
++static int video_detect_portege_r100(const struct dmi_system_id *d)
++{
++ struct pci_dev *dev;
++ /* Search for Trident CyberBlade XP4m32 to confirm Portégé R100 */
++ dev = pci_get_device(PCI_VENDOR_ID_TRIDENT, 0x2100, NULL);
++ if (dev)
++ acpi_backlight_dmi = acpi_backlight_vendor;
++ return 0;
++}
++
+ static const struct dmi_system_id video_detect_dmi_table[] = {
+ /*
+ * Models which should use the vendor backlight interface,
+@@ -268,6 +278,22 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ },
+ },
+
++ /*
++ * Toshiba Portégé R100 has working both acpi_video and toshiba_acpi
++ * vendor driver. But none of them gets activated as it has a VGA with
++ * no kernel driver (Trident CyberBlade XP4m32).
++ * The DMI strings are generic so check for the VGA chip in callback.
++ */
++ {
++ .callback = video_detect_portege_r100,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
++ DMI_MATCH(DMI_BOARD_NAME, "Portable PC")
++ },
++ },
++
+ /*
+ * Models which need acpi_video backlight control where the GPU drivers
+ * do not call acpi_video_register_backlight() because no internal panel
+--
+2.42.0
+
--- /dev/null
+From 46953b64dd1d8a9d253e5ca2a318776abadc4868 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 20:10:08 +0300
+Subject: ALSA: hda: cs35l41: Fix unbalanced pm_runtime_get()
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 486465508f8a5fe441939a7d97607f4460a60891 ]
+
+If component_add() fails, probe() returns without calling
+pm_runtime_put(), which leaves the runtime PM usage counter incremented.
+
+Fix the issue by jumping to err_pm label and drop the now unnecessary
+pm_runtime_disable() call.
+
+Fixes: 7b2f3eb492da ("ALSA: hda: cs35l41: Add support for CS35L41 in HDA systems")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20230907171010.1447274-10-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/cs35l41_hda.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/cs35l41_hda.c b/sound/pci/hda/cs35l41_hda.c
+index a5b10a6a33a5e..f92fc84199bc8 100644
+--- a/sound/pci/hda/cs35l41_hda.c
++++ b/sound/pci/hda/cs35l41_hda.c
+@@ -1501,8 +1501,7 @@ int cs35l41_hda_probe(struct device *dev, const char *device_name, int id, int i
+ ret = component_add(cs35l41->dev, &cs35l41_hda_comp_ops);
+ if (ret) {
+ dev_err(cs35l41->dev, "Register component failed: %d\n", ret);
+- pm_runtime_disable(cs35l41->dev);
+- goto err;
++ goto err_pm;
+ }
+
+ dev_info(cs35l41->dev, "Cirrus Logic CS35L41 (%x), Revision: %02X\n", regid, reg_revid);
+--
+2.42.0
+
--- /dev/null
+From 6cc91cfcc0bd4f3eea59352a18214c8529bf322c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 20:10:09 +0300
+Subject: ALSA: hda: cs35l41: Undo runtime PM changes at driver exit time
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 85a1bf86fac0c195929768b4e92c78cad107523b ]
+
+According to the documentation, drivers are responsible for undoing at
+removal time all runtime PM changes done during probing.
+
+Hence, add the missing calls to pm_runtime_dont_use_autosuspend(), which
+are necessary for undoing pm_runtime_use_autosuspend().
+
+Fixes: 1873ebd30cc8 ("ALSA: hda: cs35l41: Support Hibernation during Suspend")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20230907171010.1447274-11-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/cs35l41_hda.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/pci/hda/cs35l41_hda.c b/sound/pci/hda/cs35l41_hda.c
+index f92fc84199bc8..c79a12e5c9ad2 100644
+--- a/sound/pci/hda/cs35l41_hda.c
++++ b/sound/pci/hda/cs35l41_hda.c
+@@ -1509,6 +1509,7 @@ int cs35l41_hda_probe(struct device *dev, const char *device_name, int id, int i
+ return 0;
+
+ err_pm:
++ pm_runtime_dont_use_autosuspend(cs35l41->dev);
+ pm_runtime_disable(cs35l41->dev);
+ pm_runtime_put_noidle(cs35l41->dev);
+
+@@ -1527,6 +1528,7 @@ void cs35l41_hda_remove(struct device *dev)
+ struct cs35l41_hda *cs35l41 = dev_get_drvdata(dev);
+
+ pm_runtime_get_sync(cs35l41->dev);
++ pm_runtime_dont_use_autosuspend(cs35l41->dev);
+ pm_runtime_disable(cs35l41->dev);
+
+ if (cs35l41->halo_initialized)
+--
+2.42.0
+
--- /dev/null
+From 5047e1697a00d2d7c9d053c4ece0118d61b5945f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Aug 2023 15:37:24 -0300
+Subject: apparmor: fix invalid reference on profile->disconnected
+
+From: Georgia Garcia <georgia.garcia@canonical.com>
+
+[ Upstream commit 8884ba07786c718771cf7b78cb3024924b27ec2b ]
+
+profile->disconnected was storing an invalid reference to the
+disconnected path. Fix it by duplicating the string using
+aa_unpack_strdup and freeing accordingly.
+
+Fixes: 72c8a768641d ("apparmor: allow profiles to provide info to disconnected paths")
+Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/policy.c | 1 +
+ security/apparmor/policy_unpack.c | 5 +++--
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
+index fbdfcef91c616..c7b84fb568414 100644
+--- a/security/apparmor/policy.c
++++ b/security/apparmor/policy.c
+@@ -218,6 +218,7 @@ void aa_free_profile(struct aa_profile *profile)
+
+ aa_put_ns(profile->ns);
+ kfree_sensitive(profile->rename);
++ kfree_sensitive(profile->disconnected);
+
+ aa_free_file_rules(&profile->file);
+ aa_free_cap_rules(&profile->caps);
+diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
+index fbddf6450195d..7012fd82f1bb1 100644
+--- a/security/apparmor/policy_unpack.c
++++ b/security/apparmor/policy_unpack.c
+@@ -656,7 +656,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ const char *info = "failed to unpack profile";
+ size_t ns_len;
+ struct rhashtable_params params = { 0 };
+- char *key = NULL;
++ char *key = NULL, *disconnected = NULL;
+ struct aa_data *data;
+ int i, error = -EPROTO;
+ kernel_cap_t tmpcap;
+@@ -710,7 +710,8 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ }
+
+ /* disconnected attachment string is optional */
+- (void) aa_unpack_str(e, &profile->disconnected, "disconnected");
++ (void) aa_unpack_strdup(e, &disconnected, "disconnected");
++ profile->disconnected = disconnected;
+
+ /* per profile debug flags (complain, audit) */
+ if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {
+--
+2.42.0
+
--- /dev/null
+From d601f02acff872e43fb79f79d886b8d633e0faa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 01:40:24 +0000
+Subject: apparmor: test: make static symbols visible during kunit testing
+
+From: Rae Moar <rmoar@google.com>
+
+[ Upstream commit b11e51dd70947107fa4076c6286dce301671afc1 ]
+
+Use macros, VISIBLE_IF_KUNIT and EXPORT_SYMBOL_IF_KUNIT, to allow
+static symbols to be conditionally set to be visible during
+apparmor_policy_unpack_test, which removes the need to include the testing
+file in the implementation file.
+
+Change the namespace of the symbols that are now conditionally visible (by
+adding the prefix aa_) to avoid confusion with symbols of the same name.
+
+Allow the test to be built as a module and namespace the module name from
+policy_unpack_test to apparmor_policy_unpack_test to improve clarity of
+the module name.
+
+Provide an example of how static symbols can be dealt with in testing.
+
+Signed-off-by: Rae Moar <rmoar@google.com>
+Reviewed-by: David Gow <davidgow@google.com>
+Acked-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Stable-dep-of: 8884ba07786c ("apparmor: fix invalid reference on profile->disconnected")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/Kconfig | 4 +-
+ security/apparmor/Makefile | 3 +
+ security/apparmor/include/policy_unpack.h | 50 +++++
+ security/apparmor/policy_unpack.c | 238 ++++++++++------------
+ security/apparmor/policy_unpack_test.c | 69 ++++---
+ 5 files changed, 196 insertions(+), 168 deletions(-)
+
+diff --git a/security/apparmor/Kconfig b/security/apparmor/Kconfig
+index cb3496e00d8a6..f334e7cccf2da 100644
+--- a/security/apparmor/Kconfig
++++ b/security/apparmor/Kconfig
+@@ -106,8 +106,8 @@ config SECURITY_APPARMOR_PARANOID_LOAD
+ Disabling the check will speed up policy loads.
+
+ config SECURITY_APPARMOR_KUNIT_TEST
+- bool "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS
+- depends on KUNIT=y && SECURITY_APPARMOR
++ tristate "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS
++ depends on KUNIT && SECURITY_APPARMOR
+ default KUNIT_ALL_TESTS
+ help
+ This builds the AppArmor KUnit tests.
+diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile
+index ff23fcfefe196..065f4e346553d 100644
+--- a/security/apparmor/Makefile
++++ b/security/apparmor/Makefile
+@@ -8,6 +8,9 @@ apparmor-y := apparmorfs.o audit.o capability.o task.o ipc.o lib.o match.o \
+ resource.o secid.o file.o policy_ns.o label.o mount.o net.o
+ apparmor-$(CONFIG_SECURITY_APPARMOR_HASH) += crypto.o
+
++obj-$(CONFIG_SECURITY_APPARMOR_KUNIT_TEST) += apparmor_policy_unpack_test.o
++apparmor_policy_unpack_test-objs += policy_unpack_test.o
++
+ clean-files := capability_names.h rlim_names.h net_names.h
+
+ # Build a lower case string table of address family names
+diff --git a/security/apparmor/include/policy_unpack.h b/security/apparmor/include/policy_unpack.h
+index eb5f7d7f132bb..e89b701447bcb 100644
+--- a/security/apparmor/include/policy_unpack.h
++++ b/security/apparmor/include/policy_unpack.h
+@@ -48,6 +48,43 @@ enum {
+ AAFS_LOADDATA_NDENTS /* count of entries */
+ };
+
++/*
++ * The AppArmor interface treats data as a type byte followed by the
++ * actual data. The interface has the notion of a named entry
++ * which has a name (AA_NAME typecode followed by name string) followed by
++ * the entries typecode and data. Named types allow for optional
++ * elements and extensions to be added and tested for without breaking
++ * backwards compatibility.
++ */
++
++enum aa_code {
++ AA_U8,
++ AA_U16,
++ AA_U32,
++ AA_U64,
++ AA_NAME, /* same as string except it is items name */
++ AA_STRING,
++ AA_BLOB,
++ AA_STRUCT,
++ AA_STRUCTEND,
++ AA_LIST,
++ AA_LISTEND,
++ AA_ARRAY,
++ AA_ARRAYEND,
++};
++
++/*
++ * aa_ext is the read of the buffer containing the serialized profile. The
++ * data is copied into a kernel buffer in apparmorfs and then handed off to
++ * the unpack routines.
++ */
++struct aa_ext {
++ void *start;
++ void *end;
++ void *pos; /* pointer to current position in the buffer */
++ u32 version;
++};
++
+ /*
+ * struct aa_loaddata - buffer of policy raw_data set
+ *
+@@ -126,4 +163,17 @@ static inline void aa_put_loaddata(struct aa_loaddata *data)
+ kref_put(&data->count, aa_loaddata_kref);
+ }
+
++#if IS_ENABLED(CONFIG_KUNIT)
++bool aa_inbounds(struct aa_ext *e, size_t size);
++size_t aa_unpack_u16_chunk(struct aa_ext *e, char **chunk);
++bool aa_unpack_X(struct aa_ext *e, enum aa_code code);
++bool aa_unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name);
++bool aa_unpack_u32(struct aa_ext *e, u32 *data, const char *name);
++bool aa_unpack_u64(struct aa_ext *e, u64 *data, const char *name);
++size_t aa_unpack_array(struct aa_ext *e, const char *name);
++size_t aa_unpack_blob(struct aa_ext *e, char **blob, const char *name);
++int aa_unpack_str(struct aa_ext *e, const char **string, const char *name);
++int aa_unpack_strdup(struct aa_ext *e, char **string, const char *name);
++#endif
++
+ #endif /* __POLICY_INTERFACE_H */
+diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
+index 9c3fec2c7cf6b..fbddf6450195d 100644
+--- a/security/apparmor/policy_unpack.c
++++ b/security/apparmor/policy_unpack.c
+@@ -14,6 +14,7 @@
+ */
+
+ #include <asm/unaligned.h>
++#include <kunit/visibility.h>
+ #include <linux/ctype.h>
+ #include <linux/errno.h>
+ #include <linux/zlib.h>
+@@ -37,43 +38,6 @@
+ #define v7 7
+ #define v8 8 /* full network masking */
+
+-/*
+- * The AppArmor interface treats data as a type byte followed by the
+- * actual data. The interface has the notion of a named entry
+- * which has a name (AA_NAME typecode followed by name string) followed by
+- * the entries typecode and data. Named types allow for optional
+- * elements and extensions to be added and tested for without breaking
+- * backwards compatibility.
+- */
+-
+-enum aa_code {
+- AA_U8,
+- AA_U16,
+- AA_U32,
+- AA_U64,
+- AA_NAME, /* same as string except it is items name */
+- AA_STRING,
+- AA_BLOB,
+- AA_STRUCT,
+- AA_STRUCTEND,
+- AA_LIST,
+- AA_LISTEND,
+- AA_ARRAY,
+- AA_ARRAYEND,
+-};
+-
+-/*
+- * aa_ext is the read of the buffer containing the serialized profile. The
+- * data is copied into a kernel buffer in apparmorfs and then handed off to
+- * the unpack routines.
+- */
+-struct aa_ext {
+- void *start;
+- void *end;
+- void *pos; /* pointer to current position in the buffer */
+- u32 version;
+-};
+-
+ /* audit callback for unpack fields */
+ static void audit_cb(struct audit_buffer *ab, void *va)
+ {
+@@ -199,10 +163,11 @@ struct aa_loaddata *aa_loaddata_alloc(size_t size)
+ }
+
+ /* test if read will be in packed data bounds */
+-static bool inbounds(struct aa_ext *e, size_t size)
++VISIBLE_IF_KUNIT bool aa_inbounds(struct aa_ext *e, size_t size)
+ {
+ return (size <= e->end - e->pos);
+ }
++EXPORT_SYMBOL_IF_KUNIT(aa_inbounds);
+
+ static void *kvmemdup(const void *src, size_t len)
+ {
+@@ -214,22 +179,22 @@ static void *kvmemdup(const void *src, size_t len)
+ }
+
+ /**
+- * unpack_u16_chunk - test and do bounds checking for a u16 size based chunk
++ * aa_unpack_u16_chunk - test and do bounds checking for a u16 size based chunk
+ * @e: serialized data read head (NOT NULL)
+ * @chunk: start address for chunk of data (NOT NULL)
+ *
+ * Returns: the size of chunk found with the read head at the end of the chunk.
+ */
+-static size_t unpack_u16_chunk(struct aa_ext *e, char **chunk)
++VISIBLE_IF_KUNIT size_t aa_unpack_u16_chunk(struct aa_ext *e, char **chunk)
+ {
+ size_t size = 0;
+ void *pos = e->pos;
+
+- if (!inbounds(e, sizeof(u16)))
++ if (!aa_inbounds(e, sizeof(u16)))
+ goto fail;
+ size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
+ e->pos += sizeof(__le16);
+- if (!inbounds(e, size))
++ if (!aa_inbounds(e, size))
+ goto fail;
+ *chunk = e->pos;
+ e->pos += size;
+@@ -239,20 +204,22 @@ static size_t unpack_u16_chunk(struct aa_ext *e, char **chunk)
+ e->pos = pos;
+ return 0;
+ }
++EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u16_chunk);
+
+ /* unpack control byte */
+-static bool unpack_X(struct aa_ext *e, enum aa_code code)
++VISIBLE_IF_KUNIT bool aa_unpack_X(struct aa_ext *e, enum aa_code code)
+ {
+- if (!inbounds(e, 1))
++ if (!aa_inbounds(e, 1))
+ return false;
+ if (*(u8 *) e->pos != code)
+ return false;
+ e->pos++;
+ return true;
+ }
++EXPORT_SYMBOL_IF_KUNIT(aa_unpack_X);
+
+ /**
+- * unpack_nameX - check is the next element is of type X with a name of @name
++ * aa_unpack_nameX - check is the next element is of type X with a name of @name
+ * @e: serialized data extent information (NOT NULL)
+ * @code: type code
+ * @name: name to match to the serialized element. (MAYBE NULL)
+@@ -267,7 +234,7 @@ static bool unpack_X(struct aa_ext *e, enum aa_code code)
+ *
+ * Returns: false if either match fails, the read head does not move
+ */
+-static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
++VISIBLE_IF_KUNIT bool aa_unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
+ {
+ /*
+ * May need to reset pos if name or type doesn't match
+@@ -277,9 +244,9 @@ static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
+ * Check for presence of a tagname, and if present name size
+ * AA_NAME tag value is a u16.
+ */
+- if (unpack_X(e, AA_NAME)) {
++ if (aa_unpack_X(e, AA_NAME)) {
+ char *tag = NULL;
+- size_t size = unpack_u16_chunk(e, &tag);
++ size_t size = aa_unpack_u16_chunk(e, &tag);
+ /* if a name is specified it must match. otherwise skip tag */
+ if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag)))
+ goto fail;
+@@ -289,20 +256,21 @@ static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
+ }
+
+ /* now check if type code matches */
+- if (unpack_X(e, code))
++ if (aa_unpack_X(e, code))
+ return true;
+
+ fail:
+ e->pos = pos;
+ return false;
+ }
++EXPORT_SYMBOL_IF_KUNIT(aa_unpack_nameX);
+
+ static bool unpack_u8(struct aa_ext *e, u8 *data, const char *name)
+ {
+ void *pos = e->pos;
+
+- if (unpack_nameX(e, AA_U8, name)) {
+- if (!inbounds(e, sizeof(u8)))
++ if (aa_unpack_nameX(e, AA_U8, name)) {
++ if (!aa_inbounds(e, sizeof(u8)))
+ goto fail;
+ if (data)
+ *data = *((u8 *)e->pos);
+@@ -315,12 +283,12 @@ static bool unpack_u8(struct aa_ext *e, u8 *data, const char *name)
+ return false;
+ }
+
+-static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
++VISIBLE_IF_KUNIT bool aa_unpack_u32(struct aa_ext *e, u32 *data, const char *name)
+ {
+ void *pos = e->pos;
+
+- if (unpack_nameX(e, AA_U32, name)) {
+- if (!inbounds(e, sizeof(u32)))
++ if (aa_unpack_nameX(e, AA_U32, name)) {
++ if (!aa_inbounds(e, sizeof(u32)))
+ goto fail;
+ if (data)
+ *data = le32_to_cpu(get_unaligned((__le32 *) e->pos));
+@@ -332,13 +300,14 @@ static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
+ e->pos = pos;
+ return false;
+ }
++EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u32);
+
+-static bool unpack_u64(struct aa_ext *e, u64 *data, const char *name)
++VISIBLE_IF_KUNIT bool aa_unpack_u64(struct aa_ext *e, u64 *data, const char *name)
+ {
+ void *pos = e->pos;
+
+- if (unpack_nameX(e, AA_U64, name)) {
+- if (!inbounds(e, sizeof(u64)))
++ if (aa_unpack_nameX(e, AA_U64, name)) {
++ if (!aa_inbounds(e, sizeof(u64)))
+ goto fail;
+ if (data)
+ *data = le64_to_cpu(get_unaligned((__le64 *) e->pos));
+@@ -350,14 +319,15 @@ static bool unpack_u64(struct aa_ext *e, u64 *data, const char *name)
+ e->pos = pos;
+ return false;
+ }
++EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u64);
+
+-static size_t unpack_array(struct aa_ext *e, const char *name)
++VISIBLE_IF_KUNIT size_t aa_unpack_array(struct aa_ext *e, const char *name)
+ {
+ void *pos = e->pos;
+
+- if (unpack_nameX(e, AA_ARRAY, name)) {
++ if (aa_unpack_nameX(e, AA_ARRAY, name)) {
+ int size;
+- if (!inbounds(e, sizeof(u16)))
++ if (!aa_inbounds(e, sizeof(u16)))
+ goto fail;
+ size = (int)le16_to_cpu(get_unaligned((__le16 *) e->pos));
+ e->pos += sizeof(u16);
+@@ -368,18 +338,19 @@ static size_t unpack_array(struct aa_ext *e, const char *name)
+ e->pos = pos;
+ return 0;
+ }
++EXPORT_SYMBOL_IF_KUNIT(aa_unpack_array);
+
+-static size_t unpack_blob(struct aa_ext *e, char **blob, const char *name)
++VISIBLE_IF_KUNIT size_t aa_unpack_blob(struct aa_ext *e, char **blob, const char *name)
+ {
+ void *pos = e->pos;
+
+- if (unpack_nameX(e, AA_BLOB, name)) {
++ if (aa_unpack_nameX(e, AA_BLOB, name)) {
+ u32 size;
+- if (!inbounds(e, sizeof(u32)))
++ if (!aa_inbounds(e, sizeof(u32)))
+ goto fail;
+ size = le32_to_cpu(get_unaligned((__le32 *) e->pos));
+ e->pos += sizeof(u32);
+- if (inbounds(e, (size_t) size)) {
++ if (aa_inbounds(e, (size_t) size)) {
+ *blob = e->pos;
+ e->pos += size;
+ return size;
+@@ -390,15 +361,16 @@ static size_t unpack_blob(struct aa_ext *e, char **blob, const char *name)
+ e->pos = pos;
+ return 0;
+ }
++EXPORT_SYMBOL_IF_KUNIT(aa_unpack_blob);
+
+-static int unpack_str(struct aa_ext *e, const char **string, const char *name)
++VISIBLE_IF_KUNIT int aa_unpack_str(struct aa_ext *e, const char **string, const char *name)
+ {
+ char *src_str;
+ size_t size = 0;
+ void *pos = e->pos;
+ *string = NULL;
+- if (unpack_nameX(e, AA_STRING, name)) {
+- size = unpack_u16_chunk(e, &src_str);
++ if (aa_unpack_nameX(e, AA_STRING, name)) {
++ size = aa_unpack_u16_chunk(e, &src_str);
+ if (size) {
+ /* strings are null terminated, length is size - 1 */
+ if (src_str[size - 1] != 0)
+@@ -413,12 +385,13 @@ static int unpack_str(struct aa_ext *e, const char **string, const char *name)
+ e->pos = pos;
+ return 0;
+ }
++EXPORT_SYMBOL_IF_KUNIT(aa_unpack_str);
+
+-static int unpack_strdup(struct aa_ext *e, char **string, const char *name)
++VISIBLE_IF_KUNIT int aa_unpack_strdup(struct aa_ext *e, char **string, const char *name)
+ {
+ const char *tmp;
+ void *pos = e->pos;
+- int res = unpack_str(e, &tmp, name);
++ int res = aa_unpack_str(e, &tmp, name);
+ *string = NULL;
+
+ if (!res)
+@@ -432,6 +405,7 @@ static int unpack_strdup(struct aa_ext *e, char **string, const char *name)
+
+ return res;
+ }
++EXPORT_SYMBOL_IF_KUNIT(aa_unpack_strdup);
+
+
+ /**
+@@ -446,7 +420,7 @@ static struct aa_dfa *unpack_dfa(struct aa_ext *e)
+ size_t size;
+ struct aa_dfa *dfa = NULL;
+
+- size = unpack_blob(e, &blob, "aadfa");
++ size = aa_unpack_blob(e, &blob, "aadfa");
+ if (size) {
+ /*
+ * The dfa is aligned with in the blob to 8 bytes
+@@ -482,10 +456,10 @@ static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
+ void *saved_pos = e->pos;
+
+ /* exec table is optional */
+- if (unpack_nameX(e, AA_STRUCT, "xtable")) {
++ if (aa_unpack_nameX(e, AA_STRUCT, "xtable")) {
+ int i, size;
+
+- size = unpack_array(e, NULL);
++ size = aa_unpack_array(e, NULL);
+ /* currently 4 exec bits and entries 0-3 are reserved iupcx */
+ if (size > 16 - 4)
+ goto fail;
+@@ -497,8 +471,8 @@ static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
+ profile->file.trans.size = size;
+ for (i = 0; i < size; i++) {
+ char *str;
+- int c, j, pos, size2 = unpack_strdup(e, &str, NULL);
+- /* unpack_strdup verifies that the last character is
++ int c, j, pos, size2 = aa_unpack_strdup(e, &str, NULL);
++ /* aa_unpack_strdup verifies that the last character is
+ * null termination byte.
+ */
+ if (!size2)
+@@ -521,7 +495,7 @@ static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
+ goto fail;
+ /* beginning with : requires an embedded \0,
+ * verify that exactly 1 internal \0 exists
+- * trailing \0 already verified by unpack_strdup
++ * trailing \0 already verified by aa_unpack_strdup
+ *
+ * convert \0 back to : for label_parse
+ */
+@@ -533,9 +507,9 @@ static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
+ /* fail - all other cases with embedded \0 */
+ goto fail;
+ }
+- if (!unpack_nameX(e, AA_ARRAYEND, NULL))
++ if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
+ goto fail;
+- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
++ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
+ goto fail;
+ }
+ return true;
+@@ -550,21 +524,21 @@ static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
+ {
+ void *pos = e->pos;
+
+- if (unpack_nameX(e, AA_STRUCT, "xattrs")) {
++ if (aa_unpack_nameX(e, AA_STRUCT, "xattrs")) {
+ int i, size;
+
+- size = unpack_array(e, NULL);
++ size = aa_unpack_array(e, NULL);
+ profile->xattr_count = size;
+ profile->xattrs = kcalloc(size, sizeof(char *), GFP_KERNEL);
+ if (!profile->xattrs)
+ goto fail;
+ for (i = 0; i < size; i++) {
+- if (!unpack_strdup(e, &profile->xattrs[i], NULL))
++ if (!aa_unpack_strdup(e, &profile->xattrs[i], NULL))
+ goto fail;
+ }
+- if (!unpack_nameX(e, AA_ARRAYEND, NULL))
++ if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
+ goto fail;
+- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
++ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
+ goto fail;
+ }
+
+@@ -580,8 +554,8 @@ static bool unpack_secmark(struct aa_ext *e, struct aa_profile *profile)
+ void *pos = e->pos;
+ int i, size;
+
+- if (unpack_nameX(e, AA_STRUCT, "secmark")) {
+- size = unpack_array(e, NULL);
++ if (aa_unpack_nameX(e, AA_STRUCT, "secmark")) {
++ size = aa_unpack_array(e, NULL);
+
+ profile->secmark = kcalloc(size, sizeof(struct aa_secmark),
+ GFP_KERNEL);
+@@ -595,12 +569,12 @@ static bool unpack_secmark(struct aa_ext *e, struct aa_profile *profile)
+ goto fail;
+ if (!unpack_u8(e, &profile->secmark[i].deny, NULL))
+ goto fail;
+- if (!unpack_strdup(e, &profile->secmark[i].label, NULL))
++ if (!aa_unpack_strdup(e, &profile->secmark[i].label, NULL))
+ goto fail;
+ }
+- if (!unpack_nameX(e, AA_ARRAYEND, NULL))
++ if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
+ goto fail;
+- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
++ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
+ goto fail;
+ }
+
+@@ -624,26 +598,26 @@ static bool unpack_rlimits(struct aa_ext *e, struct aa_profile *profile)
+ void *pos = e->pos;
+
+ /* rlimits are optional */
+- if (unpack_nameX(e, AA_STRUCT, "rlimits")) {
++ if (aa_unpack_nameX(e, AA_STRUCT, "rlimits")) {
+ int i, size;
+ u32 tmp = 0;
+- if (!unpack_u32(e, &tmp, NULL))
++ if (!aa_unpack_u32(e, &tmp, NULL))
+ goto fail;
+ profile->rlimits.mask = tmp;
+
+- size = unpack_array(e, NULL);
++ size = aa_unpack_array(e, NULL);
+ if (size > RLIM_NLIMITS)
+ goto fail;
+ for (i = 0; i < size; i++) {
+ u64 tmp2 = 0;
+ int a = aa_map_resource(i);
+- if (!unpack_u64(e, &tmp2, NULL))
++ if (!aa_unpack_u64(e, &tmp2, NULL))
+ goto fail;
+ profile->rlimits.limits[a].rlim_max = tmp2;
+ }
+- if (!unpack_nameX(e, AA_ARRAYEND, NULL))
++ if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
+ goto fail;
+- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
++ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
+ goto fail;
+ }
+ return true;
+@@ -691,9 +665,9 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ *ns_name = NULL;
+
+ /* check that we have the right struct being passed */
+- if (!unpack_nameX(e, AA_STRUCT, "profile"))
++ if (!aa_unpack_nameX(e, AA_STRUCT, "profile"))
+ goto fail;
+- if (!unpack_str(e, &name, NULL))
++ if (!aa_unpack_str(e, &name, NULL))
+ goto fail;
+ if (*name == '\0')
+ goto fail;
+@@ -713,10 +687,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ return ERR_PTR(-ENOMEM);
+
+ /* profile renaming is optional */
+- (void) unpack_str(e, &profile->rename, "rename");
++ (void) aa_unpack_str(e, &profile->rename, "rename");
+
+ /* attachment string is optional */
+- (void) unpack_str(e, &profile->attach, "attach");
++ (void) aa_unpack_str(e, &profile->attach, "attach");
+
+ /* xmatch is optional and may be NULL */
+ profile->xmatch = unpack_dfa(e);
+@@ -728,7 +702,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ }
+ /* xmatch_len is not optional if xmatch is set */
+ if (profile->xmatch) {
+- if (!unpack_u32(e, &tmp, NULL)) {
++ if (!aa_unpack_u32(e, &tmp, NULL)) {
+ info = "missing xmatch len";
+ goto fail;
+ }
+@@ -736,15 +710,15 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ }
+
+ /* disconnected attachment string is optional */
+- (void) unpack_str(e, &profile->disconnected, "disconnected");
++ (void) aa_unpack_str(e, &profile->disconnected, "disconnected");
+
+ /* per profile debug flags (complain, audit) */
+- if (!unpack_nameX(e, AA_STRUCT, "flags")) {
++ if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {
+ info = "profile missing flags";
+ goto fail;
+ }
+ info = "failed to unpack profile flags";
+- if (!unpack_u32(e, &tmp, NULL))
++ if (!aa_unpack_u32(e, &tmp, NULL))
+ goto fail;
+ if (tmp & PACKED_FLAG_HAT)
+ profile->label.flags |= FLAG_HAT;
+@@ -752,7 +726,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ profile->label.flags |= FLAG_DEBUG1;
+ if (tmp & PACKED_FLAG_DEBUG2)
+ profile->label.flags |= FLAG_DEBUG2;
+- if (!unpack_u32(e, &tmp, NULL))
++ if (!aa_unpack_u32(e, &tmp, NULL))
+ goto fail;
+ if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {
+ profile->mode = APPARMOR_COMPLAIN;
+@@ -766,16 +740,16 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ } else {
+ goto fail;
+ }
+- if (!unpack_u32(e, &tmp, NULL))
++ if (!aa_unpack_u32(e, &tmp, NULL))
+ goto fail;
+ if (tmp)
+ profile->audit = AUDIT_ALL;
+
+- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
++ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
+ goto fail;
+
+ /* path_flags is optional */
+- if (unpack_u32(e, &profile->path_flags, "path_flags"))
++ if (aa_unpack_u32(e, &profile->path_flags, "path_flags"))
+ profile->path_flags |= profile->label.flags &
+ PATH_MEDIATE_DELETED;
+ else
+@@ -783,38 +757,38 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ profile->path_flags = PATH_MEDIATE_DELETED;
+
+ info = "failed to unpack profile capabilities";
+- if (!unpack_u32(e, &(profile->caps.allow.cap[0]), NULL))
++ if (!aa_unpack_u32(e, &(profile->caps.allow.cap[0]), NULL))
+ goto fail;
+- if (!unpack_u32(e, &(profile->caps.audit.cap[0]), NULL))
++ if (!aa_unpack_u32(e, &(profile->caps.audit.cap[0]), NULL))
+ goto fail;
+- if (!unpack_u32(e, &(profile->caps.quiet.cap[0]), NULL))
++ if (!aa_unpack_u32(e, &(profile->caps.quiet.cap[0]), NULL))
+ goto fail;
+- if (!unpack_u32(e, &tmpcap.cap[0], NULL))
++ if (!aa_unpack_u32(e, &tmpcap.cap[0], NULL))
+ goto fail;
+
+ info = "failed to unpack upper profile capabilities";
+- if (unpack_nameX(e, AA_STRUCT, "caps64")) {
++ if (aa_unpack_nameX(e, AA_STRUCT, "caps64")) {
+ /* optional upper half of 64 bit caps */
+- if (!unpack_u32(e, &(profile->caps.allow.cap[1]), NULL))
++ if (!aa_unpack_u32(e, &(profile->caps.allow.cap[1]), NULL))
+ goto fail;
+- if (!unpack_u32(e, &(profile->caps.audit.cap[1]), NULL))
++ if (!aa_unpack_u32(e, &(profile->caps.audit.cap[1]), NULL))
+ goto fail;
+- if (!unpack_u32(e, &(profile->caps.quiet.cap[1]), NULL))
++ if (!aa_unpack_u32(e, &(profile->caps.quiet.cap[1]), NULL))
+ goto fail;
+- if (!unpack_u32(e, &(tmpcap.cap[1]), NULL))
++ if (!aa_unpack_u32(e, &(tmpcap.cap[1]), NULL))
+ goto fail;
+- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
++ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
+ goto fail;
+ }
+
+ info = "failed to unpack extended profile capabilities";
+- if (unpack_nameX(e, AA_STRUCT, "capsx")) {
++ if (aa_unpack_nameX(e, AA_STRUCT, "capsx")) {
+ /* optional extended caps mediation mask */
+- if (!unpack_u32(e, &(profile->caps.extended.cap[0]), NULL))
++ if (!aa_unpack_u32(e, &(profile->caps.extended.cap[0]), NULL))
+ goto fail;
+- if (!unpack_u32(e, &(profile->caps.extended.cap[1]), NULL))
++ if (!aa_unpack_u32(e, &(profile->caps.extended.cap[1]), NULL))
+ goto fail;
+- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
++ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
+ goto fail;
+ }
+
+@@ -833,7 +807,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ goto fail;
+ }
+
+- if (unpack_nameX(e, AA_STRUCT, "policydb")) {
++ if (aa_unpack_nameX(e, AA_STRUCT, "policydb")) {
+ /* generic policy dfa - optional and may be NULL */
+ info = "failed to unpack policydb";
+ profile->policy.dfa = unpack_dfa(e);
+@@ -845,7 +819,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ error = -EPROTO;
+ goto fail;
+ }
+- if (!unpack_u32(e, &profile->policy.start[0], "start"))
++ if (!aa_unpack_u32(e, &profile->policy.start[0], "start"))
+ /* default start state */
+ profile->policy.start[0] = DFA_START;
+ /* setup class index */
+@@ -855,7 +829,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ profile->policy.start[0],
+ i);
+ }
+- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
++ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
+ goto fail;
+ } else
+ profile->policy.dfa = aa_get_dfa(nulldfa);
+@@ -868,7 +842,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ info = "failed to unpack profile file rules";
+ goto fail;
+ } else if (profile->file.dfa) {
+- if (!unpack_u32(e, &profile->file.start, "dfa_start"))
++ if (!aa_unpack_u32(e, &profile->file.start, "dfa_start"))
+ /* default start state */
+ profile->file.start = DFA_START;
+ } else if (profile->policy.dfa &&
+@@ -883,7 +857,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ goto fail;
+ }
+
+- if (unpack_nameX(e, AA_STRUCT, "data")) {
++ if (aa_unpack_nameX(e, AA_STRUCT, "data")) {
+ info = "out of memory";
+ profile->data = kzalloc(sizeof(*profile->data), GFP_KERNEL);
+ if (!profile->data)
+@@ -901,7 +875,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ goto fail;
+ }
+
+- while (unpack_strdup(e, &key, NULL)) {
++ while (aa_unpack_strdup(e, &key, NULL)) {
+ data = kzalloc(sizeof(*data), GFP_KERNEL);
+ if (!data) {
+ kfree_sensitive(key);
+@@ -909,7 +883,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ }
+
+ data->key = key;
+- data->size = unpack_blob(e, &data->data, NULL);
++ data->size = aa_unpack_blob(e, &data->data, NULL);
+ data->data = kvmemdup(data->data, data->size);
+ if (data->size && !data->data) {
+ kfree_sensitive(data->key);
+@@ -926,13 +900,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ }
+ }
+
+- if (!unpack_nameX(e, AA_STRUCTEND, NULL)) {
++ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
+ info = "failed to unpack end of key, value data table";
+ goto fail;
+ }
+ }
+
+- if (!unpack_nameX(e, AA_STRUCTEND, NULL)) {
++ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
+ info = "failed to unpack end of profile";
+ goto fail;
+ }
+@@ -965,7 +939,7 @@ static int verify_header(struct aa_ext *e, int required, const char **ns)
+ *ns = NULL;
+
+ /* get the interface version */
+- if (!unpack_u32(e, &e->version, "version")) {
++ if (!aa_unpack_u32(e, &e->version, "version")) {
+ if (required) {
+ audit_iface(NULL, NULL, NULL, "invalid profile format",
+ e, error);
+@@ -984,7 +958,7 @@ static int verify_header(struct aa_ext *e, int required, const char **ns)
+ }
+
+ /* read the namespace if present */
+- if (unpack_str(e, &name, "namespace")) {
++ if (aa_unpack_str(e, &name, "namespace")) {
+ if (*name == '\0') {
+ audit_iface(NULL, NULL, NULL, "invalid namespace name",
+ e, error);
+@@ -1256,7 +1230,3 @@ int aa_unpack(struct aa_loaddata *udata, struct list_head *lh,
+
+ return error;
+ }
+-
+-#ifdef CONFIG_SECURITY_APPARMOR_KUNIT_TEST
+-#include "policy_unpack_test.c"
+-#endif /* CONFIG_SECURITY_APPARMOR_KUNIT_TEST */
+diff --git a/security/apparmor/policy_unpack_test.c b/security/apparmor/policy_unpack_test.c
+index 0a969b2e03dba..f25cf2a023d57 100644
+--- a/security/apparmor/policy_unpack_test.c
++++ b/security/apparmor/policy_unpack_test.c
+@@ -4,6 +4,7 @@
+ */
+
+ #include <kunit/test.h>
++#include <kunit/visibility.h>
+
+ #include "include/policy.h"
+ #include "include/policy_unpack.h"
+@@ -43,6 +44,8 @@
+ #define TEST_ARRAY_BUF_OFFSET \
+ (TEST_NAMED_ARRAY_BUF_OFFSET + 3 + strlen(TEST_ARRAY_NAME) + 1)
+
++MODULE_IMPORT_NS(EXPORTED_FOR_KUNIT_TESTING);
++
+ struct policy_unpack_fixture {
+ struct aa_ext *e;
+ size_t e_size;
+@@ -125,16 +128,16 @@ static void policy_unpack_test_inbounds_when_inbounds(struct kunit *test)
+ {
+ struct policy_unpack_fixture *puf = test->priv;
+
+- KUNIT_EXPECT_TRUE(test, inbounds(puf->e, 0));
+- KUNIT_EXPECT_TRUE(test, inbounds(puf->e, puf->e_size / 2));
+- KUNIT_EXPECT_TRUE(test, inbounds(puf->e, puf->e_size));
++ KUNIT_EXPECT_TRUE(test, aa_inbounds(puf->e, 0));
++ KUNIT_EXPECT_TRUE(test, aa_inbounds(puf->e, puf->e_size / 2));
++ KUNIT_EXPECT_TRUE(test, aa_inbounds(puf->e, puf->e_size));
+ }
+
+ static void policy_unpack_test_inbounds_when_out_of_bounds(struct kunit *test)
+ {
+ struct policy_unpack_fixture *puf = test->priv;
+
+- KUNIT_EXPECT_FALSE(test, inbounds(puf->e, puf->e_size + 1));
++ KUNIT_EXPECT_FALSE(test, aa_inbounds(puf->e, puf->e_size + 1));
+ }
+
+ static void policy_unpack_test_unpack_array_with_null_name(struct kunit *test)
+@@ -144,7 +147,7 @@ static void policy_unpack_test_unpack_array_with_null_name(struct kunit *test)
+
+ puf->e->pos += TEST_ARRAY_BUF_OFFSET;
+
+- array_size = unpack_array(puf->e, NULL);
++ array_size = aa_unpack_array(puf->e, NULL);
+
+ KUNIT_EXPECT_EQ(test, array_size, (u16)TEST_ARRAY_SIZE);
+ KUNIT_EXPECT_PTR_EQ(test, puf->e->pos,
+@@ -159,7 +162,7 @@ static void policy_unpack_test_unpack_array_with_name(struct kunit *test)
+
+ puf->e->pos += TEST_NAMED_ARRAY_BUF_OFFSET;
+
+- array_size = unpack_array(puf->e, name);
++ array_size = aa_unpack_array(puf->e, name);
+
+ KUNIT_EXPECT_EQ(test, array_size, (u16)TEST_ARRAY_SIZE);
+ KUNIT_EXPECT_PTR_EQ(test, puf->e->pos,
+@@ -175,7 +178,7 @@ static void policy_unpack_test_unpack_array_out_of_bounds(struct kunit *test)
+ puf->e->pos += TEST_NAMED_ARRAY_BUF_OFFSET;
+ puf->e->end = puf->e->start + TEST_ARRAY_BUF_OFFSET + sizeof(u16);
+
+- array_size = unpack_array(puf->e, name);
++ array_size = aa_unpack_array(puf->e, name);
+
+ KUNIT_EXPECT_EQ(test, array_size, 0);
+ KUNIT_EXPECT_PTR_EQ(test, puf->e->pos,
+@@ -189,7 +192,7 @@ static void policy_unpack_test_unpack_blob_with_null_name(struct kunit *test)
+ size_t size;
+
+ puf->e->pos += TEST_BLOB_BUF_OFFSET;
+- size = unpack_blob(puf->e, &blob, NULL);
++ size = aa_unpack_blob(puf->e, &blob, NULL);
+
+ KUNIT_ASSERT_EQ(test, size, TEST_BLOB_DATA_SIZE);
+ KUNIT_EXPECT_TRUE(test,
+@@ -203,7 +206,7 @@ static void policy_unpack_test_unpack_blob_with_name(struct kunit *test)
+ size_t size;
+
+ puf->e->pos += TEST_NAMED_BLOB_BUF_OFFSET;
+- size = unpack_blob(puf->e, &blob, TEST_BLOB_NAME);
++ size = aa_unpack_blob(puf->e, &blob, TEST_BLOB_NAME);
+
+ KUNIT_ASSERT_EQ(test, size, TEST_BLOB_DATA_SIZE);
+ KUNIT_EXPECT_TRUE(test,
+@@ -222,7 +225,7 @@ static void policy_unpack_test_unpack_blob_out_of_bounds(struct kunit *test)
+ puf->e->end = puf->e->start + TEST_BLOB_BUF_OFFSET
+ + TEST_BLOB_DATA_SIZE - 1;
+
+- size = unpack_blob(puf->e, &blob, TEST_BLOB_NAME);
++ size = aa_unpack_blob(puf->e, &blob, TEST_BLOB_NAME);
+
+ KUNIT_EXPECT_EQ(test, size, 0);
+ KUNIT_EXPECT_PTR_EQ(test, puf->e->pos, start);
+@@ -235,7 +238,7 @@ static void policy_unpack_test_unpack_str_with_null_name(struct kunit *test)
+ size_t size;
+
+ puf->e->pos += TEST_STRING_BUF_OFFSET;
+- size = unpack_str(puf->e, &string, NULL);
++ size = aa_unpack_str(puf->e, &string, NULL);
+
+ KUNIT_EXPECT_EQ(test, size, strlen(TEST_STRING_DATA) + 1);
+ KUNIT_EXPECT_STREQ(test, string, TEST_STRING_DATA);
+@@ -247,7 +250,7 @@ static void policy_unpack_test_unpack_str_with_name(struct kunit *test)
+ const char *string = NULL;
+ size_t size;
+
+- size = unpack_str(puf->e, &string, TEST_STRING_NAME);
++ size = aa_unpack_str(puf->e, &string, TEST_STRING_NAME);
+
+ KUNIT_EXPECT_EQ(test, size, strlen(TEST_STRING_DATA) + 1);
+ KUNIT_EXPECT_STREQ(test, string, TEST_STRING_DATA);
+@@ -263,7 +266,7 @@ static void policy_unpack_test_unpack_str_out_of_bounds(struct kunit *test)
+ puf->e->end = puf->e->pos + TEST_STRING_BUF_OFFSET
+ + strlen(TEST_STRING_DATA) - 1;
+
+- size = unpack_str(puf->e, &string, TEST_STRING_NAME);
++ size = aa_unpack_str(puf->e, &string, TEST_STRING_NAME);
+
+ KUNIT_EXPECT_EQ(test, size, 0);
+ KUNIT_EXPECT_PTR_EQ(test, puf->e->pos, start);
+@@ -276,7 +279,7 @@ static void policy_unpack_test_unpack_strdup_with_null_name(struct kunit *test)
+ size_t size;
+
+ puf->e->pos += TEST_STRING_BUF_OFFSET;
+- size = unpack_strdup(puf->e, &string, NULL);
++ size = aa_unpack_strdup(puf->e, &string, NULL);
+
+ KUNIT_EXPECT_EQ(test, size, strlen(TEST_STRING_DATA) + 1);
+ KUNIT_EXPECT_FALSE(test,
+@@ -291,7 +294,7 @@ static void policy_unpack_test_unpack_strdup_with_name(struct kunit *test)
+ char *string = NULL;
+ size_t size;
+
+- size = unpack_strdup(puf->e, &string, TEST_STRING_NAME);
++ size = aa_unpack_strdup(puf->e, &string, TEST_STRING_NAME);
+
+ KUNIT_EXPECT_EQ(test, size, strlen(TEST_STRING_DATA) + 1);
+ KUNIT_EXPECT_FALSE(test,
+@@ -310,7 +313,7 @@ static void policy_unpack_test_unpack_strdup_out_of_bounds(struct kunit *test)
+ puf->e->end = puf->e->pos + TEST_STRING_BUF_OFFSET
+ + strlen(TEST_STRING_DATA) - 1;
+
+- size = unpack_strdup(puf->e, &string, TEST_STRING_NAME);
++ size = aa_unpack_strdup(puf->e, &string, TEST_STRING_NAME);
+
+ KUNIT_EXPECT_EQ(test, size, 0);
+ KUNIT_EXPECT_NULL(test, string);
+@@ -324,7 +327,7 @@ static void policy_unpack_test_unpack_nameX_with_null_name(struct kunit *test)
+
+ puf->e->pos += TEST_U32_BUF_OFFSET;
+
+- success = unpack_nameX(puf->e, AA_U32, NULL);
++ success = aa_unpack_nameX(puf->e, AA_U32, NULL);
+
+ KUNIT_EXPECT_TRUE(test, success);
+ KUNIT_EXPECT_PTR_EQ(test, puf->e->pos,
+@@ -338,7 +341,7 @@ static void policy_unpack_test_unpack_nameX_with_wrong_code(struct kunit *test)
+
+ puf->e->pos += TEST_U32_BUF_OFFSET;
+
+- success = unpack_nameX(puf->e, AA_BLOB, NULL);
++ success = aa_unpack_nameX(puf->e, AA_BLOB, NULL);
+
+ KUNIT_EXPECT_FALSE(test, success);
+ KUNIT_EXPECT_PTR_EQ(test, puf->e->pos,
+@@ -353,7 +356,7 @@ static void policy_unpack_test_unpack_nameX_with_name(struct kunit *test)
+
+ puf->e->pos += TEST_NAMED_U32_BUF_OFFSET;
+
+- success = unpack_nameX(puf->e, AA_U32, name);
++ success = aa_unpack_nameX(puf->e, AA_U32, name);
+
+ KUNIT_EXPECT_TRUE(test, success);
+ KUNIT_EXPECT_PTR_EQ(test, puf->e->pos,
+@@ -368,7 +371,7 @@ static void policy_unpack_test_unpack_nameX_with_wrong_name(struct kunit *test)
+
+ puf->e->pos += TEST_NAMED_U32_BUF_OFFSET;
+
+- success = unpack_nameX(puf->e, AA_U32, name);
++ success = aa_unpack_nameX(puf->e, AA_U32, name);
+
+ KUNIT_EXPECT_FALSE(test, success);
+ KUNIT_EXPECT_PTR_EQ(test, puf->e->pos,
+@@ -389,7 +392,7 @@ static void policy_unpack_test_unpack_u16_chunk_basic(struct kunit *test)
+ */
+ puf->e->end += TEST_U16_DATA;
+
+- size = unpack_u16_chunk(puf->e, &chunk);
++ size = aa_unpack_u16_chunk(puf->e, &chunk);
+
+ KUNIT_EXPECT_PTR_EQ(test, chunk,
+ puf->e->start + TEST_U16_OFFSET + 2);
+@@ -406,7 +409,7 @@ static void policy_unpack_test_unpack_u16_chunk_out_of_bounds_1(
+
+ puf->e->pos = puf->e->end - 1;
+
+- size = unpack_u16_chunk(puf->e, &chunk);
++ size = aa_unpack_u16_chunk(puf->e, &chunk);
+
+ KUNIT_EXPECT_EQ(test, size, 0);
+ KUNIT_EXPECT_NULL(test, chunk);
+@@ -428,7 +431,7 @@ static void policy_unpack_test_unpack_u16_chunk_out_of_bounds_2(
+ */
+ puf->e->end = puf->e->pos + TEST_U16_DATA - 1;
+
+- size = unpack_u16_chunk(puf->e, &chunk);
++ size = aa_unpack_u16_chunk(puf->e, &chunk);
+
+ KUNIT_EXPECT_EQ(test, size, 0);
+ KUNIT_EXPECT_NULL(test, chunk);
+@@ -443,7 +446,7 @@ static void policy_unpack_test_unpack_u32_with_null_name(struct kunit *test)
+
+ puf->e->pos += TEST_U32_BUF_OFFSET;
+
+- success = unpack_u32(puf->e, &data, NULL);
++ success = aa_unpack_u32(puf->e, &data, NULL);
+
+ KUNIT_EXPECT_TRUE(test, success);
+ KUNIT_EXPECT_EQ(test, data, TEST_U32_DATA);
+@@ -460,7 +463,7 @@ static void policy_unpack_test_unpack_u32_with_name(struct kunit *test)
+
+ puf->e->pos += TEST_NAMED_U32_BUF_OFFSET;
+
+- success = unpack_u32(puf->e, &data, name);
++ success = aa_unpack_u32(puf->e, &data, name);
+
+ KUNIT_EXPECT_TRUE(test, success);
+ KUNIT_EXPECT_EQ(test, data, TEST_U32_DATA);
+@@ -478,7 +481,7 @@ static void policy_unpack_test_unpack_u32_out_of_bounds(struct kunit *test)
+ puf->e->pos += TEST_NAMED_U32_BUF_OFFSET;
+ puf->e->end = puf->e->start + TEST_U32_BUF_OFFSET + sizeof(u32);
+
+- success = unpack_u32(puf->e, &data, name);
++ success = aa_unpack_u32(puf->e, &data, name);
+
+ KUNIT_EXPECT_FALSE(test, success);
+ KUNIT_EXPECT_PTR_EQ(test, puf->e->pos,
+@@ -493,7 +496,7 @@ static void policy_unpack_test_unpack_u64_with_null_name(struct kunit *test)
+
+ puf->e->pos += TEST_U64_BUF_OFFSET;
+
+- success = unpack_u64(puf->e, &data, NULL);
++ success = aa_unpack_u64(puf->e, &data, NULL);
+
+ KUNIT_EXPECT_TRUE(test, success);
+ KUNIT_EXPECT_EQ(test, data, TEST_U64_DATA);
+@@ -510,7 +513,7 @@ static void policy_unpack_test_unpack_u64_with_name(struct kunit *test)
+
+ puf->e->pos += TEST_NAMED_U64_BUF_OFFSET;
+
+- success = unpack_u64(puf->e, &data, name);
++ success = aa_unpack_u64(puf->e, &data, name);
+
+ KUNIT_EXPECT_TRUE(test, success);
+ KUNIT_EXPECT_EQ(test, data, TEST_U64_DATA);
+@@ -528,7 +531,7 @@ static void policy_unpack_test_unpack_u64_out_of_bounds(struct kunit *test)
+ puf->e->pos += TEST_NAMED_U64_BUF_OFFSET;
+ puf->e->end = puf->e->start + TEST_U64_BUF_OFFSET + sizeof(u64);
+
+- success = unpack_u64(puf->e, &data, name);
++ success = aa_unpack_u64(puf->e, &data, name);
+
+ KUNIT_EXPECT_FALSE(test, success);
+ KUNIT_EXPECT_PTR_EQ(test, puf->e->pos,
+@@ -538,7 +541,7 @@ static void policy_unpack_test_unpack_u64_out_of_bounds(struct kunit *test)
+ static void policy_unpack_test_unpack_X_code_match(struct kunit *test)
+ {
+ struct policy_unpack_fixture *puf = test->priv;
+- bool success = unpack_X(puf->e, AA_NAME);
++ bool success = aa_unpack_X(puf->e, AA_NAME);
+
+ KUNIT_EXPECT_TRUE(test, success);
+ KUNIT_EXPECT_TRUE(test, puf->e->pos == puf->e->start + 1);
+@@ -547,7 +550,7 @@ static void policy_unpack_test_unpack_X_code_match(struct kunit *test)
+ static void policy_unpack_test_unpack_X_code_mismatch(struct kunit *test)
+ {
+ struct policy_unpack_fixture *puf = test->priv;
+- bool success = unpack_X(puf->e, AA_STRING);
++ bool success = aa_unpack_X(puf->e, AA_STRING);
+
+ KUNIT_EXPECT_FALSE(test, success);
+ KUNIT_EXPECT_TRUE(test, puf->e->pos == puf->e->start);
+@@ -559,7 +562,7 @@ static void policy_unpack_test_unpack_X_out_of_bounds(struct kunit *test)
+ bool success;
+
+ puf->e->pos = puf->e->end;
+- success = unpack_X(puf->e, AA_NAME);
++ success = aa_unpack_X(puf->e, AA_NAME);
+
+ KUNIT_EXPECT_FALSE(test, success);
+ }
+@@ -605,3 +608,5 @@ static struct kunit_suite apparmor_policy_unpack_test_module = {
+ };
+
+ kunit_test_suite(apparmor_policy_unpack_test_module);
++
++MODULE_LICENSE("GPL");
+--
+2.42.0
+
--- /dev/null
+From 0669cbc7f794d36e2bb365b3e1db8e7db2c596bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Aug 2023 15:06:06 +0100
+Subject: ARM: 9321/1: memset: cast the constant byte to unsigned char
+
+From: Kursad Oney <kursad.oney@broadcom.com>
+
+[ Upstream commit c0e824661f443b8cab3897006c1bbc69fd0e7bc4 ]
+
+memset() description in ISO/IEC 9899:1999 (and elsewhere) says:
+
+ The memset function copies the value of c (converted to an
+ unsigned char) into each of the first n characters of the
+ object pointed to by s.
+
+The kernel's arm32 memset does not cast c to unsigned char. This results
+in the following code to produce erroneous output:
+
+ char a[128];
+ memset(a, -128, sizeof(a));
+
+This is because gcc will generally emit the following code before
+it calls memset() :
+
+ mov r0, r7
+ mvn r1, #127 ; 0x7f
+ bl 00000000 <memset>
+
+r1 ends up with 0xffffff80 before being used by memset() and the
+'a' array will have -128 once in every four bytes while the other
+bytes will be set incorrectly to -1 like this (printing the first
+8 bytes) :
+
+ test_module: -128 -1 -1 -1
+ test_module: -1 -1 -1 -128
+
+The change here is to 'and' r1 with 255 before it is used.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Kursad Oney <kursad.oney@broadcom.com>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/lib/memset.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/lib/memset.S b/arch/arm/lib/memset.S
+index d71ab61430b26..de75ae4d5ab41 100644
+--- a/arch/arm/lib/memset.S
++++ b/arch/arm/lib/memset.S
+@@ -17,6 +17,7 @@ ENTRY(__memset)
+ ENTRY(mmioset)
+ WEAK(memset)
+ UNWIND( .fnstart )
++ and r1, r1, #255 @ cast to unsigned char
+ ands r3, r0, #3 @ 1 unaligned?
+ mov ip, r0 @ preserve r0 as return value
+ bne 6f @ 1
+--
+2.42.0
+
--- /dev/null
+From 44fb179bdebb241e71d9d99d14c0e6a4a216453e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 19:04:01 -0500
+Subject: ARM: dts: am3517-evm: Fix LED3/4 pinmux
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 2ab6b437c65233f06bdd2988fd5913baeca5f159 ]
+
+The pinmux for LED3 and LED4 are incorrectly attached to the
+omap3_pmx_core when they should be connected to the omap3_pmx_wkup
+pin mux. This was likely masked by the fact that the bootloader
+used to do all the pinmuxing.
+
+Fixes: 0dbf99542caf ("ARM: dts: am3517-evm: Add User LEDs and Pushbutton")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Message-ID: <20231005000402.50879-1-aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am3517-evm.dts | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am3517-evm.dts b/arch/arm/boot/dts/am3517-evm.dts
+index 54f4be22784fa..585c2885afa41 100644
+--- a/arch/arm/boot/dts/am3517-evm.dts
++++ b/arch/arm/boot/dts/am3517-evm.dts
+@@ -271,13 +271,6 @@ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda */
+ >;
+ };
+
+- leds_pins: leds-pins {
+- pinctrl-single,pins = <
+- OMAP3_WKUP_IOPAD(0x2a24, PIN_OUTPUT_PULLUP | MUX_MODE4) /* jtag_emu0.gpio_11 */
+- OMAP3_WKUP_IOPAD(0x2a26, PIN_OUTPUT_PULLUP | MUX_MODE4) /* jtag_emu1.gpio_31 */
+- >;
+- };
+-
+ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+@@ -355,3 +348,12 @@ OMAP3430_CORE2_IOPAD(0x25e2, PIN_INPUT | MUX_MODE3) /* etk_d3.hsusb1_data7 */
+ >;
+ };
+ };
++
++&omap3_pmx_wkup {
++ leds_pins: leds-pins {
++ pinctrl-single,pins = <
++ OMAP3_WKUP_IOPAD(0x2a24, PIN_OUTPUT_PULLUP | MUX_MODE4) /* jtag_emu0.gpio_11 */
++ OMAP3_WKUP_IOPAD(0x2a26, PIN_OUTPUT_PULLUP | MUX_MODE4) /* jtag_emu1.gpio_31 */
++ >;
++ };
++};
+--
+2.42.0
+
--- /dev/null
+From 13277808f3d6ba2e0cb33e2d93d60fbf5acb1281 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Sep 2023 20:39:13 +0200
+Subject: ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 09f8ee81b6da5f76de8b83c8bfc4475b54e101e0 ]
+
+Fixed regulator put under "regulators" node will not be populated,
+unless simple-bus or something similar is used. Drop the "regulators"
+wrapper node to fix this.
+
+Fixes: 2c5e596524e7 ("ARM: dts: Add MDM9615 dtsi")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230924183914.51414-3-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-mdm9615.dtsi | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-mdm9615.dtsi b/arch/arm/boot/dts/qcom-mdm9615.dtsi
+index b47c86412de2c..17a1a06dfb3f1 100644
+--- a/arch/arm/boot/dts/qcom-mdm9615.dtsi
++++ b/arch/arm/boot/dts/qcom-mdm9615.dtsi
+@@ -82,14 +82,12 @@ cxo_board {
+ };
+ };
+
+- regulators {
+- vsdcc_fixed: vsdcc-regulator {
+- compatible = "regulator-fixed";
+- regulator-name = "SDCC Power";
+- regulator-min-microvolt = <2700000>;
+- regulator-max-microvolt = <2700000>;
+- regulator-always-on;
+- };
++ vsdcc_fixed: vsdcc-regulator {
++ compatible = "regulator-fixed";
++ regulator-name = "SDCC Power";
++ regulator-min-microvolt = <2700000>;
++ regulator-max-microvolt = <2700000>;
++ regulator-always-on;
+ };
+
+ soc: soc {
+--
+2.42.0
+
--- /dev/null
+From 4bc192f16ce72ee0a4ca63df79687c44aac83e59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Aug 2023 17:21:38 +0200
+Subject: ARM: dts: renesas: blanche: Fix typo in GP_11_2 pin name
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit edc6ef026fe69154bb6b70dd6e7f278cfd7d6919 ]
+
+On blanche, the GPIO keyboard fails to probe with:
+
+ sh-pfc e6060000.pinctrl: could not map pin config for "GP_11_02"
+
+Fix this by correcting the name for this pin to "GP_11_2".
+
+Fixes: 1f27fedead91eb60 ("ARM: dts: blanche: Configure pull-up for SOFT_SW and SW25 GPIO keys")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/203128eca2261ffc33b83637818dd39c488f42b0.1693408326.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a7792-blanche.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/r8a7792-blanche.dts b/arch/arm/boot/dts/r8a7792-blanche.dts
+index c66de9dd12dfc..6a83923aa4612 100644
+--- a/arch/arm/boot/dts/r8a7792-blanche.dts
++++ b/arch/arm/boot/dts/r8a7792-blanche.dts
+@@ -239,7 +239,7 @@ du1_pins: du1 {
+ };
+
+ keyboard_pins: keyboard {
+- pins = "GP_3_10", "GP_3_11", "GP_3_12", "GP_3_15", "GP_11_02";
++ pins = "GP_3_10", "GP_3_11", "GP_3_12", "GP_3_15", "GP_11_2";
+ bias-pull-up;
+ };
+
+--
+2.42.0
+
--- /dev/null
+From 349dc8d10273870b945d9b06744dcaf589399f52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 12:26:19 +0300
+Subject: ARM: dts: Unify pinctrl-single pin group nodes for omap3
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 46bab63e1dcf5aa683a47d431aeff79106c0794b ]
+
+We want to unify the pinctrl-single pin group nodes to use naming "pins".
+Otherwise non-standad pin group names will add make dtbs checks errors
+when the pinctrl-single yaml binding gets merged.
+
+Cc: Conor Dooley <conor+dt@kernel.org>
+Cc: Krzysztof Kozlowski <krzysztof.kozlowski+dt@linaro.org>
+Cc: Rob Herring <robh+dt@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Stable-dep-of: 2ab6b437c652 ("ARM: dts: am3517-evm: Fix LED3/4 pinmux")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am3517-craneboard.dts | 2 +-
+ arch/arm/boot/dts/am3517-evm-ui.dtsi | 4 +-
+ arch/arm/boot/dts/am3517-evm.dts | 20 +++----
+ arch/arm/boot/dts/am3517-som.dtsi | 14 ++---
+ .../boot/dts/logicpd-som-lv-35xx-devkit.dts | 2 +-
+ .../boot/dts/logicpd-som-lv-37xx-devkit.dts | 2 +-
+ .../boot/dts/logicpd-som-lv-baseboard.dtsi | 16 +++---
+ arch/arm/boot/dts/logicpd-som-lv.dtsi | 24 ++++-----
+ .../boot/dts/logicpd-torpedo-35xx-devkit.dts | 2 +-
+ .../boot/dts/logicpd-torpedo-37xx-devkit.dts | 6 +--
+ .../boot/dts/logicpd-torpedo-baseboard.dtsi | 26 ++++-----
+ arch/arm/boot/dts/logicpd-torpedo-som.dtsi | 14 ++---
+ arch/arm/boot/dts/omap3-beagle-xm.dts | 14 ++---
+ arch/arm/boot/dts/omap3-beagle.dts | 14 ++---
+ arch/arm/boot/dts/omap3-cm-t3517.dts | 14 ++---
+ arch/arm/boot/dts/omap3-cm-t3530.dts | 2 +-
+ arch/arm/boot/dts/omap3-cm-t3730.dts | 6 +--
+ arch/arm/boot/dts/omap3-cm-t3x.dtsi | 20 +++----
+ arch/arm/boot/dts/omap3-cm-t3x30.dtsi | 4 +-
+ .../arm/boot/dts/omap3-devkit8000-common.dtsi | 2 +-
+ arch/arm/boot/dts/omap3-echo.dts | 12 ++---
+ arch/arm/boot/dts/omap3-evm-37xx.dts | 4 +-
+ arch/arm/boot/dts/omap3-evm-common.dtsi | 2 +-
+ .../boot/dts/omap3-evm-processor-common.dtsi | 18 +++----
+ arch/arm/boot/dts/omap3-evm.dts | 4 +-
+ arch/arm/boot/dts/omap3-gta04.dtsi | 54 +++++++++----------
+ arch/arm/boot/dts/omap3-gta04a5.dts | 10 ++--
+ arch/arm/boot/dts/omap3-gta04a5one.dts | 2 +-
+ arch/arm/boot/dts/omap3-ha-common.dtsi | 16 +++---
+ arch/arm/boot/dts/omap3-ha-lcd.dts | 10 ++--
+ arch/arm/boot/dts/omap3-igep.dtsi | 16 +++---
+ arch/arm/boot/dts/omap3-igep0020-common.dtsi | 14 ++---
+ arch/arm/boot/dts/omap3-igep0020-rev-f.dts | 2 +-
+ arch/arm/boot/dts/omap3-igep0020.dts | 2 +-
+ arch/arm/boot/dts/omap3-igep0030-common.dtsi | 10 ++--
+ arch/arm/boot/dts/omap3-igep0030-rev-g.dts | 4 +-
+ arch/arm/boot/dts/omap3-igep0030.dts | 2 +-
+ arch/arm/boot/dts/omap3-ldp.dts | 6 +--
+ arch/arm/boot/dts/omap3-lilly-a83x.dtsi | 30 +++++------
+ arch/arm/boot/dts/omap3-lilly-dbb056.dts | 12 ++---
+ arch/arm/boot/dts/omap3-n900.dts | 34 ++++++------
+ arch/arm/boot/dts/omap3-n950-n9.dtsi | 18 +++----
+ arch/arm/boot/dts/omap3-n950.dts | 8 +--
+ .../boot/dts/omap3-overo-alto35-common.dtsi | 4 +-
+ arch/arm/boot/dts/omap3-overo-base.dtsi | 14 ++---
+ arch/arm/boot/dts/omap3-overo-chestnut43.dts | 4 +-
+ arch/arm/boot/dts/omap3-overo-common-dvi.dtsi | 2 +-
+ .../boot/dts/omap3-overo-common-lcd35.dtsi | 10 ++--
+ .../boot/dts/omap3-overo-common-lcd43.dtsi | 10 ++--
+ .../dts/omap3-overo-common-peripherals.dtsi | 4 +-
+ arch/arm/boot/dts/omap3-overo-gallop43.dts | 4 +-
+ arch/arm/boot/dts/omap3-overo-palo35.dts | 4 +-
+ arch/arm/boot/dts/omap3-overo-palo43.dts | 4 +-
+ .../boot/dts/omap3-overo-storm-chestnut43.dts | 4 +-
+ .../boot/dts/omap3-overo-storm-gallop43.dts | 4 +-
+ .../arm/boot/dts/omap3-overo-storm-palo35.dts | 4 +-
+ .../arm/boot/dts/omap3-overo-storm-palo43.dts | 4 +-
+ .../arm/boot/dts/omap3-overo-storm-summit.dts | 2 +-
+ arch/arm/boot/dts/omap3-overo-storm.dtsi | 4 +-
+ arch/arm/boot/dts/omap3-overo-summit.dts | 2 +-
+ arch/arm/boot/dts/omap3-overo.dtsi | 4 +-
+ arch/arm/boot/dts/omap3-pandora-1ghz.dts | 6 +--
+ arch/arm/boot/dts/omap3-pandora-600mhz.dts | 6 +--
+ arch/arm/boot/dts/omap3-pandora-common.dtsi | 16 +++---
+ arch/arm/boot/dts/omap3-sb-t35.dtsi | 8 +--
+ arch/arm/boot/dts/omap3-sbc-t3517.dts | 4 +-
+ arch/arm/boot/dts/omap3-sbc-t3530.dts | 2 +-
+ arch/arm/boot/dts/omap3-sbc-t3730.dts | 2 +-
+ arch/arm/boot/dts/omap3-sniper.dts | 20 +++----
+ arch/arm/boot/dts/omap3-tao3530.dtsi | 20 +++----
+ arch/arm/boot/dts/omap3-thunder.dts | 6 +--
+ arch/arm/boot/dts/omap3-zoom3.dts | 18 +++----
+ arch/arm/boot/dts/twl4030_omap3.dtsi | 4 +-
+ 73 files changed, 349 insertions(+), 349 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am3517-craneboard.dts b/arch/arm/boot/dts/am3517-craneboard.dts
+index 3642cfc801941..afae7a4d232ef 100644
+--- a/arch/arm/boot/dts/am3517-craneboard.dts
++++ b/arch/arm/boot/dts/am3517-craneboard.dts
+@@ -72,7 +72,7 @@ &mmc3 {
+ #include "tps65910.dtsi"
+
+ &omap3_pmx_core {
+- tps_pins: pinmux_tps_pins {
++ tps_pins: tps-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21e0, PIN_INPUT_PULLUP | MUX_MODE0) /* sys_nirq.sys_nirq */
+ >;
+diff --git a/arch/arm/boot/dts/am3517-evm-ui.dtsi b/arch/arm/boot/dts/am3517-evm-ui.dtsi
+index 75ad42179aeeb..16b8968d5be8a 100644
+--- a/arch/arm/boot/dts/am3517-evm-ui.dtsi
++++ b/arch/arm/boot/dts/am3517-evm-ui.dtsi
+@@ -197,7 +197,7 @@ &mcbsp2 {
+ };
+
+ &omap3_pmx_core {
+- mcbsp1_pins: pinmux_mcbsp1_pins {
++ mcbsp1_pins: mcbsp1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2190, PIN_OUTPUT | MUX_MODE0) /* mcbsp1_dx.mcbsp1_dx */
+ OMAP3_CORE1_IOPAD(0x2192, PIN_INPUT | MUX_MODE0) /* mcbsp1_dx.mcbsp1_dr */
+@@ -206,7 +206,7 @@ OMAP3_CORE1_IOPAD(0x2198, PIN_INPUT | MUX_MODE0) /* mcbsp1_clkx.mcbsp1_clkx */
+ >;
+ };
+
+- mcbsp2_pins: pinmux_mcbsp2_pins {
++ mcbsp2_pins: mcbsp2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x213c, PIN_INPUT | MUX_MODE0) /* mcbsp2_fsx.mcbsp2_fsx */
+ OMAP3_CORE1_IOPAD(0x213e, PIN_INPUT | MUX_MODE0) /* mcbsp2_clkx.mcbsp2_clkx */
+diff --git a/arch/arm/boot/dts/am3517-evm.dts b/arch/arm/boot/dts/am3517-evm.dts
+index 7bab0a9dadb30..54f4be22784fa 100644
+--- a/arch/arm/boot/dts/am3517-evm.dts
++++ b/arch/arm/boot/dts/am3517-evm.dts
+@@ -242,7 +242,7 @@ &usbhsehci {
+
+ &omap3_pmx_core {
+
+- ethernet_pins: pinmux_ethernet_pins {
++ ethernet_pins: ethernet-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21fe, PIN_INPUT | MUX_MODE0) /* rmii_mdio_data */
+ OMAP3_CORE1_IOPAD(0x2200, MUX_MODE0) /* rmii_mdio_clk */
+@@ -257,28 +257,28 @@ OMAP3_CORE1_IOPAD(0x2210, PIN_INPUT_PULLDOWN | MUX_MODE0) /* rmii_50mhz_clk */
+ >;
+ };
+
+- i2c2_pins: pinmux_i2c2_pins {
++ i2c2_pins: i2c2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_scl */
+ OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_sda */
+ >;
+ };
+
+- i2c3_pins: pinmux_i2c3_pins {
++ i2c3_pins: i2c3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_scl */
+ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda */
+ >;
+ };
+
+- leds_pins: pinmux_leds_pins {
++ leds_pins: leds-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a24, PIN_OUTPUT_PULLUP | MUX_MODE4) /* jtag_emu0.gpio_11 */
+ OMAP3_WKUP_IOPAD(0x2a26, PIN_OUTPUT_PULLUP | MUX_MODE4) /* jtag_emu1.gpio_31 */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -291,19 +291,19 @@ OMAP3_CORE1_IOPAD(0x2152, PIN_INPUT_PULLUP | MUX_MODE4) /* sdmmc1_dat5.gpio_127
+ >;
+ };
+
+- pwm_pins: pinmux_pwm_pins {
++ pwm_pins: pwm-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21dc, PIN_OUTPUT | MUX_MODE1) /* mcspi2_cs0.gpt11_pwm */
+ >;
+ };
+
+- backlight_pins: pinmux_backlight_pins {
++ backlight_pins: backlight-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21de, PIN_OUTPUT | MUX_MODE4) /* mcspi2_cs1.gpio_182 */
+ >;
+ };
+
+- dss_dpi_pins: pinmux_dss_dpi_pins {
++ dss_dpi_pins: dss-dpi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d2, PIN_OUTPUT | MUX_MODE4) /* mcspi1_cs2.gpio_176 */
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+@@ -329,7 +329,7 @@ OMAP3_CORE1_IOPAD(0x20fa, PIN_OUTPUT | MUX_MODE0) /* dss_data15.dss_data15
+ >;
+ };
+
+- hsusb1_rst_pins: pinmux_hsusb1_rst_pins {
++ hsusb1_rst_pins: hsusb1-rst-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20ba, PIN_OUTPUT | MUX_MODE4) /* gpmc_ncs6.gpio_57 */
+ >;
+@@ -338,7 +338,7 @@ OMAP3_CORE1_IOPAD(0x20ba, PIN_OUTPUT | MUX_MODE4) /* gpmc_ncs6.gpio_57 */
+
+ &omap3_pmx_core2 {
+
+- hsusb1_pins: pinmux_hsusb1_pins {
++ hsusb1_pins: hsusb1-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25d8, PIN_OUTPUT | MUX_MODE3) /* etk_clk.hsusb1_stp */
+ OMAP3430_CORE2_IOPAD(0x25da, PIN_OUTPUT | MUX_MODE3) /* etk_ctl.hsusb1_clk */
+diff --git a/arch/arm/boot/dts/am3517-som.dtsi b/arch/arm/boot/dts/am3517-som.dtsi
+index f7b680f6c48ad..bd0a6c95afa16 100644
+--- a/arch/arm/boot/dts/am3517-som.dtsi
++++ b/arch/arm/boot/dts/am3517-som.dtsi
+@@ -181,20 +181,20 @@ bluetooth {
+
+ &omap3_pmx_core {
+
+- i2c1_pins: pinmux_i2c1_pins {
++ i2c1_pins: i2c1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_scl */
+ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_sda */
+ >;
+ };
+
+- wl12xx_buffer_pins: pinmux_wl12xx_buffer_pins {
++ wl12xx_buffer_pins: wl12xx-buffer-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2156, PIN_OUTPUT | MUX_MODE4) /* mmc1_dat7.gpio_129 */
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc2_clk.mmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc2_cmd.mmc2_cmd */
+@@ -210,19 +210,19 @@ OMAP3_CORE1_IOPAD(0x21c6, PIN_INPUT_PULLUP | MUX_MODE4) /* hdq_sio.gpio_170 */
+ >;
+ };
+
+- rtc_pins: pinmux_rtc_pins {
++ rtc_pins: rtc-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20b6, PIN_INPUT_PULLUP | MUX_MODE4) /* gpmc_ncs4.gpio_55 */
+ >;
+ };
+
+- tsc2004_pins: pinmux_tsc2004_pins {
++ tsc2004_pins: tsc2004-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d2, PIN_INPUT | MUX_MODE4) /* gpmc_wait3.gpio_65 */
+ >;
+ };
+
+- uart2_pins: pinmux_uart2_pins {
++ uart2_pins: uart2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2174, PIN_INPUT_PULLUP | MUX_MODE0) /* uart2_cts */
+ OMAP3_CORE1_IOPAD(0x2176, PIN_OUTPUT_PULLUP | MUX_MODE0) /* uart2_rts */
+@@ -235,7 +235,7 @@ OMAP3_CORE1_IOPAD(0x20b8, PIN_INPUT | MUX_MODE0) /* gpio_56 */
+
+ &omap3_pmx_wkup {
+
+- wl12xx_wkup_pins: pinmux_wl12xx_wkup_pins {
++ wl12xx_wkup_pins: wl12xx-wkup-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */
+ >;
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts b/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts
+index 3240c67e0c392..c1705f6f3d108 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts
++++ b/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts
+@@ -15,7 +15,7 @@ / {
+ &omap3_pmx_core2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&hsusb2_2_pins>;
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ hsusb2_2_pins: hsusb2-2-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+ OMAP3430_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
+index c757f0d7781c1..9dbbcc7ced7ce 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
++++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
+@@ -15,7 +15,7 @@ / {
+ &omap3_pmx_core2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&hsusb2_2_pins>;
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ hsusb2_2_pins: hsusb2-2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+ OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+index 7d0468a237818..690f2ad50c653 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+@@ -141,25 +141,25 @@ &mmc1 {
+ };
+
+ &omap3_pmx_core {
+- gpio_key_pins: pinmux_gpio_key_pins {
++ gpio_key_pins: gpio-key-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x212e, PIN_INPUT_PULLUP | MUX_MODE4) /* cam_xclkb.gpio_111 / uP_GPIO_3*/
+ >;
+ };
+
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x215e, PIN_OUTPUT_PULLUP | MUX_MODE4) /* sdmmc2_dat1.gpio_133 / uP_GPIO_0 */
+ >;
+ };
+
+- lan9221_pins: pinmux_lan9221_pins {
++ lan9221_pins: lan9221-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2184, PIN_INPUT_PULLUP | MUX_MODE4) /* mcbsp4_clkx.gpio_152 */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_OUTPUT | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -172,13 +172,13 @@ OMAP3_CORE1_IOPAD(0x212c, PIN_INPUT_PULLUP | MUX_MODE4) /* cam_d11.gpio_110 */
+ >;
+ };
+
+- lcd_enable_pin: pinmux_lcd_enable_pin {
++ lcd_enable_pin: lcd-enable-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x218a, PIN_OUTPUT | PIN_OFF_OUTPUT_LOW | MUX_MODE4) /* mcbsp4_fs.gpio_155 */
+ >;
+ };
+
+- dss_dpi_pins1: pinmux_dss_dpi_pins1 {
++ dss_dpi_pins1: dss-dpi1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT_PULLDOWN | PIN_OFF_OUTPUT_LOW | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT_PULLDOWN | PIN_OFF_OUTPUT_LOW | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -206,13 +206,13 @@ OMAP3_CORE1_IOPAD(0x20fa, PIN_OUTPUT_PULLDOWN | PIN_OFF_OUTPUT_LOW | MUX_MODE0)
+ };
+
+ &omap3_pmx_wkup {
+- led_pins_wkup: pinmux_led_pins_wkup {
++ led_pins_wkup: led-wkup-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a24, PIN_OUTPUT_PULLUP | MUX_MODE4) /* jtag_emu0.gpio_11 / uP_GPIO_1 */
+ >;
+ };
+
+- backlight_pins: pinmux_backlight_pins {
++ backlight_pins: backlight-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a16, PIN_OUTPUT | PIN_OFF_OUTPUT_LOW | MUX_MODE4) /* sys_boot6.gpio_8 */
+ >;
+diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+index 9ba0ea4eb48a8..c0e6b73fa472d 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+@@ -157,7 +157,7 @@ &usbhsehci {
+
+ &omap3_pmx_core {
+
+- mmc3_pins: pinmux_mm3_pins {
++ mmc3_pins: mm3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2164, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat4.sdmmc3_dat0 */
+ OMAP3_CORE1_IOPAD(0x2166, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat5.sdmmc3_dat1 */
+@@ -167,7 +167,7 @@ OMAP3_CORE1_IOPAD(0x21d0, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs1.sdmmc3_cmd
+ OMAP3_CORE1_IOPAD(0x21d2, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs2.sdmmc_clk */
+ >;
+ };
+- mcbsp2_pins: pinmux_mcbsp2_pins {
++ mcbsp2_pins: mcbsp2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x213c, PIN_INPUT | MUX_MODE0) /* mcbsp2_fsx */
+ OMAP3_CORE1_IOPAD(0x213e, PIN_INPUT | MUX_MODE0) /* mcbsp2_clkx */
+@@ -175,7 +175,7 @@ OMAP3_CORE1_IOPAD(0x2140, PIN_INPUT | MUX_MODE0) /* mcbsp2_dr */
+ OMAP3_CORE1_IOPAD(0x2142, PIN_OUTPUT | MUX_MODE0) /* mcbsp2_dx */
+ >;
+ };
+- uart2_pins: pinmux_uart2_pins {
++ uart2_pins: uart2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2174, PIN_INPUT | MUX_MODE0) /* uart2_cts.uart2_cts */
+ OMAP3_CORE1_IOPAD(0x2176, PIN_OUTPUT | MUX_MODE0) /* uart2_rts .uart2_rts*/
+@@ -184,7 +184,7 @@ OMAP3_CORE1_IOPAD(0x217a, PIN_INPUT | MUX_MODE0) /* uart2_rx.uart2_rx */
+ OMAP3_CORE1_IOPAD(0x2198, PIN_OUTPUT | MUX_MODE4) /* GPIO_162,BT_EN */
+ >;
+ };
+- mcspi1_pins: pinmux_mcspi1_pins {
++ mcspi1_pins: mcspi1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c8, PIN_INPUT | MUX_MODE0) /* mcspi1_clk.mcspi1_clk */
+ OMAP3_CORE1_IOPAD(0x21ca, PIN_OUTPUT | MUX_MODE0) /* mcspi1_simo.mcspi1_simo */
+@@ -193,7 +193,7 @@ OMAP3_CORE1_IOPAD(0x21ce, PIN_OUTPUT | MUX_MODE0) /* mcspi1_cs0.mcspi1_cs0
+ >;
+ };
+
+- hsusb2_pins: pinmux_hsusb2_pins {
++ hsusb2_pins: hsusb2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi1_cs3.hsusb2_data2 */
+ OMAP3_CORE1_IOPAD(0x21d6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_clk.hsusb2_data7 */
+@@ -204,7 +204,7 @@ OMAP3_CORE1_IOPAD(0x21de, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_cs1.hs
+ >;
+ };
+
+- hsusb_otg_pins: pinmux_hsusb_otg_pins {
++ hsusb_otg_pins: hsusb-otg-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21a2, PIN_INPUT | MUX_MODE0) /* hsusb0_clk.hsusb0_clk */
+ OMAP3_CORE1_IOPAD(0x21a4, PIN_OUTPUT | MUX_MODE0) /* hsusb0_stp.hsusb0_stp */
+@@ -221,7 +221,7 @@ OMAP3_CORE1_IOPAD(0x21b8, PIN_INPUT | MUX_MODE0) /* hsusb0_data7.hsusb0_data7 */
+ >;
+ };
+
+- i2c1_pins: pinmux_i2c1_pins {
++ i2c1_pins: i2c1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */
+ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */
+@@ -229,21 +229,21 @@ OMAP3_CORE1_IOPAD(0x20ba, PIN_OUTPUT | MUX_MODE4) /* gpmc_ncs6.gpio_57 */
+ >;
+ };
+
+- i2c2_pins: pinmux_i2c2_pins {
++ i2c2_pins: i2c2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT | MUX_MODE0) /* i2c2_scl */
+ OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT | MUX_MODE0) /* i2c2_sda */
+ >;
+ };
+
+- i2c3_pins: pinmux_i2c3_pins {
++ i2c3_pins: i2c3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0) /* i2c3_scl */
+ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0) /* i2c3_sda */
+ >;
+ };
+
+- tsc2004_pins: pinmux_tsc2004_pins {
++ tsc2004_pins: tsc2004-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2186, PIN_INPUT | MUX_MODE4) /* mcbsp4_dr.gpio_153 */
+ >;
+@@ -252,12 +252,12 @@ OMAP3_CORE1_IOPAD(0x2186, PIN_INPUT | MUX_MODE4) /* mcbsp4_dr.gpio_153 */
+
+ &omap3_pmx_wkup {
+
+- hsusb2_reset_pin: pinmux_hsusb1_reset_pin {
++ hsusb2_reset_pin: hsusb1-reset-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a0e, PIN_OUTPUT | MUX_MODE4) /* sys_boot2.gpio_4 */
+ >;
+ };
+- wl127x_gpio: pinmux_wl127x_gpio_pin {
++ wl127x_gpio: wl127x-gpio-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a0a, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */
+ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */
+diff --git a/arch/arm/boot/dts/logicpd-torpedo-35xx-devkit.dts b/arch/arm/boot/dts/logicpd-torpedo-35xx-devkit.dts
+index cb08aa62d9671..eaa583fdc3d6b 100644
+--- a/arch/arm/boot/dts/logicpd-torpedo-35xx-devkit.dts
++++ b/arch/arm/boot/dts/logicpd-torpedo-35xx-devkit.dts
+@@ -13,7 +13,7 @@ / {
+ };
+
+ &omap3_pmx_core {
+- isp1763_pins: pinmux_isp1763_pins {
++ isp1763_pins: isp1763-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2154, PIN_INPUT_PULLUP | MUX_MODE4) /* sdmmc1_dat6.gpio_128 */
+ >;
+diff --git a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
+index 07ea822fe4052..533ce7ce387a5 100644
+--- a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
++++ b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
+@@ -65,7 +65,7 @@ &mt9p031_out {
+ };
+
+ &omap3_pmx_core {
+- mmc3_pins: pinmux_mm3_pins {
++ mmc3_pins: mm3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2164, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat4.sdmmc3_dat0 */
+ OMAP3_CORE1_IOPAD(0x2166, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat5.sdmmc3_dat1 */
+@@ -78,7 +78,7 @@ OMAP3_CORE1_IOPAD(0x218e, PIN_OUTPUT | MUX_MODE4) /* mcbsp1_fsr.gpio_157 */
+ };
+
+ &omap3_pmx_core2 {
+- mmc3_core2_pins: pinmux_mmc3_core2_pins {
++ mmc3_core2_pins: mmc3-core2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25d8, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_clk.sdmmc3_clk */
+ OMAP3630_CORE2_IOPAD(0x25da, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_ctl.sdmmc3_cmd */
+@@ -88,7 +88,7 @@ OMAP3630_CORE2_IOPAD(0x25da, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_ctl.sdmmc3_c
+
+ /* The gpio muxing between omap3530 and dm3730 is different for GPIO_128 */
+ &omap3_pmx_wkup {
+- isp1763_pins: pinmux_isp1763_pins {
++ isp1763_pins: isp1763-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a58, PIN_INPUT_PULLUP | MUX_MODE4) /* reserved.gpio_128 */
+ >;
+diff --git a/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi b/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
+index e0cbac500e172..e0caed5398104 100644
+--- a/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
+@@ -209,33 +209,33 @@ &mmc1 {
+ };
+
+ &omap3_pmx_core {
+- gpio_key_pins: pinmux_gpio_key_pins {
++ gpio_key_pins: gpio-key-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d6, PIN_INPUT_PULLUP | MUX_MODE4) /* mcspi2_clk.gpio_178 */
+ OMAP3_CORE1_IOPAD(0x21dc, PIN_INPUT_PULLUP | MUX_MODE4) /* mcspi2_cs0.gpio_181 */
+ >;
+ };
+
+- hdq_pins: hdq_pins {
++ hdq_pins: hdq-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c6, PIN_INPUT_PULLUP | MUX_MODE0) /* hdq_sio */
+ >;
+ };
+
+- pwm_pins: pinmux_pwm_pins {
++ pwm_pins: pwm-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20B8, PIN_OUTPUT | PIN_OFF_OUTPUT_LOW | MUX_MODE3) /* gpmc_ncs5.gpt_10_pwm_evt */
+ >;
+ };
+
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d8, PIN_OUTPUT | MUX_MODE4) /* gpio_179 */
+ OMAP3_CORE1_IOPAD(0x21da, PIN_OUTPUT | MUX_MODE4) /* gpio_180 */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_OUTPUT | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -246,19 +246,19 @@ OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT | MUX_MODE0) /* sdmmc1_dat3.sdmmc1_dat3 */
+ >;
+ };
+
+- tsc2004_pins: pinmux_tsc2004_pins {
++ tsc2004_pins: tsc2004-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2186, PIN_INPUT | MUX_MODE4) /* mcbsp4_dr.gpio_153 */
+ >;
+ };
+
+- backlight_pins: pinmux_backlight_pins {
++ backlight_pins: backlight-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2188, PIN_OUTPUT | PIN_OFF_OUTPUT_LOW | MUX_MODE4) /* mcbsp4_dx.gpio_154 */
+ >;
+ };
+
+- isp_pins: pinmux_isp_pins {
++ isp_pins: isp-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x210c, PIN_INPUT | MUX_MODE0) /* cam_hs.cam_hs */
+ OMAP3_CORE1_IOPAD(0x210e, PIN_INPUT | MUX_MODE0) /* cam_vs.cam_vs */
+@@ -276,13 +276,13 @@ OMAP3_CORE1_IOPAD(0x2124, PIN_INPUT | MUX_MODE0) /* cam_d7.cam_d7 */
+ >;
+ };
+
+- panel_pwr_pins: pinmux_panel_pwr_pins {
++ panel_pwr_pins: panel-pwr-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x218a, PIN_OUTPUT | PIN_OFF_OUTPUT_LOW | MUX_MODE4) /* mcbsp4_fs.gpio_155 */
+ >;
+ };
+
+- dss_dpi_pins1: pinmux_dss_dpi_pins1 {
++ dss_dpi_pins1: dss-dpi1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT_PULLDOWN | PIN_OFF_OUTPUT_LOW | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT_PULLDOWN | PIN_OFF_OUTPUT_LOW | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -313,20 +313,20 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT_PULLDOWN | PIN_OFF_OUTPUT_LOW | MUX_MODE3)
+ };
+
+ &omap3_pmx_wkup {
+- gpio_key_pins_wkup: pinmux_gpio_key_pins_wkup {
++ gpio_key_pins_wkup: gpio-key-wkup-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a0a, PIN_INPUT_PULLUP | MUX_MODE4) /* sys_boot0.gpio_2 */
+ OMAP3_WKUP_IOPAD(0x2a14, PIN_INPUT_PULLUP | MUX_MODE4) /* sys_boot5.gpio_7 */
+ >;
+ };
+
+- lan9221_pins: pinmux_lan9221_pins {
++ lan9221_pins: lan9221-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a5a, PIN_INPUT | MUX_MODE4) /* reserved.gpio_129 */
+ >;
+ };
+
+- mmc1_cd: pinmux_mmc1_cd {
++ mmc1_cd: mmc1-cd-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a54, PIN_INPUT_PULLUP | MUX_MODE4) /* reserved.gpio_127 */
+ >;
+diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+index 3a5228562b0d4..6ba01e2113610 100644
+--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
++++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+@@ -111,7 +111,7 @@ at24@50 {
+ };
+
+ &omap3_pmx_core {
+- mcbsp2_pins: pinmux_mcbsp2_pins {
++ mcbsp2_pins: mcbsp2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x213c, PIN_INPUT | MUX_MODE0) /* mcbsp2_fsx */
+ OMAP3_CORE1_IOPAD(0x213e, PIN_INPUT | MUX_MODE0) /* mcbsp2_clkx */
+@@ -119,7 +119,7 @@ OMAP3_CORE1_IOPAD(0x2140, PIN_INPUT | MUX_MODE0) /* mcbsp2_dr */
+ OMAP3_CORE1_IOPAD(0x2142, PIN_OUTPUT | MUX_MODE0) /* mcbsp2_dx */
+ >;
+ };
+- uart2_pins: pinmux_uart2_pins {
++ uart2_pins: uart2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2174, PIN_INPUT | MUX_MODE0) /* uart2_cts.uart2_cts */
+ OMAP3_CORE1_IOPAD(0x2176, PIN_OUTPUT | MUX_MODE0) /* uart2_rts .uart2_rts*/
+@@ -128,7 +128,7 @@ OMAP3_CORE1_IOPAD(0x217a, PIN_INPUT | MUX_MODE0) /* uart2_rx.uart2_rx */
+ OMAP3_CORE1_IOPAD(0x2198, PIN_OUTPUT | MUX_MODE4) /* GPIO_162,BT_EN */
+ >;
+ };
+- mcspi1_pins: pinmux_mcspi1_pins {
++ mcspi1_pins: mcspi1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c8, PIN_INPUT | MUX_MODE0) /* mcspi1_clk.mcspi1_clk */
+ OMAP3_CORE1_IOPAD(0x21ca, PIN_OUTPUT | MUX_MODE0) /* mcspi1_simo.mcspi1_simo */
+@@ -136,7 +136,7 @@ OMAP3_CORE1_IOPAD(0x21cc, PIN_INPUT_PULLUP | MUX_MODE0) /* mcspi1_somi.mcspi1_so
+ OMAP3_CORE1_IOPAD(0x21ce, PIN_OUTPUT | MUX_MODE0) /* mcspi1_cs0.mcspi1_cs0 */
+ >;
+ };
+- hsusb_otg_pins: pinmux_hsusb_otg_pins {
++ hsusb_otg_pins: hsusb-otg-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21a2, PIN_INPUT | MUX_MODE0) /* hsusb0_clk.hsusb0_clk */
+ OMAP3_CORE1_IOPAD(0x21a4, PIN_OUTPUT | MUX_MODE0) /* hsusb0_stp.hsusb0_stp */
+@@ -153,19 +153,19 @@ OMAP3_CORE1_IOPAD(0x21b6, PIN_INPUT | MUX_MODE0) /* hsusb0_data6.hsusb0_data6 */
+ OMAP3_CORE1_IOPAD(0x21b8, PIN_INPUT | MUX_MODE0) /* hsusb0_data7.hsusb0_data7 */
+ >;
+ };
+- i2c1_pins: pinmux_i2c1_pins {
++ i2c1_pins: i2c1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */
+ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */
+ >;
+ };
+- i2c2_pins: pinmux_i2c2_pins {
++ i2c2_pins: i2c2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT | MUX_MODE0) /* i2c2_scl */
+ OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT | MUX_MODE0) /* i2c2_sda */
+ >;
+ };
+- i2c3_pins: pinmux_i2c3_pins {
++ i2c3_pins: i2c3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0) /* i2c3_scl */
+ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0) /* i2c3_sda */
+diff --git a/arch/arm/boot/dts/omap3-beagle-xm.dts b/arch/arm/boot/dts/omap3-beagle-xm.dts
+index 35eced6521efb..d6417a016217e 100644
+--- a/arch/arm/boot/dts/omap3-beagle-xm.dts
++++ b/arch/arm/boot/dts/omap3-beagle-xm.dts
+@@ -90,7 +90,7 @@ hsusb2_power: hsusb2_power_reg {
+ };
+
+ /* HS USB Host PHY on PORT 2 */
+- hsusb2_phy: hsusb2_phy {
++ hsusb2_phy: hsusb2-phy-pins {
+ compatible = "usb-nop-xceiv";
+ reset-gpios = <&gpio5 19 GPIO_ACTIVE_LOW>; /* gpio_147 */
+ vcc-supply = <&hsusb2_power>;
+@@ -183,13 +183,13 @@ etm_out: endpoint {
+ };
+
+ &omap3_pmx_wkup {
+- gpio1_pins: pinmux_gpio1_pins {
++ gpio1_pins: gpio1-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a0e, PIN_INPUT | PIN_OFF_WAKEUPENABLE | MUX_MODE4) /* sys_boot2.gpio_4 */
+ >;
+ };
+
+- dss_dpi_pins2: pinmux_dss_dpi_pins1 {
++ dss_dpi_pins2: dss-dpi1-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a0a, PIN_OUTPUT | MUX_MODE3) /* sys_boot0.dss_data18 */
+ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE3) /* sys_boot1.dss_data19 */
+@@ -207,14 +207,14 @@ &omap3_pmx_core {
+ &hsusb2_pins
+ >;
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | MUX_MODE0) /* uart3_rx_irrx.uart3_rx_irrx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx.uart3_tx_irtx OUTPUT | MODE0 */
+ >;
+ };
+
+- hsusb2_pins: pinmux_hsusb2_pins {
++ hsusb2_pins: hsusb2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi1_cs3.hsusb2_data2 */
+ OMAP3_CORE1_IOPAD(0x21d6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_clk.hsusb2_data7 */
+@@ -225,7 +225,7 @@ OMAP3_CORE1_IOPAD(0x21de, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_cs1.hsusb2_d
+ >;
+ };
+
+- dss_dpi_pins1: pinmux_dss_dpi_pins2 {
++ dss_dpi_pins1: dss-dpi2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -261,7 +261,7 @@ &omap3_pmx_core2 {
+ &hsusb2_2_pins
+ >;
+
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ hsusb2_2_pins: hsusb2-2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+ OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+diff --git a/arch/arm/boot/dts/omap3-beagle.dts b/arch/arm/boot/dts/omap3-beagle.dts
+index 0548b391334fd..981b50b54ccd6 100644
+--- a/arch/arm/boot/dts/omap3-beagle.dts
++++ b/arch/arm/boot/dts/omap3-beagle.dts
+@@ -57,7 +57,7 @@ hsusb2_power: hsusb2_power_reg {
+ };
+
+ /* HS USB Host PHY on PORT 2 */
+- hsusb2_phy: hsusb2_phy {
++ hsusb2_phy: hsusb2-phy-pins {
+ compatible = "usb-nop-xceiv";
+ reset-gpios = <&gpio5 19 GPIO_ACTIVE_LOW>; /* gpio_147 */
+ vcc-supply = <&hsusb2_power>;
+@@ -170,7 +170,7 @@ etm_out: endpoint {
+ };
+
+ &omap3_pmx_wkup {
+- gpio1_pins: pinmux_gpio1_pins {
++ gpio1_pins: gpio1-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a14, PIN_INPUT | PIN_OFF_WAKEUPENABLE | MUX_MODE4) /* sys_boot5.gpio_7 */
+ >;
+@@ -183,7 +183,7 @@ &omap3_pmx_core {
+ &hsusb2_pins
+ >;
+
+- hsusb2_pins: pinmux_hsusb2_pins {
++ hsusb2_pins: hsusb2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi1_cs3.hsusb2_data2 */
+ OMAP3_CORE1_IOPAD(0x21d6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_clk.hsusb2_data7 */
+@@ -194,20 +194,20 @@ OMAP3_CORE1_IOPAD(0x21de, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_cs1.hsusb2_d
+ >;
+ };
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | PIN_OFF_WAKEUPENABLE | MUX_MODE0) /* uart3_rx_irrx.uart3_rx_irrx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx.uart3_tx_irtx */
+ >;
+ };
+
+- tfp410_pins: pinmux_tfp410_pins {
++ tfp410_pins: tfp410-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c6, PIN_OUTPUT | MUX_MODE4) /* hdq_sio.gpio_170 */
+ >;
+ };
+
+- dss_dpi_pins: pinmux_dss_dpi_pins {
++ dss_dpi_pins: dss-dpi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -247,7 +247,7 @@ &omap3_pmx_core2 {
+ &hsusb2_2_pins
+ >;
+
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ hsusb2_2_pins: hsusb2-2-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+ OMAP3430_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+diff --git a/arch/arm/boot/dts/omap3-cm-t3517.dts b/arch/arm/boot/dts/omap3-cm-t3517.dts
+index f25c0a84a190c..f776e0527049c 100644
+--- a/arch/arm/boot/dts/omap3-cm-t3517.dts
++++ b/arch/arm/boot/dts/omap3-cm-t3517.dts
+@@ -43,7 +43,7 @@ wl12xx_vaux2: wl12xx_vaux2 {
+
+ &omap3_pmx_wkup {
+
+- wl12xx_wkup_pins: pinmux_wl12xx_wkup_pins {
++ wl12xx_wkup_pins: wl12xx-wkup-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a0e, PIN_OUTPUT | MUX_MODE4) /* sys_boot2.gpio_4 */
+ OMAP3_WKUP_IOPAD(0x2a12, PIN_OUTPUT | MUX_MODE4) /* sys_boot4.gpio_6 */
+@@ -53,25 +53,25 @@ OMAP3_WKUP_IOPAD(0x2a12, PIN_OUTPUT | MUX_MODE4) /* sys_boot4.gpio_6 */
+
+ &omap3_pmx_core {
+
+- phy1_reset_pins: pinmux_hsusb1_phy_reset_pins {
++ phy1_reset_pins: hsusb1-phy-reset-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2178, PIN_OUTPUT | MUX_MODE4) /* uart2_tx.gpio_146 */
+ >;
+ };
+
+- phy2_reset_pins: pinmux_hsusb2_phy_reset_pins {
++ phy2_reset_pins: hsusb2-phy-reset-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x217a, PIN_OUTPUT | MUX_MODE4) /* uart2_rx.gpio_147 */
+ >;
+ };
+
+- otg_drv_vbus: pinmux_otg_drv_vbus {
++ otg_drv_vbus: otg-drv-vbus-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2210, PIN_INPUT_PULLDOWN | MUX_MODE0) /* rmii_50MHz_clk.usb0_drvvbus */
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
+@@ -82,14 +82,14 @@ OMAP3_CORE1_IOPAD(0x2162, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat3.sdmmc2_da
+ >;
+ };
+
+- wl12xx_core_pins: pinmux_wl12xx_core_pins {
++ wl12xx_core_pins: wl12xx-core-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20b8, PIN_OUTPUT | MUX_MODE4) /* gpmc_ncs5.gpio_56 */
+ OMAP3_CORE1_IOPAD(0x2176, PIN_INPUT_PULLUP | MUX_MODE4) /* uart2_rts.gpio_145 */
+ >;
+ };
+
+- usb_hub_pins: pinmux_usb_hub_pins {
++ usb_hub_pins: usb-hub-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2184, PIN_OUTPUT | MUX_MODE4) /* mcbsp4_clkx.gpio_152 - USB HUB RST */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-cm-t3530.dts b/arch/arm/boot/dts/omap3-cm-t3530.dts
+index bc545ee23e711..0c6f14963e5ea 100644
+--- a/arch/arm/boot/dts/omap3-cm-t3530.dts
++++ b/arch/arm/boot/dts/omap3-cm-t3530.dts
+@@ -23,7 +23,7 @@ mmc2_sdio_reset: regulator-mmc2-sdio-reset {
+ };
+
+ &omap3_pmx_core {
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
+diff --git a/arch/arm/boot/dts/omap3-cm-t3730.dts b/arch/arm/boot/dts/omap3-cm-t3730.dts
+index 48e48b0c81901..5dc0875e40d20 100644
+--- a/arch/arm/boot/dts/omap3-cm-t3730.dts
++++ b/arch/arm/boot/dts/omap3-cm-t3730.dts
+@@ -33,7 +33,7 @@ wl12xx_vaux2: wl12xx_vaux2 {
+ };
+
+ &omap3_pmx_wkup {
+- dss_dpi_pins_cm_t3730: pinmux_dss_dpi_pins_cm_t3730 {
++ dss_dpi_pins_cm_t3730: dss-dpi-cm-t3730-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a08, PIN_OUTPUT | MUX_MODE3) /* sys_boot0.dss_data18 */
+ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE3) /* sys_boot1.dss_data19 */
+@@ -47,7 +47,7 @@ OMAP3_WKUP_IOPAD(0x2a16, PIN_OUTPUT | MUX_MODE3) /* sys_boot6.dss_data23 */
+
+ &omap3_pmx_core {
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
+@@ -58,7 +58,7 @@ OMAP3_CORE1_IOPAD(0x2162, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat3.sdmmc2_da
+ >;
+ };
+
+- wl12xx_gpio: pinmux_wl12xx_gpio {
++ wl12xx_gpio: wl12xx-gpio-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20e2, PIN_OUTPUT | MUX_MODE4) /* dss_data3.gpio_73 */
+ OMAP3_CORE1_IOPAD(0x2164, PIN_INPUT | MUX_MODE4) /* sdmmc2_dat4.gpio_136 */
+diff --git a/arch/arm/boot/dts/omap3-cm-t3x.dtsi b/arch/arm/boot/dts/omap3-cm-t3x.dtsi
+index 51baedf1603bd..950a29f9b4a0b 100644
+--- a/arch/arm/boot/dts/omap3-cm-t3x.dtsi
++++ b/arch/arm/boot/dts/omap3-cm-t3x.dtsi
+@@ -47,7 +47,7 @@ hsusb1_phy: hsusb1_phy {
+ };
+
+ /* HS USB Host PHY on PORT 2 */
+- hsusb2_phy: hsusb2_phy {
++ hsusb2_phy: hsusb2-phy-pins {
+ compatible = "usb-nop-xceiv";
+ vcc-supply = <&hsusb2_power>;
+ #phy-cells = <0>;
+@@ -74,14 +74,14 @@ tv_connector_in: endpoint {
+
+ &omap3_pmx_core {
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | MUX_MODE0) /* uart3_rx_irrx.uart3_rx_irrx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx.uart3_tx_irtx */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -92,13 +92,13 @@ OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_dat3.sdmmc1_da
+ >;
+ };
+
+- green_led_pins: pinmux_green_led_pins {
++ green_led_pins: green-led-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21e2, PIN_OUTPUT | MUX_MODE4) /* sys_clkout2.gpio_186 */
+ >;
+ };
+
+- dss_dpi_pins_common: pinmux_dss_dpi_pins_common {
++ dss_dpi_pins_common: dss-dpi-common-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -126,7 +126,7 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE0) /* dss_data23.dss_data23 */
+ >;
+ };
+
+- dss_dpi_pins_cm_t35x: pinmux_dss_dpi_pins_cm_t35x {
++ dss_dpi_pins_cm_t35x: dss-dpi-cm-t35x-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20dc, PIN_OUTPUT | MUX_MODE0) /* dss_data0.dss_data0 */
+ OMAP3_CORE1_IOPAD(0x20de, PIN_OUTPUT | MUX_MODE0) /* dss_data1.dss_data1 */
+@@ -137,13 +137,13 @@ OMAP3_CORE1_IOPAD(0x20e6, PIN_OUTPUT | MUX_MODE0) /* dss_data5.dss_data5 */
+ >;
+ };
+
+- ads7846_pins: pinmux_ads7846_pins {
++ ads7846_pins: ads7846-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20ba, PIN_INPUT_PULLUP | MUX_MODE4) /* gpmc_ncs6.gpio_57 */
+ >;
+ };
+
+- mcspi1_pins: pinmux_mcspi1_pins {
++ mcspi1_pins: mcspi1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c8, PIN_INPUT | MUX_MODE0) /* mcspi1_clk */
+ OMAP3_CORE1_IOPAD(0x21ca, PIN_INPUT | MUX_MODE0) /* mcspi1_simo */
+@@ -152,14 +152,14 @@ OMAP3_CORE1_IOPAD(0x21ce, PIN_INPUT_PULLDOWN | MUX_MODE0) /* mcspi1_cs0 */
+ >;
+ };
+
+- i2c1_pins: pinmux_i2c1_pins {
++ i2c1_pins: i2c1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_scl */
+ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_sda */
+ >;
+ };
+
+- mcbsp2_pins: pinmux_mcbsp2_pins {
++ mcbsp2_pins: mcbsp2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x213c, PIN_INPUT | MUX_MODE0) /* mcbsp2_fsx */
+ OMAP3_CORE1_IOPAD(0x213e, PIN_INPUT | MUX_MODE0) /* mcbsp2_clkx */
+diff --git a/arch/arm/boot/dts/omap3-cm-t3x30.dtsi b/arch/arm/boot/dts/omap3-cm-t3x30.dtsi
+index 5e8943539fcc2..0e942513560d6 100644
+--- a/arch/arm/boot/dts/omap3-cm-t3x30.dtsi
++++ b/arch/arm/boot/dts/omap3-cm-t3x30.dtsi
+@@ -22,14 +22,14 @@ sound {
+
+ &omap3_pmx_core {
+
+- smsc1_pins: pinmux_smsc1_pins {
++ smsc1_pins: smsc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20b8, PIN_OUTPUT | MUX_MODE0) /* gpmc_ncs5.gpmc_ncs5 */
+ OMAP3_CORE1_IOPAD(0x219a, PIN_INPUT_PULLUP | MUX_MODE4) /* uart3_cts_rctx.gpio_163 */
+ >;
+ };
+
+- hsusb0_pins: pinmux_hsusb0_pins {
++ hsusb0_pins: hsusb0-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21a2, PIN_OUTPUT | MUX_MODE0) /* hsusb0_clk.hsusb0_clk */
+ OMAP3_CORE1_IOPAD(0x21a4, PIN_OUTPUT | MUX_MODE0) /* hsusb0_stp.hsusb0_stp */
+diff --git a/arch/arm/boot/dts/omap3-devkit8000-common.dtsi b/arch/arm/boot/dts/omap3-devkit8000-common.dtsi
+index 54cd37336be7a..e6e1f0946917a 100644
+--- a/arch/arm/boot/dts/omap3-devkit8000-common.dtsi
++++ b/arch/arm/boot/dts/omap3-devkit8000-common.dtsi
+@@ -312,7 +312,7 @@ ethernet@6,0 {
+ };
+
+ &omap3_pmx_core {
+- dss_dpi_pins: pinmux_dss_dpi_pins {
++ dss_dpi_pins: dss-dpi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+diff --git a/arch/arm/boot/dts/omap3-echo.dts b/arch/arm/boot/dts/omap3-echo.dts
+index 8f02ff5e7da69..afdc3684f95cc 100644
+--- a/arch/arm/boot/dts/omap3-echo.dts
++++ b/arch/arm/boot/dts/omap3-echo.dts
+@@ -524,13 +524,13 @@ codec0: codec@18 {
+ #include "tps65910.dtsi"
+
+ &omap3_pmx_core {
+- tps_pins: pinmux_tps_pins {
++ tps_pins: tps-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21e0, PIN_INPUT_PULLUP | PIN_OFF_INPUT_PULLUP | PIN_OFF_OUTPUT_LOW | PIN_OFF_WAKEUPENABLE | MUX_MODE0) /* sys_nirq.sys_nirq */
+ >;
+ };
+
+- button_pins: pinmux_button_pins {
++ button_pins: button-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20dc, PIN_INPUT | MUX_MODE4) /* dss_data0.gpio_70 */
+ OMAP3_CORE1_IOPAD(0x20e0, PIN_INPUT | MUX_MODE4) /* dss_data2.gpio_72 */
+@@ -540,7 +540,7 @@ OMAP3_CORE1_IOPAD(0x2a1a, PIN_OUTPUT | MUX_MODE0) /* sys_clkout1.sys_clkout1 */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -551,7 +551,7 @@ OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_dat3.sdmmc1_d
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
+@@ -566,7 +566,7 @@ OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat7.sdmmc2_d
+ >;
+ };
+
+- mcbsp2_pins: pinmux_mcbsp2_pins {
++ mcbsp2_pins: mcbsp2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x213c, PIN_INPUT | MUX_MODE0) /* mcbsp2_fsx.mcbsp2_fsx */
+ OMAP3_CORE1_IOPAD(0x213e, PIN_INPUT | MUX_MODE0) /* mcbsp2_clkx.mcbsp2_clkx */
+@@ -577,7 +577,7 @@ OMAP3_CORE1_IOPAD(0x2142, PIN_OUTPUT | MUX_MODE0) /* mcbsp2_dx.mcbsp2_dx */
+ };
+
+ &omap3_pmx_core2 {
+- mmc3_pins: pinmux_mmc3_pins {
++ mmc3_pins: mmc3-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25d8, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_clk.sdmmc3_clk */
+ OMAP3630_CORE2_IOPAD(0x25da, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_ctl.sdmmc3_cmd */
+diff --git a/arch/arm/boot/dts/omap3-evm-37xx.dts b/arch/arm/boot/dts/omap3-evm-37xx.dts
+index abd403c228c7a..e0346bf842fcd 100644
+--- a/arch/arm/boot/dts/omap3-evm-37xx.dts
++++ b/arch/arm/boot/dts/omap3-evm-37xx.dts
+@@ -17,7 +17,7 @@ &omap3_pmx_core2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&hsusb2_2_pins>;
+
+- ehci_phy_pins: pinmux_ehci_phy_pins {
++ ehci_phy_pins: ehci-phy-pins {
+ pinctrl-single,pins = <
+
+ /* EHCI PHY reset GPIO etk_d7.gpio_21 */
+@@ -29,7 +29,7 @@ OMAP3630_CORE2_IOPAD(0x25ec, PIN_OUTPUT | MUX_MODE4)
+ };
+
+ /* Used by OHCI and EHCI. OHCI won't work without external phy */
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ hsusb2_2_pins: hsusb2-2-pins {
+ pinctrl-single,pins = <
+
+ /* etk_d10.hsusb2_clk */
+diff --git a/arch/arm/boot/dts/omap3-evm-common.dtsi b/arch/arm/boot/dts/omap3-evm-common.dtsi
+index 17c89df6ce6b1..1b6023c4cdf31 100644
+--- a/arch/arm/boot/dts/omap3-evm-common.dtsi
++++ b/arch/arm/boot/dts/omap3-evm-common.dtsi
+@@ -25,7 +25,7 @@ hsusb2_power: hsusb2_power_reg {
+ };
+
+ /* HS USB Host PHY on PORT 2 */
+- hsusb2_phy: hsusb2_phy {
++ hsusb2_phy: hsusb2-phy-pins {
+ compatible = "usb-nop-xceiv";
+ reset-gpios = <&gpio1 21 GPIO_ACTIVE_LOW>; /* gpio_21 */
+ vcc-supply = <&hsusb2_power>;
+diff --git a/arch/arm/boot/dts/omap3-evm-processor-common.dtsi b/arch/arm/boot/dts/omap3-evm-processor-common.dtsi
+index e6ba30a211663..e27837093e43d 100644
+--- a/arch/arm/boot/dts/omap3-evm-processor-common.dtsi
++++ b/arch/arm/boot/dts/omap3-evm-processor-common.dtsi
+@@ -33,7 +33,7 @@ &omap3_pmx_core {
+ pinctrl-names = "default";
+ pinctrl-0 = <&on_board_gpio_61 &hsusb2_pins>;
+
+- dss_dpi_pins1: pinmux_dss_dpi_pins2 {
++ dss_dpi_pins1: dss-dpi2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -62,7 +62,7 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE3) /* dss_data23.dss_data5 */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_OUTPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -78,7 +78,7 @@ OMAP3_CORE1_IOPAD(0x2156, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_dat7.sdmmc1_d
+ };
+
+ /* NOTE: Clocked externally, needs INPUT also for sdmmc2_clk.sdmmc2_clk */
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
+@@ -93,7 +93,7 @@ OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT | MUX_MODE1) /* sdmmc2_dat7.sdmmc2_clkin */
+ >;
+ };
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, WAKEUP_EN | PIN_INPUT | MUX_MODE0) /* uart3_rx_irrx.uart3_rx_irrx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx.uart3_tx_irtx */
+@@ -101,14 +101,14 @@ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx.uart3_tx_irt
+ };
+
+ /* Devices are routed with gpmc_nbe1.gpio_61 to on-board devices */
+- on_board_gpio_61: pinmux_ehci_port_select_pins {
++ on_board_gpio_61: ehci-port-select-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20c8, PIN_OUTPUT | MUX_MODE4)
+ >;
+ };
+
+ /* Used by OHCI and EHCI. OHCI won't work without external phy */
+- hsusb2_pins: pinmux_hsusb2_pins {
++ hsusb2_pins: hsusb2-pins {
+ pinctrl-single,pins = <
+
+ /* mcspi1_cs3.hsusb2_data2 */
+@@ -135,14 +135,14 @@ OMAP3_CORE1_IOPAD(0x21de, PIN_INPUT_PULLDOWN | MUX_MODE3)
+ * Note that gpio_150 pulled high with internal pull to prevent wlcore
+ * reset on return from off mode in idle.
+ */
+- wl12xx_gpio: pinmux_wl12xx_gpio {
++ wl12xx_gpio: wl12xx-gpio-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2180, PIN_INPUT_PULLUP | MUX_MODE7) /* uart1_cts.gpio_150 */
+ OMAP3_CORE1_IOPAD(0x217e, PIN_INPUT | MUX_MODE4) /* uart1_rts.gpio_149 */
+ >;
+ };
+
+- smsc911x_pins: pinmux_smsc911x_pins {
++ smsc911x_pins: smsc911x-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d2, PIN_INPUT | MUX_MODE4) /* mcspi1_cs2.gpio_176 */
+ >;
+@@ -150,7 +150,7 @@ OMAP3_CORE1_IOPAD(0x21d2, PIN_INPUT | MUX_MODE4) /* mcspi1_cs2.gpio_176 */
+ };
+
+ &omap3_pmx_wkup {
+- dss_dpi_pins2: pinmux_dss_dpi_pins1 {
++ dss_dpi_pins2: dss-dpi1-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a0a, PIN_OUTPUT | MUX_MODE3) /* sys_boot0.dss_data18 */
+ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE3) /* sys_boot1.dss_data19 */
+diff --git a/arch/arm/boot/dts/omap3-evm.dts b/arch/arm/boot/dts/omap3-evm.dts
+index f95eea63b355f..a2a1613c45c3e 100644
+--- a/arch/arm/boot/dts/omap3-evm.dts
++++ b/arch/arm/boot/dts/omap3-evm.dts
+@@ -17,7 +17,7 @@ &omap3_pmx_core2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&hsusb2_2_pins>;
+
+- ehci_phy_pins: pinmux_ehci_phy_pins {
++ ehci_phy_pins: ehci-phy-pins {
+ pinctrl-single,pins = <
+
+ /* EHCI PHY reset GPIO etk_d7.gpio_21 */
+@@ -29,7 +29,7 @@ OMAP3430_CORE2_IOPAD(0x25ec, PIN_OUTPUT | MUX_MODE4)
+ };
+
+ /* Used by OHCI and EHCI. OHCI won't work without external phy */
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ hsusb2_2_pins: hsusb2-2-pins {
+ pinctrl-single,pins = <
+
+ /* etk_d10.hsusb2_clk */
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index e0be0fb23f80f..93a61fe3ef306 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -154,7 +154,7 @@ pwm11: pwm-11 {
+ ti,clock-source = <0x01>;
+ };
+
+- hsusb2_phy: hsusb2_phy {
++ hsusb2_phy: hsusb2-phy-pins {
+ compatible = "usb-nop-xceiv";
+ reset-gpios = <&gpio6 14 GPIO_ACTIVE_LOW>;
+ #phy-cells = <0>;
+@@ -201,7 +201,7 @@ wifi_pwrseq: wifi_pwrseq {
+ };
+
+ /* devconf0 setup for mcbsp1 clock pins */
+- pinmux_mcbsp1@48002274 {
++ pinmux@48002274 {
+ compatible = "pinctrl-single";
+ reg = <0x48002274 4>; /* CONTROL_DEVCONF0 */
+ #address-cells = <1>;
+@@ -212,14 +212,14 @@ pinmux_mcbsp1@48002274 {
+ #pinctrl-cells = <2>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&mcbsp1_devconf0_pins>;
+- mcbsp1_devconf0_pins: pinmux_mcbsp1_devconf0_pins {
++ mcbsp1_devconf0_pins: mcbsp1-devconf0-pins {
+ /* offset bits mask */
+ pinctrl-single,bits = <0x00 0x08 0x1c>; /* set MCBSP1_CLKR */
+ };
+ };
+
+ /* devconf1 setup for tvout pins */
+- pinmux_tv_out@480022d8 {
++ pinmux@480022d8 {
+ compatible = "pinctrl-single";
+ reg = <0x480022d8 4>; /* CONTROL_DEVCONF1 */
+ #address-cells = <1>;
+@@ -230,7 +230,7 @@ pinmux_tv_out@480022d8 {
+ #pinctrl-cells = <2>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&tv_acbias_devconf1_pins>;
+- tv_acbias_devconf1_pins: pinmux_tv_acbias_devconf1_pins {
++ tv_acbias_devconf1_pins: tv-acbias-devconf1-pins {
+ /* offset bits mask */
+ pinctrl-single,bits = <0x00 0x40800 0x40800>; /* set TVOUTBYPASS and TVOUTACEN */
+ };
+@@ -238,7 +238,7 @@ tv_acbias_devconf1_pins: pinmux_tv_acbias_devconf1_pins {
+ };
+
+ &omap3_pmx_wkup {
+- gpio1_pins: pinmux_gpio1_pins {
++ gpio1_pins: gpio1-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a14, PIN_INPUT | PIN_OFF_WAKEUPENABLE | MUX_MODE4) /* sys_boot5.gpio_7 */
+ OMAP3_WKUP_IOPAD(0x2a1a, PIN_INPUT | PIN_OFF_WAKEUPENABLE | MUX_MODE4) /* sys_clkout.gpio_10 */
+@@ -252,7 +252,7 @@ &omap3_pmx_core {
+ &hsusb2_pins
+ >;
+
+- hsusb2_pins: pinmux_hsusb2_pins {
++ hsusb2_pins: hsusb2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi1_cs3.hsusb2_data2 */
+ OMAP3_CORE1_IOPAD(0x21d6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_clk.hsusb2_data7 */
+@@ -263,28 +263,28 @@ OMAP3_CORE1_IOPAD(0x21de, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_cs1.hsusb2_d
+ >;
+ };
+
+- uart1_pins: pinmux_uart1_pins {
++ uart1_pins: uart1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2182, PIN_INPUT | MUX_MODE0) /* uart1_rx.uart1_rx */
+ OMAP3_CORE1_IOPAD(0x217c, PIN_OUTPUT | MUX_MODE0) /* uart1_tx.uart1_tx */
+ >;
+ };
+
+- uart2_pins: pinmux_uart2_pins {
++ uart2_pins: uart2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x217a, PIN_INPUT | MUX_MODE0) /* uart2_rx.uart2_rx */
+ OMAP3_CORE1_IOPAD(0x2178, PIN_OUTPUT | MUX_MODE0) /* uart2_tx.uart2_tx */
+ >;
+ };
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | MUX_MODE0) /* uart3_rx.uart3_rx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx.uart3_tx */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -295,13 +295,13 @@ OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_dat3.sdmmc1_d
+ >;
+ };
+
+- backlight_pins: backlight_pins_pinmux {
++ backlight_pins: backlight-pinmux-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20ba, MUX_MODE3) /* gpt11/gpio57 */
+ >;
+ };
+
+- dss_dpi_pins: pinmux_dss_dpi_pins {
++ dss_dpi_pins: dss-dpi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -334,50 +334,50 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE0) /* dss_data23.dss_data23 */
+ >;
+ };
+
+- gps_pins: pinmux_gps_pins {
++ gps_pins: gps-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2176, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* gpio145 */
+ >;
+ };
+
+- hdq_pins: hdq_pins {
++ hdq_pins: hdq-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c6, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda.hdq */
+ >;
+ };
+
+- bmp085_pins: pinmux_bmp085_pins {
++ bmp085_pins: bmp085-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2136, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio113 */
+ >;
+ };
+
+- bma180_pins: pinmux_bma180_pins {
++ bma180_pins: bma180-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x213a, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio115 */
+ >;
+ };
+
+- itg3200_pins: pinmux_itg3200_pins {
++ itg3200_pins: itg3200-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20b8, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio56 */
+ >;
+ };
+
+- hmc5843_pins: pinmux_hmc5843_pins {
++ hmc5843_pins: hmc5843-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2134, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio112 */
+ >;
+ };
+
+- penirq_pins: pinmux_penirq_pins {
++ penirq_pins: penirq-pins {
+ pinctrl-single,pins = <
+ /* here we could enable to wakeup the cpu from suspend by a pen touch */
+ OMAP3_CORE1_IOPAD(0x2194, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio160 */
+ >;
+ };
+
+- camera_pins: pinmux_camera_pins {
++ camera_pins: camera-pins {
+ pinctrl-single,pins = <
+ /* set up parallel camera interface */
+ OMAP3_CORE1_IOPAD(0x210c, PIN_INPUT_PULLDOWN | MUX_MODE0) /* cam_hs */
+@@ -403,7 +403,7 @@ OMAP3_CORE1_IOPAD(0x2132, PIN_INPUT_PULLDOWN | MUX_MODE4) /* cam_strobe */
+ >;
+ };
+
+- mcbsp1_pins: pinmux_mcbsp1_pins {
++ mcbsp1_pins: mcbsp1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x218c, PIN_INPUT | MUX_MODE4) /* mcbsp1_clkr.mcbsp1_clkr - gpio_156 FM interrupt */
+ OMAP3_CORE1_IOPAD(0x218e, PIN_OUTPUT | MUX_MODE0) /* mcbsp1_clkr.mcbsp1_fsr */
+@@ -416,7 +416,7 @@ OMAP3_CORE1_IOPAD(0x2198, PIN_INPUT | MUX_MODE0) /* mcbsp1_clkx.mcbsp1_clkx */
+ >;
+ };
+
+- mcbsp2_pins: pinmux_mcbsp2_pins {
++ mcbsp2_pins: mcbsp2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x213c, PIN_INPUT | MUX_MODE0) /* mcbsp2_fsx.mcbsp2_fsx */
+ OMAP3_CORE1_IOPAD(0x213e, PIN_INPUT | MUX_MODE0) /* mcbsp2_fsx.mcbsp2_clkx */
+@@ -425,7 +425,7 @@ OMAP3_CORE1_IOPAD(0x2142, PIN_OUTPUT | MUX_MODE0) /* mcbsp2_dr.mcbsp2_dx */
+ >;
+ };
+
+- mcbsp3_pins: pinmux_mcbsp3_pins {
++ mcbsp3_pins: mcbsp3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x216c, PIN_OUTPUT | MUX_MODE0) /* mcbsp3_dx.mcbsp3_dx */
+ OMAP3_CORE1_IOPAD(0x216e, PIN_INPUT | MUX_MODE0) /* mcbsp3_dx.mcbsp3_dr */
+@@ -434,7 +434,7 @@ OMAP3_CORE1_IOPAD(0x2172, PIN_INPUT | MUX_MODE0) /* mcbsp3_clkx.mcbsp3_fsx */
+ >;
+ };
+
+- mcbsp4_pins: pinmux_mcbsp4_pins {
++ mcbsp4_pins: mcbsp4-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2184, PIN_INPUT_PULLDOWN | MUX_MODE0) /* mcbsp4_clkx.mcbsp4_clkx */
+ OMAP3_CORE1_IOPAD(0x2186, PIN_INPUT_PULLDOWN | MUX_MODE0) /* mcbsp4_clkx.mcbsp4_dr */
+@@ -449,7 +449,7 @@ &omap3_pmx_core2 {
+ &hsusb2_2_pins
+ >;
+
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ hsusb2_2_pins: hsusb2-2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+ OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+@@ -460,7 +460,7 @@ OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_d
+ >;
+ };
+
+- spi_gpio_pins: spi_gpio_pinmux {
++ spi_gpio_pins: spi-gpio-pinmux-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25d8, PIN_OUTPUT | MUX_MODE4) /* clk */
+ OMAP3630_CORE2_IOPAD(0x25e6, PIN_OUTPUT | MUX_MODE4) /* cs */
+diff --git a/arch/arm/boot/dts/omap3-gta04a5.dts b/arch/arm/boot/dts/omap3-gta04a5.dts
+index 0b5bd73888771..e5dbfdaaea82f 100644
+--- a/arch/arm/boot/dts/omap3-gta04a5.dts
++++ b/arch/arm/boot/dts/omap3-gta04a5.dts
+@@ -45,31 +45,31 @@ irda-en-hog {
+ };
+
+ &omap3_pmx_core {
+- bt_pins: pinmux_bt_pins {
++ bt_pins: bt-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2166, PIN_OUTPUT | MUX_MODE4) /* mmc2_dat5 = mmc3_dat1 = gpio137 */
+ >;
+ };
+
+- wlan_pins: pinmux_wlan_pins {
++ wlan_pins: wlan-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2168, PIN_OUTPUT | MUX_MODE4) /* mmc2_dat6 = mmc3_dat2 = gpio138 */
+ >;
+ };
+
+- wlan_irq_pin: pinmux_wlan_irq_pin {
++ wlan_irq_pin: wlan-irq-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT_PULLUP | MUX_MODE4) /* mmc2_dat7 = mmc3_dat3 = gpio139 */
+ >;
+ };
+
+- irda_pins: pinmux_irda {
++ irda_pins: irda-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d0, PIN_OUTPUT_PULLUP | MUX_MODE4) /* mcspi1_cs1 = gpio175 */
+ >;
+ };
+
+- pps_pins: pinmux_pps_pins {
++ pps_pins: pps-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2138, PIN_INPUT | MUX_MODE4) /* gpin114 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-gta04a5one.dts b/arch/arm/boot/dts/omap3-gta04a5one.dts
+index 95df45cc70c09..1e5703d1b02ee 100644
+--- a/arch/arm/boot/dts/omap3-gta04a5one.dts
++++ b/arch/arm/boot/dts/omap3-gta04a5one.dts
+@@ -10,7 +10,7 @@ / {
+ };
+
+ &omap3_pmx_core {
+- gpmc_pins: pinmux_gpmc_pins {
++ gpmc_pins: gpmc-pins {
+ pinctrl-single,pins = <
+
+ /* address lines */
+diff --git a/arch/arm/boot/dts/omap3-ha-common.dtsi b/arch/arm/boot/dts/omap3-ha-common.dtsi
+index a010585d0302a..3a258a692757f 100644
+--- a/arch/arm/boot/dts/omap3-ha-common.dtsi
++++ b/arch/arm/boot/dts/omap3-ha-common.dtsi
+@@ -17,43 +17,43 @@ gpio_poweroff {
+ };
+
+ &omap3_pmx_core {
+- sound2_pins: pinmux_sound2_pins {
++ sound2_pins: sound2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x209e, PIN_OUTPUT | MUX_MODE4) /* gpmc_d8 gpio_44 */
+ >;
+ };
+
+- led_blue_pins: pinmux_led_blue_pins {
++ led_blue_pins: led-blue-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2110, PIN_OUTPUT | MUX_MODE4) /* cam_xclka gpio_96, LED blue */
+ >;
+ };
+
+- led_green_pins: pinmux_led_green_pins {
++ led_green_pins: led-green-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2126, PIN_OUTPUT | MUX_MODE4) /* cam_d8 gpio_107, LED green */
+ >;
+ };
+
+- led_red_pins: pinmux_led_red_pins {
++ led_red_pins: led-red-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x212e, PIN_OUTPUT_PULLUP | MUX_MODE4) /* cam_xclkb gpio_111, LED red */
+ >;
+ };
+
+- poweroff_pins: pinmux_poweroff_pins {
++ poweroff_pins: poweroff-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21be, PIN_OUTPUT_PULLUP | MUX_MODE4) /* i2c2_scl gpio_168 */
+ >;
+ };
+
+- powerdown_input_pins: pinmux_powerdown_input_pins {
++ powerdown_input_pins: powerdown-input-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT_PULLUP | MUX_MODE4) /* i2c2_sda gpio_183 */
+ >;
+ };
+
+- fpga_boot0_pins: fpga_boot0_pins {
++ fpga_boot0_pins: fpga-boot0-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x211a, PIN_INPUT | MUX_MODE4) /* cam_d2 gpio_101 */
+ OMAP3_CORE1_IOPAD(0x211c, PIN_OUTPUT | MUX_MODE4) /* cam_d3 gpio_102 */
+@@ -62,7 +62,7 @@ OMAP3_CORE1_IOPAD(0x2120, PIN_INPUT_PULLUP | MUX_MODE4) /* cam_d5 gpio_104 */
+ >;
+ };
+
+- fpga_boot1_pins: fpga_boot1_pins {
++ fpga_boot1_pins: fpga-boot1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20a2, PIN_INPUT | MUX_MODE4) /* gpmc_d10 gpio_46 */
+ OMAP3_CORE1_IOPAD(0x20a4, PIN_OUTPUT | MUX_MODE4) /* gpmc_d11 gpio_47 */
+diff --git a/arch/arm/boot/dts/omap3-ha-lcd.dts b/arch/arm/boot/dts/omap3-ha-lcd.dts
+index 643283f0c3dbb..94f6b7931e333 100644
+--- a/arch/arm/boot/dts/omap3-ha-lcd.dts
++++ b/arch/arm/boot/dts/omap3-ha-lcd.dts
+@@ -24,19 +24,19 @@ &led_red_pins
+ &touchscreen_wake_pins
+ >;
+
+- touchscreen_irq_pins: pinmux_touchscreen_irq_pins {
++ touchscreen_irq_pins: touchscreen-irq-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2164, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio_136, Touchscreen IRQ */
+ >;
+ };
+
+- touchscreen_wake_pins: pinmux_touchscreen_wake_pins {
++ touchscreen_wake_pins: touchscreen-wake-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x212c, PIN_OUTPUT_PULLUP | MUX_MODE4) /* gpio_110, Touchscreen Wake */
+ >;
+ };
+
+- dss_dpi_pins: pinmux_dss_dpi_pins {
++ dss_dpi_pins: dss-dpi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -69,13 +69,13 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE0) /* dss_data23.dss_data23 */
+ >;
+ };
+
+- lte430_pins: pinmux_lte430_pins {
++ lte430_pins: lte430-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2168, PIN_OUTPUT | MUX_MODE4) /* sdmmc2_dat6.gpio_138 */
+ >;
+ };
+
+- backlight_pins: pinmux_backlight_pins {
++ backlight_pins: backlight-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x216a, PIN_OUTPUT | MUX_MODE4) /* sdmmc2_dat7.gpio_139 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-igep.dtsi b/arch/arm/boot/dts/omap3-igep.dtsi
+index 2192026104638..e068ecf86b8f8 100644
+--- a/arch/arm/boot/dts/omap3-igep.dtsi
++++ b/arch/arm/boot/dts/omap3-igep.dtsi
+@@ -34,28 +34,28 @@ vdd33: regulator-vdd33 {
+ };
+
+ &omap3_pmx_core {
+- gpmc_pins: pinmux_gpmc_pins {
++ gpmc_pins: gpmc-pins {
+ pinctrl-single,pins = <
+ /* OneNAND seems to require PIN_INPUT on clock. */
+ OMAP3_CORE1_IOPAD(0x20be, PIN_INPUT | MUX_MODE0) /* gpmc_clk.gpmc_clk */
+ >;
+ };
+
+- uart1_pins: pinmux_uart1_pins {
++ uart1_pins: uart1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2182, PIN_INPUT | MUX_MODE0) /* uart1_rx.uart1_rx */
+ OMAP3_CORE1_IOPAD(0x217c, PIN_OUTPUT | MUX_MODE0) /* uart1_tx.uart1_tx */
+ >;
+ };
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | MUX_MODE0) /* uart3_rx.uart3_rx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx.uart3_tx */
+ >;
+ };
+
+- mcbsp2_pins: pinmux_mcbsp2_pins {
++ mcbsp2_pins: mcbsp2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x213c, PIN_INPUT | MUX_MODE0) /* mcbsp2_fsx.mcbsp2_fsx */
+ OMAP3_CORE1_IOPAD(0x213e, PIN_INPUT | MUX_MODE0) /* mcbsp2_clkx.mcbsp2_clkx */
+@@ -64,7 +64,7 @@ OMAP3_CORE1_IOPAD(0x2142, PIN_OUTPUT | MUX_MODE0) /* mcbsp2_dx.mcbsp2_dx */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -75,7 +75,7 @@ OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_dat3.sdmmc1_da
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
+@@ -86,14 +86,14 @@ OMAP3_CORE1_IOPAD(0x2162, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat3.sdmmc2_da
+ >;
+ };
+
+- i2c1_pins: pinmux_i2c1_pins {
++ i2c1_pins: i2c1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */
+ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */
+ >;
+ };
+
+- i2c3_pins: pinmux_i2c3_pins {
++ i2c3_pins: i2c3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0) /* i2c3_scl.i2c3_scl */
+ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0) /* i2c3_sda.i2c3_sda */
+diff --git a/arch/arm/boot/dts/omap3-igep0020-common.dtsi b/arch/arm/boot/dts/omap3-igep0020-common.dtsi
+index 73d8f471b9ec9..13f434625407a 100644
+--- a/arch/arm/boot/dts/omap3-igep0020-common.dtsi
++++ b/arch/arm/boot/dts/omap3-igep0020-common.dtsi
+@@ -107,13 +107,13 @@ &tfp410_pins
+ &dss_dpi_pins
+ >;
+
+- tfp410_pins: pinmux_tfp410_pins {
++ tfp410_pins: tfp410-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c6, PIN_OUTPUT | MUX_MODE4) /* hdq_sio.gpio_170 */
+ >;
+ };
+
+- dss_dpi_pins: pinmux_dss_dpi_pins {
++ dss_dpi_pins: dss-dpi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -146,7 +146,7 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE0) /* dss_data23.dss_data23 */
+ >;
+ };
+
+- uart2_pins: pinmux_uart2_pins {
++ uart2_pins: uart2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2174, PIN_INPUT | MUX_MODE0) /* uart2_cts.uart2_cts */
+ OMAP3_CORE1_IOPAD(0x2176, PIN_OUTPUT | MUX_MODE0) /* uart2_rts .uart2_rts*/
+@@ -155,7 +155,7 @@ OMAP3_CORE1_IOPAD(0x217a, PIN_INPUT | MUX_MODE0) /* uart2_rx.uart2_rx */
+ >;
+ };
+
+- smsc9221_pins: pinmux_smsc9221_pins {
++ smsc9221_pins: smsc9221-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d2, PIN_INPUT | MUX_MODE4) /* mcspi1_cs2.gpio_176 */
+ >;
+@@ -168,7 +168,7 @@ &omap3_pmx_core2 {
+ &hsusbb1_pins
+ >;
+
+- hsusbb1_pins: pinmux_hsusbb1_pins {
++ hsusbb1_pins: hsusbb1-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25da, PIN_OUTPUT | MUX_MODE3) /* etk_ctl.hsusb1_clk */
+ OMAP3630_CORE2_IOPAD(0x25d8, PIN_OUTPUT | MUX_MODE3) /* etk_clk.hsusb1_stp */
+@@ -185,7 +185,7 @@ OMAP3630_CORE2_IOPAD(0x25ea, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d7.hsusb1_da
+ >;
+ };
+
+- leds_pins: pinmux_leds_pins {
++ leds_pins: leds-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25f4, PIN_OUTPUT | MUX_MODE4) /* etk_d12.gpio_26 */
+ OMAP3630_CORE2_IOPAD(0x25f6, PIN_OUTPUT | MUX_MODE4) /* etk_d13.gpio_27 */
+@@ -193,7 +193,7 @@ OMAP3630_CORE2_IOPAD(0x25f8, PIN_OUTPUT | MUX_MODE4) /* etk_d14.gpio_28 */
+ >;
+ };
+
+- mmc1_wp_pins: pinmux_mmc1_cd_pins {
++ mmc1_wp_pins: mmc1-cd-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT | MUX_MODE4) /* etk_d15.gpio_29 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-igep0020-rev-f.dts b/arch/arm/boot/dts/omap3-igep0020-rev-f.dts
+index 9dca5bfc87ab2..f46539a39cf69 100644
+--- a/arch/arm/boot/dts/omap3-igep0020-rev-f.dts
++++ b/arch/arm/boot/dts/omap3-igep0020-rev-f.dts
+@@ -24,7 +24,7 @@ lbep5clwmc_wlen: regulator-lbep5clwmc-wlen {
+ };
+
+ &omap3_pmx_core {
+- lbep5clwmc_pins: pinmux_lbep5clwmc_pins {
++ lbep5clwmc_pins: lbep5clwmc-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d4, PIN_INPUT | MUX_MODE4) /* mcspi1_cs3.gpio_177 - W_IRQ */
+ OMAP3_CORE1_IOPAD(0x2166, PIN_OUTPUT | MUX_MODE4) /* sdmmc2_dat5.gpio_137 - BT_EN */
+diff --git a/arch/arm/boot/dts/omap3-igep0020.dts b/arch/arm/boot/dts/omap3-igep0020.dts
+index c6f863bc03adf..4b55ec22b4c62 100644
+--- a/arch/arm/boot/dts/omap3-igep0020.dts
++++ b/arch/arm/boot/dts/omap3-igep0020.dts
+@@ -27,7 +27,7 @@ mmc2_pwrseq: mmc2_pwrseq {
+ };
+
+ &omap3_pmx_core {
+- lbee1usjyc_pins: pinmux_lbee1usjyc_pins {
++ lbee1usjyc_pins: lbee1usjyc-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2166, PIN_OUTPUT | MUX_MODE4) /* sdmmc2_dat5.gpio_137 - RESET_N_W */
+ OMAP3_CORE1_IOPAD(0x2168, PIN_OUTPUT | MUX_MODE4) /* sdmmc2_dat6.gpio_138 - WIFI_PDN */
+diff --git a/arch/arm/boot/dts/omap3-igep0030-common.dtsi b/arch/arm/boot/dts/omap3-igep0030-common.dtsi
+index 742e3e1470633..d434f75aadaca 100644
+--- a/arch/arm/boot/dts/omap3-igep0030-common.dtsi
++++ b/arch/arm/boot/dts/omap3-igep0030-common.dtsi
+@@ -31,7 +31,7 @@ user2 {
+ };
+ };
+
+- hsusb2_phy: hsusb2_phy {
++ hsusb2_phy: hsusb2-phy-pins {
+ compatible = "usb-nop-xceiv";
+ reset-gpios = <&gpio2 22 GPIO_ACTIVE_LOW>; /* gpio_54 */
+ #phy-cells = <0>;
+@@ -42,7 +42,7 @@ &omap3_pmx_core {
+ pinctrl-names = "default";
+ pinctrl-0 = <&hsusb2_pins>;
+
+- hsusb2_pins: pinmux_hsusb2_pins {
++ hsusb2_pins: hsusb2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi1_cs3.hsusb2_data2 */
+ OMAP3_CORE1_IOPAD(0x21d6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_clk.hsusb2_data7 */
+@@ -53,7 +53,7 @@ OMAP3_CORE1_IOPAD(0x21de, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_cs1.hsusb2_d
+ >;
+ };
+
+- uart2_pins: pinmux_uart2_pins {
++ uart2_pins: uart2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x216c, PIN_INPUT | MUX_MODE1) /* mcbsp3_dx.uart2_cts */
+ OMAP3_CORE1_IOPAD(0x216e, PIN_OUTPUT | MUX_MODE1) /* mcbsp3_dr.uart2_rts */
+@@ -67,7 +67,7 @@ &omap3_pmx_core2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&hsusb2_core2_pins>;
+
+- hsusb2_core2_pins: pinmux_hsusb2_core2_pins {
++ hsusb2_core2_pins: hsusb2-core2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+ OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+@@ -78,7 +78,7 @@ OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_d
+ >;
+ };
+
+- leds_core2_pins: pinmux_leds_core2_pins {
++ leds_core2_pins: leds-core2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25e0, PIN_OUTPUT | MUX_MODE4) /* etk_d2.gpio_16 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-igep0030-rev-g.dts b/arch/arm/boot/dts/omap3-igep0030-rev-g.dts
+index 8e9c12cf51a7b..1a6b86b390052 100644
+--- a/arch/arm/boot/dts/omap3-igep0030-rev-g.dts
++++ b/arch/arm/boot/dts/omap3-igep0030-rev-g.dts
+@@ -24,7 +24,7 @@ lbep5clwmc_wlen: regulator-lbep5clwmc-wlen {
+ };
+
+ &omap3_pmx_core {
+- lbep5clwmc_pins: pinmux_lbep5clwmc_pins {
++ lbep5clwmc_pins: lbep5clwmc-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2164, PIN_INPUT | MUX_MODE4) /* sdmmc2_dat4.gpio_136 - W_IRQ */
+ OMAP3_CORE1_IOPAD(0x2166, PIN_OUTPUT | MUX_MODE4) /* sdmmc2_dat5.gpio_137 - BT_EN */
+@@ -32,7 +32,7 @@ OMAP3_CORE1_IOPAD(0x216a, PIN_OUTPUT | MUX_MODE4) /* sdmmc2_dat7.gpio_139 - WL_E
+ >;
+ };
+
+- leds_pins: pinmux_leds_pins {
++ leds_pins: leds-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21be, PIN_OUTPUT | MUX_MODE4) /* i2c2_scl.gpio_168 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-igep0030.dts b/arch/arm/boot/dts/omap3-igep0030.dts
+index 5188f96f431e7..4042f79350f10 100644
+--- a/arch/arm/boot/dts/omap3-igep0030.dts
++++ b/arch/arm/boot/dts/omap3-igep0030.dts
+@@ -27,7 +27,7 @@ mmc2_pwrseq: mmc2_pwrseq {
+ };
+
+ &omap3_pmx_core {
+- lbee1usjyc_pins: pinmux_lbee1usjyc_pins {
++ lbee1usjyc_pins: lbee1usjyc-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2166, PIN_OUTPUT | MUX_MODE4) /* sdmmc2_dat5.gpio_137 - RESET_N_W */
+ OMAP3_CORE1_IOPAD(0x2168, PIN_OUTPUT | MUX_MODE4) /* sdmmc2_dat6.gpio_138 - WIFI_PDN */
+diff --git a/arch/arm/boot/dts/omap3-ldp.dts b/arch/arm/boot/dts/omap3-ldp.dts
+index 85f33bbb566f9..bb6fab9fa47df 100644
+--- a/arch/arm/boot/dts/omap3-ldp.dts
++++ b/arch/arm/boot/dts/omap3-ldp.dts
+@@ -223,7 +223,7 @@ &mmc3 {
+ };
+
+ &omap3_pmx_core {
+- gpio_key_pins: pinmux_gpio_key_pins {
++ gpio_key_pins: gpio-key-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x211a, PIN_INPUT | MUX_MODE4) /* cam_d2.gpio_101 */
+ OMAP3_CORE1_IOPAD(0x211c, PIN_INPUT | MUX_MODE4) /* cam_d3.gpio_102 */
+@@ -237,7 +237,7 @@ OMAP3_CORE1_IOPAD(0x212a, PIN_INPUT | MUX_MODE4) /* cam_d10.gpio_109 */
+ >;
+ };
+
+- musb_pins: pinmux_musb_pins {
++ musb_pins: musb-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21a2, PIN_INPUT | MUX_MODE0) /* hsusb0_clk.hsusb0_clk */
+ OMAP3_CORE1_IOPAD(0x21aa, PIN_INPUT | MUX_MODE0) /* hsusb0_data0.hsusb0_data0 */
+@@ -254,7 +254,7 @@ OMAP3_CORE1_IOPAD(0x21a4, PIN_OUTPUT | MUX_MODE0) /* hsusb0_stp.hsusb0_stp */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_clk.mmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_cmd.mmc1_cmd */
+diff --git a/arch/arm/boot/dts/omap3-lilly-a83x.dtsi b/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
+index d310b5c7bac36..565a6c0e7b37d 100644
+--- a/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
++++ b/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
+@@ -54,19 +54,19 @@ hsusb1_phy: hsusb1_phy {
+ &omap3_pmx_wkup {
+ pinctrl-names = "default";
+
+- lan9221_pins: pinmux_lan9221_pins {
++ lan9221_pins: lan9221-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a5a, PIN_INPUT | MUX_MODE4) /* reserved.gpio_129 */
+ >;
+ };
+
+- tsc2048_pins: pinmux_tsc2048_pins {
++ tsc2048_pins: tsc2048-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a16, PIN_INPUT_PULLUP | MUX_MODE4) /* sys_boot6.gpio_8 */
+ >;
+ };
+
+- mmc1cd_pins: pinmux_mmc1cd_pins {
++ mmc1cd_pins: mmc1cd-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a56, PIN_INPUT | MUX_MODE4) /* reserved.gpio_126 */
+ >;
+@@ -76,7 +76,7 @@ OMAP3_WKUP_IOPAD(0x2a56, PIN_INPUT | MUX_MODE4) /* reserved.gpio_126 */
+ &omap3_pmx_core {
+ pinctrl-names = "default";
+
+- uart1_pins: pinmux_uart1_pins {
++ uart1_pins: uart1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x217c, PIN_OUTPUT | MUX_MODE0) /* uart1_tx.uart1_tx */
+ OMAP3_CORE1_IOPAD(0x217e, PIN_OUTPUT | MUX_MODE0) /* uart1_rts.uart1_rts */
+@@ -85,42 +85,42 @@ OMAP3_CORE1_IOPAD(0x2182, PIN_INPUT | MUX_MODE0) /* uart1_rx.uart1_rx */
+ >;
+ };
+
+- uart2_pins: pinmux_uart2_pins {
++ uart2_pins: uart2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2170, PIN_OUTPUT | MUX_MODE1) /* mcbsp3_clkx.uart2_tx */
+ OMAP3_CORE1_IOPAD(0x2172, PIN_INPUT | MUX_MODE1) /* mcbsp3_fsx.uart2_rx */
+ >;
+ };
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | MUX_MODE0) /* uart3_rx_irrx.uart3_rx_irrx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx.uart3_tx_irtx */
+ >;
+ };
+
+- i2c1_pins: pinmux_i2c1_pins {
++ i2c1_pins: i2c1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21ba ,PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_scl.i2c1_scl */
+ OMAP3_CORE1_IOPAD(0x21bc ,PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_sda.i2c1_sda */
+ >;
+ };
+
+- i2c2_pins: pinmux_i2c2_pins {
++ i2c2_pins: i2c2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT | MUX_MODE0) /* i2c2_scl.i2c2_scl */
+ OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT | MUX_MODE0) /* i2c2_sda.i2c2_sda */
+ >;
+ };
+
+- i2c3_pins: pinmux_i2c3_pins {
++ i2c3_pins: i2c3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0) /* i2c3_scl.i2c3_scl */
+ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0) /* i2c3_sda.i2c3_sda */
+ >;
+ };
+
+- hsusb1_pins: pinmux_hsusb1_pins {
++ hsusb1_pins: hsusb1-pins {
+ pinctrl-single,pins = <
+
+ /* GPIO 182 controls USB-Hub reset. But USB-Phy its
+@@ -132,7 +132,7 @@ OMAP3_CORE1_IOPAD(0x21de, PIN_OUTPUT_PULLUP | PIN_OFF_OUTPUT_HIGH | MUX_MODE4)
+ >;
+ };
+
+- hsusb_otg_pins: pinmux_hsusb_otg_pins {
++ hsusb_otg_pins: hsusb-otg-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21a2, PIN_INPUT | MUX_MODE0) /* hsusb0_clk.hsusb0_clk */
+ OMAP3_CORE1_IOPAD(0x21a4, PIN_OUTPUT | MUX_MODE0) /* hsusb0_stp.hsusb0_stp */
+@@ -149,7 +149,7 @@ OMAP3_CORE1_IOPAD(0x21b8, PIN_INPUT | MUX_MODE0) /* hsusb0_data7.hsusb0_data7
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -160,7 +160,7 @@ OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_dat3.sdmmc1_
+ >;
+ };
+
+- spi2_pins: pinmux_spi2_pins {
++ spi2_pins: spi2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d6, PIN_INPUT_PULLDOWN | MUX_MODE0) /* mcspi2_clk.mcspi2_clk */
+ OMAP3_CORE1_IOPAD(0x21d8, PIN_INPUT_PULLDOWN | MUX_MODE0) /* mcspi2_simo.mcspi2_simo */
+@@ -173,7 +173,7 @@ OMAP3_CORE1_IOPAD(0x21dc, PIN_OUTPUT | MUX_MODE0) /* mcspi2_cs0.mcspi2_cs0 */
+ &omap3_pmx_core2 {
+ pinctrl-names = "default";
+
+- hsusb1_2_pins: pinmux_hsusb1_2_pins {
++ hsusb1_2_pins: hsusb1-2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25d8, PIN_OUTPUT | MUX_MODE3) /* etk_clk.hsusb1_stp */
+ OMAP3630_CORE2_IOPAD(0x25da, PIN_INPUT | MUX_MODE3) /* etk_ctl.hsusb1_clk */
+@@ -190,7 +190,7 @@ OMAP3630_CORE2_IOPAD(0x25ee, PIN_INPUT | MUX_MODE3) /* etk_d9.hsusb1_nxt */
+ >;
+ };
+
+- gpio1_pins: pinmux_gpio1_pins {
++ gpio1_pins: gpio1-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25fa, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d15.gpio_29 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-lilly-dbb056.dts b/arch/arm/boot/dts/omap3-lilly-dbb056.dts
+index ecb4ef738e07b..e566bd336de49 100644
+--- a/arch/arm/boot/dts/omap3-lilly-dbb056.dts
++++ b/arch/arm/boot/dts/omap3-lilly-dbb056.dts
+@@ -24,25 +24,25 @@ &omap3_pmx_core {
+ pinctrl-names = "default";
+ pinctrl-0 = <&lcd_pins>;
+
+- lan9117_pins: pinmux_lan9117_pins {
++ lan9117_pins: lan9117-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2114, PIN_INPUT | MUX_MODE4) /* cam_fld.gpio_98 */
+ >;
+ };
+
+- gpio4_pins: pinmux_gpio4_pins {
++ gpio4_pins: gpio4-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x212e, PIN_INPUT | MUX_MODE4) /* cam_xclkb.gpio_111 -> sja1000 IRQ */
+ >;
+ };
+
+- gpio5_pins: pinmux_gpio5_pins {
++ gpio5_pins: gpio5-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x218c, PIN_OUTPUT | PIN_OFF_OUTPUT_HIGH | MUX_MODE4) /* mcbsp1_clk.gpio_156 -> enable DSS */
+ >;
+ };
+
+- lcd_pins: pinmux_lcd_pins {
++ lcd_pins: lcd-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -69,7 +69,7 @@ OMAP3_CORE1_IOPAD(0x20fe, PIN_OUTPUT | MUX_MODE0) /* dss_data17.dss_data17 */
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
+@@ -86,7 +86,7 @@ OMAP3_CORE1_IOPAD(0x219c, PIN_INPUT_PULLUP | MUX_MODE4) /* uart3_rts_sd.gpio_1
+ >;
+ };
+
+- spi1_pins: pinmux_spi1_pins {
++ spi1_pins: spi1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c8, PIN_INPUT | MUX_MODE0) /* mcspi1_clk.mcspi1_clk */
+ OMAP3_CORE1_IOPAD(0x21ca, PIN_INPUT | MUX_MODE0) /* mcspi1_simo.mcspi1_simo */
+diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
+index 89ab08d83261a..6ced24e4a7c33 100644
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -208,7 +208,7 @@ csi_isp: endpoint {
+ &omap3_pmx_core {
+ pinctrl-names = "default";
+
+- uart2_pins: pinmux_uart2_pins {
++ uart2_pins: uart2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2174, PIN_INPUT_PULLUP | MUX_MODE0) /* uart2_cts */
+ OMAP3_CORE1_IOPAD(0x2176, PIN_OUTPUT | MUX_MODE0) /* uart2_rts */
+@@ -217,14 +217,14 @@ OMAP3_CORE1_IOPAD(0x217a, PIN_INPUT | MUX_MODE0) /* uart2_rx */
+ >;
+ };
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | MUX_MODE0) /* uart3_rx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx */
+ >;
+ };
+
+- ethernet_pins: pinmux_ethernet_pins {
++ ethernet_pins: ethernet-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20b4, PIN_INPUT_PULLDOWN | MUX_MODE4) /* gpmc_ncs3.gpio_54 */
+ OMAP3_CORE1_IOPAD(0x20fc, PIN_OUTPUT | MUX_MODE4) /* dss_data16.gpio_86 */
+@@ -232,7 +232,7 @@ OMAP3_CORE1_IOPAD(0x219c, PIN_OUTPUT | MUX_MODE4) /* uart3_rts_sd.gpio_164 */
+ >;
+ };
+
+- gpmc_pins: pinmux_gpmc_pins {
++ gpmc_pins: gpmc-pins {
+ pinctrl-single,pins = <
+
+ /* address lines */
+@@ -259,34 +259,34 @@ OMAP3_CORE1_IOPAD(0x20be, PIN_INPUT | MUX_MODE0) /* gpmc_clk.gpmc_clk */
+ >;
+ };
+
+- i2c1_pins: pinmux_i2c1_pins {
++ i2c1_pins: i2c1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl */
+ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda */
+ >;
+ };
+
+- i2c2_pins: pinmux_i2c2_pins {
++ i2c2_pins: i2c2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT | MUX_MODE0) /* i2c2_scl */
+ OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT | MUX_MODE0) /* i2c2_sda */
+ >;
+ };
+
+- i2c3_pins: pinmux_i2c3_pins {
++ i2c3_pins: i2c3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0) /* i2c3_scl */
+ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0) /* i2c3_sda */
+ >;
+ };
+
+- debug_leds: pinmux_debug_led_pins {
++ debug_leds: debug-led-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2198, PIN_OUTPUT | MUX_MODE4) /* mcbsp1_clkx.gpio_162 */
+ >;
+ };
+
+- mcspi4_pins: pinmux_mcspi4_pins {
++ mcspi4_pins: mcspi4-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x218c, PIN_INPUT_PULLDOWN | MUX_MODE1) /* mcspi4_clk */
+ OMAP3_CORE1_IOPAD(0x2192, PIN_INPUT_PULLDOWN | MUX_MODE1) /* mcspi4_somi */
+@@ -295,7 +295,7 @@ OMAP3_CORE1_IOPAD(0x2196, PIN_OUTPUT | MUX_MODE1) /* mcspi4_cs0 */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd */
+@@ -306,7 +306,7 @@ OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_dat3 */
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd */
+@@ -321,13 +321,13 @@ OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat7 */
+ >;
+ };
+
+- acx565akm_pins: pinmux_acx565akm_pins {
++ acx565akm_pins: acx565akm-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2104, PIN_OUTPUT | MUX_MODE4) /* RX51_LCD_RESET_GPIO */
+ >;
+ };
+
+- dss_sdi_pins: pinmux_dss_sdi_pins {
++ dss_sdi_pins: dss-sdi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20f0, PIN_OUTPUT | MUX_MODE1) /* dss_data10.sdi_dat1n */
+ OMAP3_CORE1_IOPAD(0x20f2, PIN_OUTPUT | MUX_MODE1) /* dss_data11.sdi_dat1p */
+@@ -339,14 +339,14 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE1) /* dss_data23.sdi_clkn */
+ >;
+ };
+
+- wl1251_pins: pinmux_wl1251 {
++ wl1251_pins: wl1251-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20fe, PIN_OUTPUT | MUX_MODE4) /* gpio 87 => wl1251 enable */
+ OMAP3_CORE1_IOPAD(0x208a, PIN_INPUT | MUX_MODE4) /* gpio 42 => wl1251 irq */
+ >;
+ };
+
+- ssi_pins: pinmux_ssi {
++ ssi_pins: ssi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2180, PIN_INPUT_PULLUP | MUX_MODE1) /* ssi1_rdy_tx */
+ OMAP3_CORE1_IOPAD(0x217e, PIN_OUTPUT | MUX_MODE1) /* ssi1_flag_tx */
+@@ -359,7 +359,7 @@ OMAP3_CORE1_IOPAD(0x218a, PIN_OUTPUT | MUX_MODE1) /* ssi1_wake */
+ >;
+ };
+
+- modem_pins: pinmux_modem {
++ modem_pins: modem-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20dc, PIN_OUTPUT | MUX_MODE4) /* gpio 70 => cmt_apeslpx */
+ OMAP3_CORE1_IOPAD(0x20e0, PIN_INPUT | MUX_MODE4) /* gpio 72 => ape_rst_rq */
+@@ -370,7 +370,7 @@ modem_pins: pinmux_modem {
+ >;
+ };
+
+- camera_pins: pinmux_camera {
++ camera_pins: camera-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x210c, PIN_OUTPUT | MUX_MODE7) /* cam_hs */
+ OMAP3_CORE1_IOPAD(0x210e, PIN_OUTPUT | MUX_MODE7) /* cam_vs */
+diff --git a/arch/arm/boot/dts/omap3-n950-n9.dtsi b/arch/arm/boot/dts/omap3-n950-n9.dtsi
+index f68da828b0505..aa4fcdbedd8fb 100644
+--- a/arch/arm/boot/dts/omap3-n950-n9.dtsi
++++ b/arch/arm/boot/dts/omap3-n950-n9.dtsi
+@@ -57,20 +57,20 @@ vctcxo: vctcxo {
+ };
+
+ &omap3_pmx_core {
+- accelerator_pins: pinmux_accelerator_pins {
++ accelerator_pins: accelerator-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21da, PIN_INPUT | MUX_MODE4) /* mcspi2_somi.gpio_180 -> LIS302 INT1 */
+ OMAP3_CORE1_IOPAD(0x21dc, PIN_INPUT | MUX_MODE4) /* mcspi2_cs0.gpio_181 -> LIS302 INT2 */
+ >;
+ };
+
+- debug_leds: pinmux_debug_led_pins {
++ debug_leds: debug-led-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2108, PIN_OUTPUT | MUX_MODE4) /* dss_data22.gpio_92 */
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd */
+@@ -81,14 +81,14 @@ OMAP3_CORE1_IOPAD(0x2162, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat3 */
+ >;
+ };
+
+- wlan_pins: pinmux_wlan_pins {
++ wlan_pins: wlan-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x207c, PIN_OUTPUT | MUX_MODE4) /* gpio 35 - wlan enable */
+ OMAP3_CORE1_IOPAD(0x208a, PIN_INPUT | MUX_MODE4) /* gpio 42 - wlan irq */
+ >;
+ };
+
+- ssi_pins: pinmux_ssi_pins {
++ ssi_pins: ssi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x217c, PIN_OUTPUT | MUX_MODE1) /* ssi1_dat_tx */
+ OMAP3_CORE1_IOPAD(0x217e, PIN_OUTPUT | MUX_MODE1) /* ssi1_flag_tx */
+@@ -101,7 +101,7 @@ OMAP3_CORE1_IOPAD(0x218a, PIN_OUTPUT | MUX_MODE1) /* ssi1_wake */
+ >;
+ };
+
+- ssi_pins_idle: pinmux_ssi_pins_idle {
++ ssi_pins_idle: ssi-idle-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x217c, PIN_OUTPUT | MUX_MODE7) /* ssi1_dat_tx */
+ OMAP3_CORE1_IOPAD(0x217e, PIN_OUTPUT | MUX_MODE7) /* ssi1_flag_tx */
+@@ -114,7 +114,7 @@ OMAP3_CORE1_IOPAD(0x218a, PIN_OUTPUT | MUX_MODE7) /* ssi1_wake */
+ >;
+ };
+
+- modem_pins1: pinmux_modem_core1_pins {
++ modem_pins1: modem-core1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x207a, PIN_INPUT | MUX_MODE4) /* gpio_34 (ape_rst_rq) */
+ OMAP3_CORE1_IOPAD(0x2100, PIN_OUTPUT | MUX_MODE4) /* gpio_88 (cmt_rst_rq) */
+@@ -122,7 +122,7 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE4) /* gpio_93 (cmt_ape
+ >;
+ };
+
+- uart2_pins: pinmux_uart2_pins {
++ uart2_pins: uart2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2174, PIN_INPUT_PULLUP | MUX_MODE0) /* uart2_cts */
+ OMAP3_CORE1_IOPAD(0x2176, PIN_OUTPUT | MUX_MODE0) /* uart2_rts */
+@@ -133,7 +133,7 @@ OMAP3_CORE1_IOPAD(0x217a, PIN_INPUT | MUX_MODE0) /* uart2_rx */
+ };
+
+ &omap3_pmx_core2 {
+- modem_pins2: pinmux_modem_core2_pins {
++ modem_pins2: modem-core2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25ec, PIN_OUTPUT | MUX_MODE4) /* gpio_23 (cmt_en) */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-n950.dts b/arch/arm/boot/dts/omap3-n950.dts
+index b2f480022ff6e..a82e02031c7b6 100644
+--- a/arch/arm/boot/dts/omap3-n950.dts
++++ b/arch/arm/boot/dts/omap3-n950.dts
+@@ -30,7 +30,7 @@ keypad_slide {
+ };
+
+ &omap3_pmx_core {
+- keypad_slide_pins: pinmux_debug_led_pins {
++ keypad_slide_pins: debug-led-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x212a, PIN_INPUT | MUX_MODE4) /* cam_d10.gpio_109 */
+ >;
+@@ -38,7 +38,7 @@ OMAP3_CORE1_IOPAD(0x212a, PIN_INPUT | MUX_MODE4) /* cam_d10.gpio_109 */
+ };
+
+ &omap3_pmx_core {
+- spi4_pins: pinmux_spi4_pins {
++ spi4_pins: spi4-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x218c, PIN_INPUT_PULLDOWN | MUX_MODE1) /* mcspi4_clk */
+ OMAP3_CORE1_IOPAD(0x2190, PIN_OUTPUT | MUX_MODE1) /* mcspi4_simo */
+@@ -49,7 +49,7 @@ OMAP3_CORE1_IOPAD(0x2196, PIN_OUTPUT | MUX_MODE1) /* mcspi4_cs0 */
+ };
+
+ &omap3_pmx_core {
+- dsi_pins: pinmux_dsi_pins {
++ dsi_pins: dsi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20dc, PIN_OUTPUT | MUX_MODE1) /* dsi_dx0 - data0+ */
+ OMAP3_CORE1_IOPAD(0x20de, PIN_OUTPUT | MUX_MODE1) /* dsi_dy0 - data0- */
+@@ -60,7 +60,7 @@ OMAP3_CORE1_IOPAD(0x20e6, PIN_OUTPUT | MUX_MODE1) /* dsi_dy2 - data1- */
+ >;
+ };
+
+- display_pins: pinmux_display_pins {
++ display_pins: display-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20ca, PIN_INPUT | MUX_MODE4) /* gpio 62 - display te */
+ OMAP3_CORE1_IOPAD(0x20fe, PIN_OUTPUT | MUX_MODE4) /* gpio 87 - display reset */
+diff --git a/arch/arm/boot/dts/omap3-overo-alto35-common.dtsi b/arch/arm/boot/dts/omap3-overo-alto35-common.dtsi
+index bb932913c9e34..aede433d33ea2 100644
+--- a/arch/arm/boot/dts/omap3-overo-alto35-common.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-alto35-common.dtsi
+@@ -51,7 +51,7 @@ button0 {
+ };
+
+ &omap3_pmx_core {
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x217c, PIN_OUTPUT | MUX_MODE4) /* uart1_tx.gpio_148 */
+ OMAP3_CORE1_IOPAD(0x2180, PIN_OUTPUT | MUX_MODE4) /* uart1_cts.gpio_150 */
+@@ -62,7 +62,7 @@ OMAP3_CORE1_IOPAD(0x21c6, PIN_OUTPUT | MUX_MODE4) /* hdq_sio.gpio_170 */
+ };
+
+ &omap3_pmx_wkup {
+- button_pins: pinmux_button_pins {
++ button_pins: button-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a18, PIN_INPUT | MUX_MODE4) /* sys_clkout1.gpio_10 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-overo-base.dtsi b/arch/arm/boot/dts/omap3-overo-base.dtsi
+index adc714c398257..cc57626ea6076 100644
+--- a/arch/arm/boot/dts/omap3-overo-base.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-base.dtsi
+@@ -44,7 +44,7 @@ hsusb2_power: hsusb2_power_reg {
+ };
+
+ /* HS USB Host PHY on PORT 2 */
+- hsusb2_phy: hsusb2_phy {
++ hsusb2_phy: hsusb2-phy-pins {
+ compatible = "usb-nop-xceiv";
+ reset-gpios = <&gpio6 23 GPIO_ACTIVE_LOW>; /* gpio_183 */
+ vcc-supply = <&hsusb2_power>;
+@@ -80,7 +80,7 @@ &omap3_pmx_core {
+ &hsusb2_pins
+ >;
+
+- uart2_pins: pinmux_uart2_pins {
++ uart2_pins: uart2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x216c, PIN_INPUT | MUX_MODE1) /* mcbsp3_dx.uart2_cts */
+ OMAP3_CORE1_IOPAD(0x216e, PIN_OUTPUT | MUX_MODE1) /* mcbsp3_dr.uart2_rts */
+@@ -89,14 +89,14 @@ OMAP3_CORE1_IOPAD(0x2172, PIN_INPUT | MUX_MODE1) /* mcbsp3_fsx.uart2_rx */
+ >;
+ };
+
+- i2c1_pins: pinmux_i2c1_pins {
++ i2c1_pins: i2c1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */
+ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -107,7 +107,7 @@ OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_dat3.sdmmc1_d
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
+@@ -119,14 +119,14 @@ OMAP3_CORE1_IOPAD(0x2162, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat3.sdmmc2_d
+ };
+
+ /* WiFi/BT combo */
+- w3cbw003c_pins: pinmux_w3cbw003c_pins {
++ w3cbw003c_pins: w3cbw003c-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20b4, PIN_OUTPUT | MUX_MODE4) /* gpmc_ncs3.gpio_54 */
+ OMAP3_CORE1_IOPAD(0x219c, PIN_OUTPUT | MUX_MODE4) /* uart3_rts_sd.gpio_164 */
+ >;
+ };
+
+- hsusb2_pins: pinmux_hsusb2_pins {
++ hsusb2_pins: hsusb2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21d4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi1_cs3.hsusb2_data2 */
+ OMAP3_CORE1_IOPAD(0x21d6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_clk.hsusb2_data7 */
+diff --git a/arch/arm/boot/dts/omap3-overo-chestnut43.dts b/arch/arm/boot/dts/omap3-overo-chestnut43.dts
+index d147d704b89f1..bb53c76fff6ca 100644
+--- a/arch/arm/boot/dts/omap3-overo-chestnut43.dts
++++ b/arch/arm/boot/dts/omap3-overo-chestnut43.dts
+@@ -18,14 +18,14 @@ / {
+ };
+
+ &omap3_pmx_core2 {
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25ea, PIN_OUTPUT | MUX_MODE4) /* etk_d7.gpio_21 */
+ OMAP3430_CORE2_IOPAD(0x25ec, PIN_OUTPUT | MUX_MODE4) /* etk_d8.gpio_22 */
+ >;
+ };
+
+- button_pins: pinmux_button_pins {
++ button_pins: button-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25ee, PIN_INPUT | MUX_MODE4) /* etk_d9.gpio_23 */
+ OMAP3430_CORE2_IOPAD(0x25dc, PIN_INPUT | MUX_MODE4) /* etk_d0.gpio_14 */
+diff --git a/arch/arm/boot/dts/omap3-overo-common-dvi.dtsi b/arch/arm/boot/dts/omap3-overo-common-dvi.dtsi
+index 339a51fa41198..b1a800f2e940d 100644
+--- a/arch/arm/boot/dts/omap3-overo-common-dvi.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-common-dvi.dtsi
+@@ -8,7 +8,7 @@
+ */
+
+ &omap3_pmx_core {
+- dss_dpi_pins: pinmux_dss_dpi_pins {
++ dss_dpi_pins: dss-dpi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+diff --git a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
+index c3570acc35fad..0da561a23f36b 100644
+--- a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
+@@ -8,7 +8,7 @@
+ */
+
+ &omap3_pmx_core {
+- dss_dpi_pins: pinmux_dss_dpi_pins {
++ dss_dpi_pins: dss-dpi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -41,19 +41,19 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE0) /* dss_data23.dss_data23 */
+ >;
+ };
+
+- lb035_pins: pinmux_lb035_pins {
++ lb035_pins: lb035-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2174, PIN_OUTPUT | MUX_MODE4) /* uart2_cts.gpio_144 */
+ >;
+ };
+
+- backlight_pins: pinmux_backlight_pins {
++ backlight_pins: backlight-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2176, PIN_OUTPUT | MUX_MODE4) /* uart2_rts.gpio_145 */
+ >;
+ };
+
+- mcspi1_pins: pinmux_mcspi1_pins {
++ mcspi1_pins: mcspi1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c8, PIN_INPUT | MUX_MODE0) /* mcspi1_clk.mcspi1_clk */
+ OMAP3_CORE1_IOPAD(0x21ca, PIN_INPUT | MUX_MODE0) /* mcspi1_simo.mcspi1_simo */
+@@ -63,7 +63,7 @@ OMAP3_CORE1_IOPAD(0x21d0, PIN_INPUT | MUX_MODE0) /* mcspi1_cs1.mcspi1_cs1 */
+ >;
+ };
+
+- ads7846_pins: pinmux_ads7846_pins {
++ ads7846_pins: ads7846-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2138, PIN_INPUT_PULLDOWN | MUX_MODE4) /* csi2_dx1.gpio_114 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi b/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
+index d95a0e130058c..981f02f088f85 100644
+--- a/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
+@@ -8,7 +8,7 @@
+ */
+
+ &omap3_pmx_core {
+- dss_dpi_pins: pinmux_dss_dpi_pins {
++ dss_dpi_pins: dss-dpi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -41,19 +41,19 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE0) /* dss_data23.dss_data23 */
+ >;
+ };
+
+- lte430_pins: pinmux_lte430_pins {
++ lte430_pins: lte430-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2174, PIN_OUTPUT | MUX_MODE4) /* uart2_cts.gpio_144 */
+ >;
+ };
+
+- backlight_pins: pinmux_backlight_pins {
++ backlight_pins: backlight-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2176, PIN_OUTPUT | MUX_MODE4) /* uart2_rts.gpio_145 */
+ >;
+ };
+
+- mcspi1_pins: pinmux_mcspi1_pins {
++ mcspi1_pins: mcspi1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c8, PIN_INPUT | MUX_MODE0) /* mcspi1_clk.mcspi1_clk */
+ OMAP3_CORE1_IOPAD(0x21ca, PIN_INPUT | MUX_MODE0) /* mcspi1_simo.mcspi1_simo */
+@@ -62,7 +62,7 @@ OMAP3_CORE1_IOPAD(0x21ce, PIN_INPUT | MUX_MODE0) /* mcspi1_cs0.mcspi1_cs0 */
+ >;
+ };
+
+- ads7846_pins: pinmux_ads7846_pins {
++ ads7846_pins: ads7846-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2138, PIN_INPUT_PULLDOWN | MUX_MODE4) /* csi2_dx1.gpio_114 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-overo-common-peripherals.dtsi b/arch/arm/boot/dts/omap3-overo-common-peripherals.dtsi
+index 8a4a02472c9a3..00369f699e207 100644
+--- a/arch/arm/boot/dts/omap3-overo-common-peripherals.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-common-peripherals.dtsi
+@@ -24,14 +24,14 @@ lis33_1v8: lis33-1v8-reg {
+ };
+
+ &omap3_pmx_core {
+- i2c3_pins: pinmux_i2c3_pins {
++ i2c3_pins: i2c3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0) /* i2c3_scl.i2c3_scl */
+ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0) /* i2c3_sda.i2c3_sda */
+ >;
+ };
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | MUX_MODE0) /* uart3_rx_irrx.uart3_rx_irrx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx.uart3_tx_irtx */
+diff --git a/arch/arm/boot/dts/omap3-overo-gallop43.dts b/arch/arm/boot/dts/omap3-overo-gallop43.dts
+index 24b40bdf7ea1d..d882a58028c14 100644
+--- a/arch/arm/boot/dts/omap3-overo-gallop43.dts
++++ b/arch/arm/boot/dts/omap3-overo-gallop43.dts
+@@ -18,14 +18,14 @@ / {
+ };
+
+ &omap3_pmx_core2 {
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25ea, PIN_OUTPUT | MUX_MODE4) /* etk_d7.gpio_21 */
+ OMAP3430_CORE2_IOPAD(0x25ec, PIN_OUTPUT | MUX_MODE4) /* etk_d8.gpio_22 */
+ >;
+ };
+
+- button_pins: pinmux_button_pins {
++ button_pins: button-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25ee, PIN_INPUT | MUX_MODE4) /* etk_d9.gpio_23 */
+ OMAP3430_CORE2_IOPAD(0x25dc, PIN_INPUT | MUX_MODE4) /* etk_d0.gpio_14 */
+diff --git a/arch/arm/boot/dts/omap3-overo-palo35.dts b/arch/arm/boot/dts/omap3-overo-palo35.dts
+index 55e08d56b18b3..39c8e9ce57760 100644
+--- a/arch/arm/boot/dts/omap3-overo-palo35.dts
++++ b/arch/arm/boot/dts/omap3-overo-palo35.dts
+@@ -18,14 +18,14 @@ / {
+ };
+
+ &omap3_pmx_core2 {
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25ea, PIN_OUTPUT | MUX_MODE4) /* etk_d7.gpio_21 */
+ OMAP3430_CORE2_IOPAD(0x25ec, PIN_OUTPUT | MUX_MODE4) /* etk_d8.gpio_22 */
+ >;
+ };
+
+- button_pins: pinmux_button_pins {
++ button_pins: button-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25ee, PIN_INPUT | MUX_MODE4) /* etk_d9.gpio_23 */
+ OMAP3430_CORE2_IOPAD(0x25dc, PIN_INPUT | MUX_MODE4) /* etk_d0.gpio_14 */
+diff --git a/arch/arm/boot/dts/omap3-overo-palo43.dts b/arch/arm/boot/dts/omap3-overo-palo43.dts
+index 092c8325a133d..2c0f755ec8cc5 100644
+--- a/arch/arm/boot/dts/omap3-overo-palo43.dts
++++ b/arch/arm/boot/dts/omap3-overo-palo43.dts
+@@ -18,14 +18,14 @@ / {
+ };
+
+ &omap3_pmx_core2 {
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25ea, PIN_OUTPUT | MUX_MODE4) /* etk_d7.gpio_21 */
+ OMAP3430_CORE2_IOPAD(0x25ec, PIN_OUTPUT | MUX_MODE4) /* etk_d8.gpio_22 */
+ >;
+ };
+
+- button_pins: pinmux_button_pins {
++ button_pins: button-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25ee, PIN_INPUT | MUX_MODE4) /* etk_d9.gpio_23 */
+ OMAP3430_CORE2_IOPAD(0x25dc, PIN_INPUT | MUX_MODE4) /* etk_d0.gpio_14 */
+diff --git a/arch/arm/boot/dts/omap3-overo-storm-chestnut43.dts b/arch/arm/boot/dts/omap3-overo-storm-chestnut43.dts
+index bc5a04e033362..c5e798dd7a766 100644
+--- a/arch/arm/boot/dts/omap3-overo-storm-chestnut43.dts
++++ b/arch/arm/boot/dts/omap3-overo-storm-chestnut43.dts
+@@ -18,14 +18,14 @@ / {
+ };
+
+ &omap3_pmx_core2 {
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25ea, PIN_OUTPUT | MUX_MODE4) /* etk_d7.gpio_21 */
+ OMAP3630_CORE2_IOPAD(0x25ec, PIN_OUTPUT | MUX_MODE4) /* etk_d8.gpio_22 */
+ >;
+ };
+
+- button_pins: pinmux_button_pins {
++ button_pins: button-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25ee, PIN_INPUT | MUX_MODE4) /* etk_d9.gpio_23 */
+ OMAP3630_CORE2_IOPAD(0x25dc, PIN_INPUT | MUX_MODE4) /* etk_d0.gpio_14 */
+diff --git a/arch/arm/boot/dts/omap3-overo-storm-gallop43.dts b/arch/arm/boot/dts/omap3-overo-storm-gallop43.dts
+index 065c31cbf0e29..ae56b25566df4 100644
+--- a/arch/arm/boot/dts/omap3-overo-storm-gallop43.dts
++++ b/arch/arm/boot/dts/omap3-overo-storm-gallop43.dts
+@@ -18,14 +18,14 @@ / {
+ };
+
+ &omap3_pmx_core2 {
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25ea, PIN_OUTPUT | MUX_MODE4) /* etk_d7.gpio_21 */
+ OMAP3630_CORE2_IOPAD(0x25ec, PIN_OUTPUT | MUX_MODE4) /* etk_d8.gpio_22 */
+ >;
+ };
+
+- button_pins: pinmux_button_pins {
++ button_pins: button-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25ee, PIN_INPUT | MUX_MODE4) /* etk_d9.gpio_23 */
+ OMAP3630_CORE2_IOPAD(0x25dc, PIN_INPUT | MUX_MODE4) /* etk_d0.gpio_14 */
+diff --git a/arch/arm/boot/dts/omap3-overo-storm-palo35.dts b/arch/arm/boot/dts/omap3-overo-storm-palo35.dts
+index e38c1c51392c5..2ba360e7c0409 100644
+--- a/arch/arm/boot/dts/omap3-overo-storm-palo35.dts
++++ b/arch/arm/boot/dts/omap3-overo-storm-palo35.dts
+@@ -18,14 +18,14 @@ / {
+ };
+
+ &omap3_pmx_core2 {
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25ea, PIN_OUTPUT | MUX_MODE4) /* etk_d7.gpio_21 */
+ OMAP3630_CORE2_IOPAD(0x25ec, PIN_OUTPUT | MUX_MODE4) /* etk_d8.gpio_22 */
+ >;
+ };
+
+- button_pins: pinmux_button_pins {
++ button_pins: button-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25ee, PIN_INPUT | MUX_MODE4) /* etk_d9.gpio_23 */
+ OMAP3630_CORE2_IOPAD(0x25dc, PIN_INPUT | MUX_MODE4) /* etk_d0.gpio_14 */
+diff --git a/arch/arm/boot/dts/omap3-overo-storm-palo43.dts b/arch/arm/boot/dts/omap3-overo-storm-palo43.dts
+index e6dc23159c4d9..f193dc86c8e3e 100644
+--- a/arch/arm/boot/dts/omap3-overo-storm-palo43.dts
++++ b/arch/arm/boot/dts/omap3-overo-storm-palo43.dts
+@@ -18,14 +18,14 @@ / {
+ };
+
+ &omap3_pmx_core2 {
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25ea, PIN_OUTPUT | MUX_MODE4) /* etk_d7.gpio_21 */
+ OMAP3630_CORE2_IOPAD(0x25ec, PIN_OUTPUT | MUX_MODE4) /* etk_d8.gpio_22 */
+ >;
+ };
+
+- button_pins: pinmux_button_pins {
++ button_pins: button-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25ee, PIN_INPUT | MUX_MODE4) /* etk_d9.gpio_23 */
+ OMAP3630_CORE2_IOPAD(0x25dc, PIN_INPUT | MUX_MODE4) /* etk_d0.gpio_14 */
+diff --git a/arch/arm/boot/dts/omap3-overo-storm-summit.dts b/arch/arm/boot/dts/omap3-overo-storm-summit.dts
+index 587c08ce282d3..dd5d4aebf1b23 100644
+--- a/arch/arm/boot/dts/omap3-overo-storm-summit.dts
++++ b/arch/arm/boot/dts/omap3-overo-storm-summit.dts
+@@ -18,7 +18,7 @@ / {
+ };
+
+ &omap3_pmx_core2 {
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25ea, PIN_OUTPUT | MUX_MODE4) /* etk_d7.gpio_21 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-overo-storm.dtsi b/arch/arm/boot/dts/omap3-overo-storm.dtsi
+index 2af15d5f61f92..da583b47ed8db 100644
+--- a/arch/arm/boot/dts/omap3-overo-storm.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-storm.dtsi
+@@ -12,7 +12,7 @@ &omap3_pmx_core2 {
+ &hsusb2_2_pins
+ >;
+
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ hsusb2_2_pins: hsusb2-2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+ OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+@@ -23,7 +23,7 @@ OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_d
+ >;
+ };
+
+- w3cbw003c_2_pins: pinmux_w3cbw003c_2_pins {
++ w3cbw003c_2_pins: w3cbw003c-2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25e0, PIN_OUTPUT | MUX_MODE4) /* etk_d2.gpio_16 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-overo-summit.dts b/arch/arm/boot/dts/omap3-overo-summit.dts
+index a6c9799fe4915..da5ca80430aeb 100644
+--- a/arch/arm/boot/dts/omap3-overo-summit.dts
++++ b/arch/arm/boot/dts/omap3-overo-summit.dts
+@@ -18,7 +18,7 @@ / {
+ };
+
+ &omap3_pmx_core2 {
+- led_pins: pinmux_led_pins {
++ led_pins: led-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25ea, PIN_OUTPUT | MUX_MODE4) /* etk_d7.gpio_21 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-overo.dtsi b/arch/arm/boot/dts/omap3-overo.dtsi
+index cc9263e99254f..7dc044e87226c 100644
+--- a/arch/arm/boot/dts/omap3-overo.dtsi
++++ b/arch/arm/boot/dts/omap3-overo.dtsi
+@@ -12,7 +12,7 @@ &omap3_pmx_core2 {
+ &hsusb2_2_pins
+ >;
+
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ hsusb2_2_pins: hsusb2-2-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+ OMAP3430_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+@@ -23,7 +23,7 @@ OMAP3430_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_d
+ >;
+ };
+
+- w3cbw003c_2_pins: pinmux_w3cbw003c_2_pins {
++ w3cbw003c_2_pins: w3cbw003c-2-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25e0, PIN_OUTPUT | MUX_MODE4) /* etk_d2.gpio_16 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-pandora-1ghz.dts b/arch/arm/boot/dts/omap3-pandora-1ghz.dts
+index ea509956d7aca..ffc072e1e2397 100644
+--- a/arch/arm/boot/dts/omap3-pandora-1ghz.dts
++++ b/arch/arm/boot/dts/omap3-pandora-1ghz.dts
+@@ -27,7 +27,7 @@ &hsusb2_2_pins
+ &control_pins
+ >;
+
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ hsusb2_2_pins: hsusb2-2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+ OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+@@ -38,7 +38,7 @@ OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_d
+ >;
+ };
+
+- mmc3_pins: pinmux_mmc3_pins {
++ mmc3_pins: mmc3-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25d8, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_clk.sdmmc3_clk */
+ OMAP3630_CORE2_IOPAD(0x25da, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_ctl.sdmmc3_cmd */
+@@ -49,7 +49,7 @@ OMAP3630_CORE2_IOPAD(0x25e8, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_d6.sdmmc3_dat2
+ >;
+ };
+
+- control_pins: pinmux_control_pins {
++ control_pins: control-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25dc, PIN_INPUT_PULLDOWN | MUX_MODE4) /* etk_d0.gpio_14 = HP_SHUTDOWN */
+ OMAP3630_CORE2_IOPAD(0x25de, PIN_OUTPUT | MUX_MODE4) /* etk_d1.gpio_15 = BT_SHUTDOWN */
+diff --git a/arch/arm/boot/dts/omap3-pandora-600mhz.dts b/arch/arm/boot/dts/omap3-pandora-600mhz.dts
+index 6bd9041942f2a..2d5eac3ffc6cd 100644
+--- a/arch/arm/boot/dts/omap3-pandora-600mhz.dts
++++ b/arch/arm/boot/dts/omap3-pandora-600mhz.dts
+@@ -27,7 +27,7 @@ &hsusb2_2_pins
+ &control_pins
+ >;
+
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ hsusb2_2_pins: hsusb2-2-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+ OMAP3430_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+@@ -38,7 +38,7 @@ OMAP3430_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_d
+ >;
+ };
+
+- mmc3_pins: pinmux_mmc3_pins {
++ mmc3_pins: mmc3-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25d8, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_clk.sdmmc3_clk */
+ OMAP3430_CORE2_IOPAD(0x25da, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_ctl.sdmmc3_cmd */
+@@ -49,7 +49,7 @@ OMAP3430_CORE2_IOPAD(0x25e8, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_d6.sdmmc3_dat2
+ >;
+ };
+
+- control_pins: pinmux_control_pins {
++ control_pins: control-pins {
+ pinctrl-single,pins = <
+ OMAP3430_CORE2_IOPAD(0x25dc, PIN_INPUT_PULLDOWN | MUX_MODE4) /* etk_d0.gpio_14 = HP_SHUTDOWN */
+ OMAP3430_CORE2_IOPAD(0x25de, PIN_OUTPUT | MUX_MODE4) /* etk_d1.gpio_15 = BT_SHUTDOWN */
+diff --git a/arch/arm/boot/dts/omap3-pandora-common.dtsi b/arch/arm/boot/dts/omap3-pandora-common.dtsi
+index 4c3b6bab179cc..06c5b23589991 100644
+--- a/arch/arm/boot/dts/omap3-pandora-common.dtsi
++++ b/arch/arm/boot/dts/omap3-pandora-common.dtsi
+@@ -205,7 +205,7 @@ lid {
+ };
+
+ /* HS USB Host PHY on PORT 2 */
+- hsusb2_phy: hsusb2_phy {
++ hsusb2_phy: hsusb2-phy-pins {
+ compatible = "usb-nop-xceiv";
+ reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>; /* GPIO_16 */
+ vcc-supply = <&vaux2>;
+@@ -251,7 +251,7 @@ wg7210_32k: fixed-regulator-wg7210_32k {
+
+ &omap3_pmx_core {
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -262,7 +262,7 @@ OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_dat3.sdmmc1_d
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
+@@ -277,7 +277,7 @@ OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT_PULLUP | MUX_MODE1) /* sdmmc2_dat7.sdmmc2_c
+ >;
+ };
+
+- dss_dpi_pins: pinmux_dss_dpi_pins {
++ dss_dpi_pins: dss-dpi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -311,14 +311,14 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE0) /* dss_data23.dss_data23 */
+ >;
+ };
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | PIN_OFF_WAKEUPENABLE | MUX_MODE0) /* uart3_rx_irrx.uart3_rx_irrx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx.uart3_tx_irtx */
+ >;
+ };
+
+- led_pins: pinmux_leds_pins {
++ led_pins: leds-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2154, PIN_OUTPUT | MUX_MODE4) /* GPIO_128 */
+ OMAP3_CORE1_IOPAD(0x2156, PIN_OUTPUT | MUX_MODE4) /* GPIO_129 */
+@@ -327,7 +327,7 @@ OMAP3_CORE1_IOPAD(0x2192, PIN_OUTPUT | MUX_MODE4) /* GPIO_159 */
+ >;
+ };
+
+- button_pins: pinmux_button_pins {
++ button_pins: button-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2110, PIN_INPUT | MUX_MODE4) /* GPIO_96 */
+ OMAP3_CORE1_IOPAD(0x2112, PIN_INPUT | MUX_MODE4) /* GPIO_97 */
+@@ -349,7 +349,7 @@ OMAP3_CORE1_IOPAD(0x21d2, PIN_INPUT | MUX_MODE4) /* GPIO_176 */
+ >;
+ };
+
+- penirq_pins: pinmux_penirq_pins {
++ penirq_pins: penirq-pins {
+ pinctrl-single,pins = <
+ /* here we could enable to wakeup the cpu from suspend by a pen touch */
+ OMAP3_CORE1_IOPAD(0x210c, PIN_INPUT | MUX_MODE4) /* GPIO_94 */
+diff --git a/arch/arm/boot/dts/omap3-sb-t35.dtsi b/arch/arm/boot/dts/omap3-sb-t35.dtsi
+index 5ec0893415e03..6730c749d5eaf 100644
+--- a/arch/arm/boot/dts/omap3-sb-t35.dtsi
++++ b/arch/arm/boot/dts/omap3-sb-t35.dtsi
+@@ -56,27 +56,27 @@ audio_amp: audio_amp {
+ };
+
+ &omap3_pmx_core {
+- smsc2_pins: pinmux_smsc2_pins {
++ smsc2_pins: smsc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20b6, PIN_OUTPUT | MUX_MODE0) /* gpmc_ncs4.gpmc_ncs4 */
+ OMAP3_CORE1_IOPAD(0x20d2, PIN_INPUT_PULLUP | MUX_MODE4) /* gpmc_wait3.gpio_65 */
+ >;
+ };
+
+- tfp410_pins: pinmux_tfp410_pins {
++ tfp410_pins: tfp410-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20b4, PIN_OUTPUT | MUX_MODE4) /* gpmc_ncs3.gpio_54 */
+ >;
+ };
+
+- i2c3_pins: pinmux_i2c3_pins {
++ i2c3_pins: i2c3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_scl */
+ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda */
+ >;
+ };
+
+- sb_t35_audio_amp: pinmux_sb_t35_audio_amp {
++ sb_t35_audio_amp: sb-t35-audio-amp-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20c8, PIN_OUTPUT | MUX_MODE4) /* gpmc_nbe1.gpio_61 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-sbc-t3517.dts b/arch/arm/boot/dts/omap3-sbc-t3517.dts
+index a69d328604219..07bec48dc4416 100644
+--- a/arch/arm/boot/dts/omap3-sbc-t3517.dts
++++ b/arch/arm/boot/dts/omap3-sbc-t3517.dts
+@@ -36,14 +36,14 @@ &sb_t35_usb_hub_pins
+ &usb_hub_pins
+ >;
+
+- mmc1_aux_pins: pinmux_mmc1_aux_pins {
++ mmc1_aux_pins: mmc1-aux-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20c0, PIN_INPUT_PULLUP | MUX_MODE4) /* gpmc_clk.gpio_59 */
+ OMAP3_CORE1_IOPAD(0x2174, PIN_INPUT_PULLUP | MUX_MODE4) /* uart2_cts.gpio_144 */
+ >;
+ };
+
+- sb_t35_usb_hub_pins: pinmux_sb_t35_usb_hub_pins {
++ sb_t35_usb_hub_pins: sb-t35-usb-hub-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21ec, PIN_OUTPUT | MUX_MODE4) /* ccdc_wen.gpio_98 - SB-T35 USB HUB RST */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-sbc-t3530.dts b/arch/arm/boot/dts/omap3-sbc-t3530.dts
+index 24bf3fd86641f..1beefc3194224 100644
+--- a/arch/arm/boot/dts/omap3-sbc-t3530.dts
++++ b/arch/arm/boot/dts/omap3-sbc-t3530.dts
+@@ -20,7 +20,7 @@ &omap3_pmx_core {
+ pinctrl-names = "default";
+ pinctrl-0 = <&sb_t35_usb_hub_pins>;
+
+- sb_t35_usb_hub_pins: pinmux_sb_t35_usb_hub_pins {
++ sb_t35_usb_hub_pins: sb-t35-usb-hub-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2130, PIN_OUTPUT | MUX_MODE4) /* ccdc_wen.gpio_167 - SB-T35 USB HUB RST */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-sbc-t3730.dts b/arch/arm/boot/dts/omap3-sbc-t3730.dts
+index eb3893b9535e6..4a8f553293c65 100644
+--- a/arch/arm/boot/dts/omap3-sbc-t3730.dts
++++ b/arch/arm/boot/dts/omap3-sbc-t3730.dts
+@@ -20,7 +20,7 @@ &omap3_pmx_core {
+ pinctrl-names = "default";
+ pinctrl-0 = <&sb_t35_usb_hub_pins>;
+
+- sb_t35_usb_hub_pins: pinmux_sb_t35_usb_hub_pins {
++ sb_t35_usb_hub_pins: sb-t35-usb-hub-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2130, PIN_OUTPUT | MUX_MODE4) /* ccdc_wen.gpio_167 - SB-T35 USB HUB RST */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-sniper.dts b/arch/arm/boot/dts/omap3-sniper.dts
+index b6879cdc5c13e..f7768a2c88282 100644
+--- a/arch/arm/boot/dts/omap3-sniper.dts
++++ b/arch/arm/boot/dts/omap3-sniper.dts
+@@ -26,48 +26,48 @@ memory@80000000 {
+ &omap3_pmx_core {
+ pinctrl-names = "default";
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | MUX_MODE0) /* uart3_rx_irrx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx */
+ >;
+ };
+
+- dp3t_sel_pins: pinmux_dp3t_sel_pins {
++ dp3t_sel_pins: dp3t-sel-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2196, PIN_OUTPUT | MUX_MODE4) /* gpio_161 */
+ OMAP3_CORE1_IOPAD(0x2198, PIN_OUTPUT | MUX_MODE4) /* gpio_162 */
+ >;
+ };
+
+- i2c1_pins: pinmux_i2c1_pins {
++ i2c1_pins: i2c1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl */
+ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda */
+ >;
+ };
+
+- i2c2_pins: pinmux_i2c2_pins {
++ i2c2_pins: i2c2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT | MUX_MODE0) /* i2c2_scl */
+ OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT | MUX_MODE0) /* i2c2_sda */
+ >;
+ };
+
+- i2c3_pins: pinmux_i2c3_pins {
++ i2c3_pins: i2c3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0) /* i2c3_scl */
+ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0) /* i2c3_sda */
+ >;
+ };
+
+- lp8720_en_pin: pinmux_lp8720_en_pin {
++ lp8720_en_pin: lp8720-en-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2080, PIN_OUTPUT | MUX_MODE4) /* gpio_37 */
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT | MUX_MODE0) /* sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT | MUX_MODE0) /* sdmmc1_cmd */
+@@ -78,7 +78,7 @@ OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT | MUX_MODE0) /* sdmmc1_dat3 */
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT | MUX_MODE0) /* sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT | MUX_MODE0) /* sdmmc2_cmd */
+@@ -93,7 +93,7 @@ OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT | MUX_MODE0) /* sdmmc2_dat7 */
+ >;
+ };
+
+- usb_otg_hs_pins: pinmux_usb_otg_hs_pins {
++ usb_otg_hs_pins: usb-otg-hs-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21a2, PIN_INPUT | MUX_MODE0) /* hsusb0_clk */
+ OMAP3_CORE1_IOPAD(0x21a4, PIN_OUTPUT | MUX_MODE0) /* hsusb0_stp */
+@@ -114,7 +114,7 @@ OMAP3_CORE1_IOPAD(0x21b8, PIN_INPUT | MUX_MODE0) /* hsusb0_data7 */
+ &omap3_pmx_wkup {
+ pinctrl-names = "default";
+
+- mmc1_cd_pin: pinmux_mmc1_cd_pin {
++ mmc1_cd_pin: mmc1-cd-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a1a, PIN_INPUT | MUX_MODE4) /* gpio_10 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-tao3530.dtsi b/arch/arm/boot/dts/omap3-tao3530.dtsi
+index 7f440d11f7e75..92a5846048bd7 100644
+--- a/arch/arm/boot/dts/omap3-tao3530.dtsi
++++ b/arch/arm/boot/dts/omap3-tao3530.dtsi
+@@ -43,7 +43,7 @@ hsusb2_power: hsusb2_power_reg {
+ };
+
+ /* HS USB Host PHY on PORT 2 */
+- hsusb2_phy: hsusb2_phy {
++ hsusb2_phy: hsusb2-phy-pins {
+ compatible = "usb-nop-xceiv";
+ reset-gpios = <&gpio6 2 GPIO_ACTIVE_LOW>; /* gpio_162 */
+ vcc-supply = <&hsusb2_power>;
+@@ -70,7 +70,7 @@ mmc2_sdio_poweron: regulator-mmc2-sdio-poweron {
+ };
+
+ &omap3_pmx_core {
+- hsusbb2_pins: pinmux_hsusbb2_pins {
++ hsusbb2_pins: hsusbb2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+ OMAP3_CORE1_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+@@ -87,7 +87,7 @@ OMAP3_CORE1_IOPAD(0x21de, PIN_INPUT_PULLDOWN | MUX_MODE3) /* mcspi2_cs1.hsusb2_d
+ >;
+ };
+
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -102,7 +102,7 @@ OMAP3_CORE1_IOPAD(0x2156, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_dat7.sdmmc1_da
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
+@@ -114,27 +114,27 @@ OMAP3_CORE1_IOPAD(0x2162, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat3.sdmmc2_da
+ };
+
+ /* wlan GPIO output for WLAN_EN */
+- wlan_gpio: pinmux_wlan_gpio {
++ wlan_gpio: wlan-gpio-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x218e, PIN_OUTPUT | MUX_MODE4) /* mcbsp1_fsr gpio_157 */
+ >;
+ };
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | PIN_OFF_WAKEUPENABLE | MUX_MODE0) /* uart3_rx_irrx.uart3_rx_irrx */
+ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx.uart3_tx_irtx */
+ >;
+ };
+
+- i2c3_pins: pinmux_i2c3_pins {
++ i2c3_pins: i2c3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_scl.i2c3_scl */
+ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda.i2c3_sda */
+ >;
+ };
+
+- mcspi1_pins: pinmux_mcspi1_pins {
++ mcspi1_pins: mcspi1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21c8, PIN_INPUT | MUX_MODE0) /* mcspi1_clk.mcspi1_clk */
+ OMAP3_CORE1_IOPAD(0x21ca, PIN_OUTPUT | MUX_MODE0) /* mcspi1_simo.mcspi1_simo */
+@@ -143,7 +143,7 @@ OMAP3_CORE1_IOPAD(0x21ce, PIN_OUTPUT | MUX_MODE0) /* mcspi1_cs0.mcspi1_cs0 */
+ >;
+ };
+
+- mcspi3_pins: pinmux_mcspi3_pins {
++ mcspi3_pins: mcspi3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x25dc, PIN_OUTPUT | MUX_MODE1) /* etk_d0.mcspi3_simo gpio14 INPUT | MODE1 */
+ OMAP3_CORE1_IOPAD(0x25de, PIN_INPUT_PULLUP | MUX_MODE1) /* etk_d1.mcspi3_somi gpio15 INPUT | MODE1 */
+@@ -152,7 +152,7 @@ OMAP3_CORE1_IOPAD(0x25e2, PIN_INPUT | MUX_MODE1) /* etk_d3.mcspi3_clk gpio17 INP
+ >;
+ };
+
+- mcbsp3_pins: pinmux_mcbsp3_pins {
++ mcbsp3_pins: mcbsp3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x216c, PIN_OUTPUT | MUX_MODE0) /* mcbsp3_dx.uart2_cts */
+ OMAP3_CORE1_IOPAD(0x216e, PIN_INPUT | MUX_MODE0) /* mcbsp3_dr.uart2_rts */
+diff --git a/arch/arm/boot/dts/omap3-thunder.dts b/arch/arm/boot/dts/omap3-thunder.dts
+index d82cab8e213a6..c87956c59b083 100644
+--- a/arch/arm/boot/dts/omap3-thunder.dts
++++ b/arch/arm/boot/dts/omap3-thunder.dts
+@@ -12,7 +12,7 @@ / {
+ };
+
+ &omap3_pmx_core {
+- dss_dpi_pins: pinmux_dss_dpi_pins {
++ dss_dpi_pins: dss-dpi-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x20d4, PIN_OUTPUT | MUX_MODE0) /* dss_pclk.dss_pclk */
+ OMAP3_CORE1_IOPAD(0x20d6, PIN_OUTPUT | MUX_MODE0) /* dss_hsync.dss_hsync */
+@@ -45,13 +45,13 @@ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE0) /* dss_data23.dss_data23 */
+ >;
+ };
+
+- lte430_pins: pinmux_lte430_pins {
++ lte430_pins: lte430-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2168, PIN_OUTPUT | MUX_MODE4) /* sdmmc2_dat6.gpio_138 */
+ >;
+ };
+
+- backlight_pins: pinmux_backlight_pins {
++ backlight_pins: backlight-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x216a, PIN_OUTPUT | MUX_MODE4) /* sdmmc2_dat7.gpio_139 */
+ >;
+diff --git a/arch/arm/boot/dts/omap3-zoom3.dts b/arch/arm/boot/dts/omap3-zoom3.dts
+index ce58b1f208e81..c62f70f5c05a7 100644
+--- a/arch/arm/boot/dts/omap3-zoom3.dts
++++ b/arch/arm/boot/dts/omap3-zoom3.dts
+@@ -49,7 +49,7 @@ wl12xx_vmmc: wl12xx_vmmc {
+
+ &omap3_pmx_core {
+ /* REVISIT: twl gpio0 is mmc0_cd */
+- mmc1_pins: pinmux_mmc1_pins {
++ mmc1_pins: mmc1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2144, PIN_OUTPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */
+ OMAP3_CORE1_IOPAD(0x2146, PIN_OUTPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
+@@ -60,7 +60,7 @@ OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_dat3.sdmmc1_da
+ >;
+ };
+
+- mmc2_pins: pinmux_mmc2_pins {
++ mmc2_pins: mmc2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
+ OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
+@@ -75,14 +75,14 @@ OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT | MUX_MODE0) /* sdmmc2_dat7.sdmmc2_dat7 */
+ >;
+ };
+
+- mmc3_pins: pinmux_mmc3_pins {
++ mmc3_pins: mmc3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2198, PIN_INPUT | MUX_MODE4) /* mcbsp1_clkx.gpio_162 WLAN IRQ */
+ OMAP3_CORE1_IOPAD(0x21d0, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs1.sdmmc3_cmd */
+ >;
+ };
+
+- uart1_pins: pinmux_uart1_pins {
++ uart1_pins: uart1-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2180, PIN_INPUT | MUX_MODE0) /* uart1_cts.uart1_cts */
+ OMAP3_CORE1_IOPAD(0x217e, PIN_OUTPUT | MUX_MODE0) /* uart1_rts.uart1_rts */
+@@ -91,7 +91,7 @@ OMAP3_CORE1_IOPAD(0x217c, PIN_OUTPUT | MUX_MODE0) /* uart1_tx.uart1_tx */
+ >;
+ };
+
+- uart2_pins: pinmux_uart2_pins {
++ uart2_pins: uart2-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2174, PIN_INPUT_PULLUP | MUX_MODE0) /* uart2_cts.uart2_cts */
+ OMAP3_CORE1_IOPAD(0x2176, PIN_OUTPUT | MUX_MODE0) /* uart2_rts.uart2_rts */
+@@ -100,7 +100,7 @@ OMAP3_CORE1_IOPAD(0x2178, PIN_OUTPUT | MUX_MODE0) /* uart2_tx.uart2_tx */
+ >;
+ };
+
+- uart3_pins: pinmux_uart3_pins {
++ uart3_pins: uart3-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x219a, PIN_INPUT_PULLDOWN | MUX_MODE0) /* uart3_cts_rctx.uart3_cts_rctx */
+ OMAP3_CORE1_IOPAD(0x219c, PIN_OUTPUT | MUX_MODE0) /* uart3_rts_sd.uart3_rts_sd */
+@@ -110,7 +110,7 @@ OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx.uart3_tx_irt
+ };
+
+ /* wl12xx GPIO output for WLAN_EN */
+- wl12xx_gpio: pinmux_wl12xx_gpio {
++ wl12xx_gpio: wl12xx-gpio-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x211a, PIN_OUTPUT| MUX_MODE4) /* cam_d2.gpio_101 */
+ >;
+@@ -118,7 +118,7 @@ OMAP3_CORE1_IOPAD(0x211a, PIN_OUTPUT| MUX_MODE4) /* cam_d2.gpio_101 */
+ };
+
+ &omap3_pmx_core2 {
+- mmc3_2_pins: pinmux_mmc3_2_pins {
++ mmc3_2_pins: mmc3-2-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25d8, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_clk.sdmmc3_clk */
+ OMAP3630_CORE2_IOPAD(0x25e4, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_d4.sdmmc3_dat0 */
+@@ -130,7 +130,7 @@ OMAP3630_CORE2_IOPAD(0x25e2, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_d3.sdmmc3_dat3
+ };
+
+ &omap3_pmx_wkup {
+- wlan_host_wkup: pinmux_wlan_host_wkup_pins {
++ wlan_host_wkup: wlan-host-wkup-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a1a, PIN_INPUT_PULLUP | MUX_MODE4) /* sys_clkout1.gpio_10 WLAN_HOST_WKUP */
+ >;
+diff --git a/arch/arm/boot/dts/twl4030_omap3.dtsi b/arch/arm/boot/dts/twl4030_omap3.dtsi
+index 683419d5c0e5c..89433f251df03 100644
+--- a/arch/arm/boot/dts/twl4030_omap3.dtsi
++++ b/arch/arm/boot/dts/twl4030_omap3.dtsi
+@@ -14,7 +14,7 @@ &omap3_pmx_core {
+ * to the SYS_NIRQ line on OMAP. Therefore, configure the
+ * defaults for the SYS_NIRQ pin here.
+ */
+- twl4030_pins: pinmux_twl4030_pins {
++ twl4030_pins: twl4030-pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x21e0, PIN_INPUT_PULLUP | PIN_OFF_WAKEUPENABLE | MUX_MODE0) /* sys_nirq.sys_nirq */
+ >;
+@@ -28,7 +28,7 @@ OMAP3_CORE1_IOPAD(0x21e0, PIN_INPUT_PULLUP | PIN_OFF_WAKEUPENABLE | MUX_MODE0) /
+ * sys_nvmode2 signaling.
+ */
+ &omap3_pmx_wkup {
+- twl4030_vpins: pinmux_twl4030_vpins {
++ twl4030_vpins: twl4030-vpins-pins {
+ pinctrl-single,pins = <
+ OMAP3_WKUP_IOPAD(0x2a00, PIN_INPUT | MUX_MODE0) /* i2c4_scl.i2c4_scl */
+ OMAP3_WKUP_IOPAD(0x2a02, PIN_INPUT | MUX_MODE0) /* i2c4_sda.i2c4_sda */
+--
+2.42.0
+
--- /dev/null
+From 5abd4ea5783b761ec64b8982b6d78b6b012a8c7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 11:24:25 +0100
+Subject: arm64/arm: xen: enlighten: Fix KPTI checks
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 20f3b8eafe0ba5d3c69d5011a9b07739e9645132 ]
+
+When KPTI is in use, we cannot register a runstate region as XEN
+requires that this is always a valid VA, which we cannot guarantee. Due
+to this, xen_starting_cpu() must avoid registering each CPU's runstate
+region, and xen_guest_init() must avoid setting up features that depend
+upon it.
+
+We tried to ensure that in commit:
+
+ f88af7229f6f22ce (" xen/arm: do not setup the runstate info page if kpti is enabled")
+
+... where we added checks for xen_kernel_unmapped_at_usr(), which wraps
+arm64_kernel_unmapped_at_el0() on arm64 and is always false on 32-bit
+arm.
+
+Unfortunately, as xen_guest_init() is an early_initcall, this happens
+before secondary CPUs are booted and arm64 has finalized the
+ARM64_UNMAP_KERNEL_AT_EL0 cpucap which backs
+arm64_kernel_unmapped_at_el0(), and so this can subsequently be set as
+secondary CPUs are onlined. On a big.LITTLE system where the boot CPU
+does not require KPTI but some secondary CPUs do, this will result in
+xen_guest_init() intializing features that depend on the runstate
+region, and xen_starting_cpu() registering the runstate region on some
+CPUs before KPTI is subsequent enabled, resulting the the problems the
+aforementioned commit tried to avoid.
+
+Handle this more robsutly by deferring the initialization of the
+runstate region until secondary CPUs have been initialized and the
+ARM64_UNMAP_KERNEL_AT_EL0 cpucap has been finalized. The per-cpu work is
+moved into a new hotplug starting function which is registered later
+when we're certain that KPTI will not be used.
+
+Fixes: f88af7229f6f ("xen/arm: do not setup the runstate info page if kpti is enabled")
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Bertrand Marquis <bertrand.marquis@arm.com>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Stefano Stabellini <sstabellini@kernel.org>
+Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/xen/enlighten.c | 25 ++++++++++++++++---------
+ include/linux/cpuhotplug.h | 1 +
+ 2 files changed, 17 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
+index 93c8ccbf29828..b647306eb1608 100644
+--- a/arch/arm/xen/enlighten.c
++++ b/arch/arm/xen/enlighten.c
+@@ -164,9 +164,6 @@ static int xen_starting_cpu(unsigned int cpu)
+ BUG_ON(err);
+ per_cpu(xen_vcpu, cpu) = vcpup;
+
+- if (!xen_kernel_unmapped_at_usr())
+- xen_setup_runstate_info(cpu);
+-
+ after_register_vcpu_info:
+ enable_percpu_irq(xen_events_irq, 0);
+ return 0;
+@@ -523,9 +520,6 @@ static int __init xen_guest_init(void)
+ return -EINVAL;
+ }
+
+- if (!xen_kernel_unmapped_at_usr())
+- xen_time_setup_guest();
+-
+ if (xen_initial_domain())
+ pvclock_gtod_register_notifier(&xen_pvclock_gtod_notifier);
+
+@@ -535,7 +529,13 @@ static int __init xen_guest_init(void)
+ }
+ early_initcall(xen_guest_init);
+
+-static int __init xen_pm_init(void)
++static int xen_starting_runstate_cpu(unsigned int cpu)
++{
++ xen_setup_runstate_info(cpu);
++ return 0;
++}
++
++static int __init xen_late_init(void)
+ {
+ if (!xen_domain())
+ return -ENODEV;
+@@ -548,9 +548,16 @@ static int __init xen_pm_init(void)
+ do_settimeofday64(&ts);
+ }
+
+- return 0;
++ if (xen_kernel_unmapped_at_usr())
++ return 0;
++
++ xen_time_setup_guest();
++
++ return cpuhp_setup_state(CPUHP_AP_ARM_XEN_RUNSTATE_STARTING,
++ "arm/xen_runstate:starting",
++ xen_starting_runstate_cpu, NULL);
+ }
+-late_initcall(xen_pm_init);
++late_initcall(xen_late_init);
+
+
+ /* empty stubs */
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index 2be2091c2b447..c7e0d80dbf6a5 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -191,6 +191,7 @@ enum cpuhp_state {
+ /* Must be the last timer callback */
+ CPUHP_AP_DUMMY_TIMER_STARTING,
+ CPUHP_AP_ARM_XEN_STARTING,
++ CPUHP_AP_ARM_XEN_RUNSTATE_STARTING,
+ CPUHP_AP_ARM_CORESIGHT_STARTING,
+ CPUHP_AP_ARM_CORESIGHT_CTI_STARTING,
+ CPUHP_AP_ARM64_ISNDEP_STARTING,
+--
+2.42.0
+
--- /dev/null
+From b1d79cca604457140279b9246142b7ed90ab6c33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 18:01:58 -0500
+Subject: arm64: dts: imx8mm: Add sound-dai-cells to micfil node
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 0e6cc2b8bb7d67733f4a47720787eff1ce2666f2 ]
+
+Per the DT bindings, the micfil node should have a sound-dai-cells
+entry.
+
+Fixes: 3bd0788c43d9 ("arm64: dts: imx8mm: Add support for micfil")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+index 12c82bb1bb7aa..d583db18f74cc 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+@@ -398,6 +398,7 @@ micfil: audio-controller@30080000 {
+ "pll8k", "pll11k", "clkext3";
+ dmas = <&sdma2 24 25 0x80000000>;
+ dma-names = "rx";
++ #sound-dai-cells = <0>;
+ status = "disabled";
+ };
+
+--
+2.42.0
+
--- /dev/null
+From 6919e808ca7626f738620469dd8a05ad00444a01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 18:01:59 -0500
+Subject: arm64: dts: imx8mn: Add sound-dai-cells to micfil node
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit db1925454a2e7cadcac8756442ca7c3198332336 ]
+
+Per the DT bindings, the micfil node should have a sound-dai-cells
+entry.
+
+Fixes: cca69ef6eba5 ("arm64: dts: imx8mn: Add support for micfil")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mn.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+index 37246ca9d9075..66fadbf19f0a3 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+@@ -370,6 +370,7 @@ micfil: audio-controller@30080000 {
+ "pll8k", "pll11k", "clkext3";
+ dmas = <&sdma2 24 25 0x80000000>;
+ dma-names = "rx";
++ #sound-dai-cells = <0>;
+ status = "disabled";
+ };
+
+--
+2.42.0
+
--- /dev/null
+From fbe3c2810c7e921cd6bdf20b1492d85e511cc85b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Sep 2023 11:27:36 -0300
+Subject: arm64: dts: imx8qm-ss-img: Fix jpegenc compatible entry
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit 1d33cd614d89b0ec024d25ec45acf4632211b5a7 ]
+
+The first compatible entry for the jpegenc should be 'nxp,imx8qm-jpgenc'.
+
+Change it accordingly to fix the following schema warning:
+
+imx8qm-apalis-eval.dtb: jpegenc@58450000: compatible: 'oneOf' conditional failed, one must be fixed:
+ 'nxp,imx8qm-jpgdec' is not one of ['nxp,imx8qxp-jpgdec', 'nxp,imx8qxp-jpgenc']
+ 'nxp,imx8qm-jpgenc' was expected
+ 'nxp,imx8qxp-jpgdec' was expected
+
+Fixes: 5bb279171afc ("arm64: dts: imx8: Add jpeg encoder/decoder nodes")
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Reviewed-by: Mirela Rabulea <mirela.rabulea@nxp.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8qm-ss-img.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-ss-img.dtsi b/arch/arm64/boot/dts/freescale/imx8qm-ss-img.dtsi
+index 7764b4146e0ab..2bbdacb1313f9 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-ss-img.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8qm-ss-img.dtsi
+@@ -8,5 +8,5 @@ &jpegdec {
+ };
+
+ &jpegenc {
+- compatible = "nxp,imx8qm-jpgdec", "nxp,imx8qxp-jpgenc";
++ compatible = "nxp,imx8qm-jpgenc", "nxp,imx8qxp-jpgenc";
+ };
+--
+2.42.0
+
--- /dev/null
+From 81abd629abcf96d2a8717c8ba797a792ff937a1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Aug 2023 10:51:25 +1200
+Subject: ARM64: dts: marvell: cn9310: Use appropriate label for spi1 pins
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit 0878fd86f554ab98aa493996c7e0c72dff58437f ]
+
+Both the CN9130-CRB and CN9130-DB use the SPI1 interface but had the
+pinctrl node labelled as "cp0_spi0_pins". Use the label "cp0_spi1_pins"
+and update the node name to "cp0-spi-pins-1" to avoid confusion with the
+pinctrl options for SPI0.
+
+Fixes: 4c43a41e5b8c ("arm64: dts: cn913x: add device trees for topology B boards")
+Fixes: 5c0ee54723f3 ("arm64: dts: add support for Marvell cn9130-crb platform")
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/cn9130-crb.dtsi | 4 ++--
+ arch/arm64/boot/dts/marvell/cn9130-db.dtsi | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/marvell/cn9130-crb.dtsi b/arch/arm64/boot/dts/marvell/cn9130-crb.dtsi
+index 8e4ec243fb8fc..e5fc6cca50e74 100644
+--- a/arch/arm64/boot/dts/marvell/cn9130-crb.dtsi
++++ b/arch/arm64/boot/dts/marvell/cn9130-crb.dtsi
+@@ -120,7 +120,7 @@ cp0_sdhci_pins: cp0-sdhi-pins-0 {
+ "mpp59", "mpp60", "mpp61";
+ marvell,function = "sdio";
+ };
+- cp0_spi0_pins: cp0-spi-pins-0 {
++ cp0_spi1_pins: cp0-spi-pins-1 {
+ marvell,pins = "mpp13", "mpp14", "mpp15", "mpp16";
+ marvell,function = "spi1";
+ };
+@@ -170,7 +170,7 @@ &cp0_sdhci0 {
+
+ &cp0_spi1 {
+ pinctrl-names = "default";
+- pinctrl-0 = <&cp0_spi0_pins>;
++ pinctrl-0 = <&cp0_spi1_pins>;
+ reg = <0x700680 0x50>, /* control */
+ <0x2000000 0x1000000>; /* CS0 */
+ status = "okay";
+diff --git a/arch/arm64/boot/dts/marvell/cn9130-db.dtsi b/arch/arm64/boot/dts/marvell/cn9130-db.dtsi
+index c7de1ea0d470a..6eb6a175de38d 100644
+--- a/arch/arm64/boot/dts/marvell/cn9130-db.dtsi
++++ b/arch/arm64/boot/dts/marvell/cn9130-db.dtsi
+@@ -307,7 +307,7 @@ &cp0_sdhci0 {
+ &cp0_spi1 {
+ status = "disabled";
+ pinctrl-names = "default";
+- pinctrl-0 = <&cp0_spi0_pins>;
++ pinctrl-0 = <&cp0_spi1_pins>;
+ reg = <0x700680 0x50>;
+
+ flash@0 {
+@@ -371,7 +371,7 @@ cp0_sdhci_pins: cp0-sdhi-pins-0 {
+ "mpp59", "mpp60", "mpp61";
+ marvell,function = "sdio";
+ };
+- cp0_spi0_pins: cp0-spi-pins-0 {
++ cp0_spi1_pins: cp0-spi-pins-1 {
+ marvell,pins = "mpp13", "mpp14", "mpp15", "mpp16";
+ marvell,function = "spi1";
+ };
+--
+2.42.0
+
--- /dev/null
+From c3d760b5a80f9d895e2643c2671a37d63c5cfade Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 12:49:55 +0200
+Subject: arm64: dts: qcom: apq8016-sbc: Add missing ADV7533 regulators
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 33e9032a1875bb1aee3c68a4540f5a577ff44130 ]
+
+Add the missing regulator supplies to the ADV7533 HDMI bridge to fix
+the following dtbs_check warnings. They are all also supplied by
+pm8916_l6 so there is no functional difference.
+
+apq8016-sbc.dtb: bridge@39: 'dvdd-supply' is a required property
+apq8016-sbc.dtb: bridge@39: 'pvdd-supply' is a required property
+apq8016-sbc.dtb: bridge@39: 'a2vdd-supply' is a required property
+ from schema display/bridge/adi,adv7533.yaml
+
+Fixes: 28546b095511 ("arm64: dts: apq8016-sbc: Add HDMI display support")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230922-db410c-adv7533-regulators-v1-1-68aba71e529b@gerhold.net
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
+index 9650ae70c8723..9d116e1fbe10c 100644
+--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
+@@ -200,6 +200,9 @@ adv_bridge: bridge@39 {
+ pd-gpios = <&msmgpio 32 GPIO_ACTIVE_HIGH>;
+
+ avdd-supply = <&pm8916_l6>;
++ a2vdd-supply = <&pm8916_l6>;
++ dvdd-supply = <&pm8916_l6>;
++ pvdd-supply = <&pm8916_l6>;
+ v1p2-supply = <&pm8916_l6>;
+ v3p3-supply = <&pm8916_l17>;
+
+--
+2.42.0
+
--- /dev/null
+From b0eb1a5ef9cec40a518616d317e3e2f19d0306d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 20:03:04 +0530
+Subject: arm64: dts: qcom: msm8916: Fix iommu local address range
+
+From: Gaurav Kohli <quic_gkohli@quicinc.com>
+
+[ Upstream commit 2de8ee9f58fa51f707c71f8fbcd8470ab0078102 ]
+
+Fix the apps iommu local address space range as per data sheet.
+
+Fixes: 6a6729f38436 ("arm64: dts: qcom: msm8916: Add IOMMU support")
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Gaurav Kohli <quic_gkohli@quicinc.com>
+Reviewed-by: Stephan Gerhold <stephan@gerhold.net>
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230915143304.477-1-quic_gkohli@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index f84b3c1a03c53..bafac2cf7e3d6 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -1257,7 +1257,7 @@ apps_iommu: iommu@1ef0000 {
+ #size-cells = <1>;
+ #iommu-cells = <1>;
+ compatible = "qcom,msm8916-iommu", "qcom,msm-iommu-v1";
+- ranges = <0 0x01e20000 0x40000>;
++ ranges = <0 0x01e20000 0x20000>;
+ reg = <0x01ef0000 0x3000>;
+ clocks = <&gcc GCC_SMMU_CFG_CLK>,
+ <&gcc GCC_APSS_TCU_CLK>;
+--
+2.42.0
+
--- /dev/null
+From b0de3de59307243086a4a4ce4ae08059d1d457e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jul 2023 09:20:48 +0200
+Subject: arm64: dts: qcom: msm8992-libra: drop duplicated reserved memory
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit f32096602c19e68fb9bf04b494d13f1190602554 ]
+
+There are two entries for similar reserved memory: qseecom@cb400000 and
+audio@cb400000. Keep the qseecom as it is longer.
+
+ Warning (unique_unit_address_if_enabled): /reserved-memory/audio@cb400000: duplicate unit-address (also used in node /reserved-memory/qseecom@cb400000)
+
+Fixes: 69876bc6fd4d ("arm64: dts: qcom: msm8992-libra: Fix the memory map")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230720072048.10093-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8992-xiaomi-libra.dts | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8992-xiaomi-libra.dts b/arch/arm64/boot/dts/qcom/msm8992-xiaomi-libra.dts
+index 3ab0ad14e8704..95eab1f379229 100644
+--- a/arch/arm64/boot/dts/qcom/msm8992-xiaomi-libra.dts
++++ b/arch/arm64/boot/dts/qcom/msm8992-xiaomi-libra.dts
+@@ -109,11 +109,6 @@ rmtfs_mem: rmtfs@ca100000 {
+ qcom,client-id = <1>;
+ };
+
+- audio_mem: audio@cb400000 {
+- reg = <0 0xcb000000 0 0x400000>;
+- no-mem;
+- };
+-
+ qseecom_mem: qseecom@cb400000 {
+ reg = <0 0xcb400000 0 0x1c00000>;
+ no-mem;
+--
+2.42.0
+
--- /dev/null
+From cab97c9706272d3022f24508f7d848fbaeb58a56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Aug 2023 22:58:22 +0200
+Subject: arm64: dts: qcom: sc7280: Add missing LMH interrupts
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 3f93d119c9d6e1744d55cd48af764160a1a3aca3 ]
+
+Hook up the interrupts that signal the Limits Management Hardware has
+started some sort of throttling action.
+
+Fixes: 7dbd121a2c58 ("arm64: dts: qcom: sc7280: Add cpufreq hw node")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230811-topic-7280_lmhirq-v1-1-c262b6a25c8f@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 409dad617a27c..aea356c63b9a3 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -5338,6 +5338,14 @@ cpufreq_hw: cpufreq@18591000 {
+ reg = <0 0x18591000 0 0x1000>,
+ <0 0x18592000 0 0x1000>,
+ <0 0x18593000 0 0x1000>;
++
++ interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "dcvsh-irq-0",
++ "dcvsh-irq-1",
++ "dcvsh-irq-2";
++
+ clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>;
+ clock-names = "xo", "alternate";
+ #freq-domain-cells = <1>;
+--
+2.42.0
+
--- /dev/null
+From acfe1688221f92851bb75a4b16635305324c313a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jul 2023 15:09:12 +0300
+Subject: arm64: dts: qcom: sc7280: link usb3_phy_wrapper_gcc_usb30_pipe_clk
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 70c4a1ca13b333b00e01266d299605fa1041b0d5 ]
+
+Use usb_1_ssphy's clock as gcc's usb3_phy_wrapper_gcc_usb30_pipe_clk
+clock source.
+
+Suggested-by: Neil Armstrong <neil.armstrong@linaro.org>
+Fixes: 1c39e6f9b534 ("arm64: dts: qcom: sc7280: Add USB related nodes")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230711120916.4165894-7-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 0cdc579f26de7..409dad617a27c 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -820,7 +820,8 @@ gcc: clock-controller@100000 {
+ clocks = <&rpmhcc RPMH_CXO_CLK>,
+ <&rpmhcc RPMH_CXO_CLK_A>, <&sleep_clk>,
+ <0>, <&pcie1_lane>,
+- <0>, <0>, <0>, <0>;
++ <0>, <0>, <0>,
++ <&usb_1_ssphy>;
+ clock-names = "bi_tcxo", "bi_tcxo_ao", "sleep_clk",
+ "pcie_0_pipe_clk", "pcie_1_pipe_clk",
+ "ufs_phy_rx_symbol_0_clk", "ufs_phy_rx_symbol_1_clk",
+--
+2.42.0
+
--- /dev/null
+From d48a6116e2691df1f107eb81906f6e7d19cfc963 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 12:42:04 +0530
+Subject: arm64: dts: qcom: sdm845: cheza doesn't support LMh node
+
+From: David Heidelberg <david@ixit.cz>
+
+[ Upstream commit 197ae69d1caedb3203e0b189a39efb820675fd5c ]
+
+Cheza firmware doesn't allow controlling LMh from the operating system.
+
+Fixes: 36c6581214c4 ("arm64: dts: qcom: sdm845: Add support for LMh node")
+Suggested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: David Heidelberg <david@ixit.cz>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20230912071205.11502-2-david@ixit.cz
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi b/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi
+index b5f11fbcc3004..a5c0c788969fb 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi
+@@ -145,6 +145,10 @@ panel_in_edp: endpoint {
+ };
+ };
+
++&cpufreq_hw {
++ /delete-property/ interrupts-extended; /* reference to lmh_cluster[01] */
++};
++
+ &psci {
+ /delete-node/ cpu0;
+ /delete-node/ cpu1;
+@@ -277,6 +281,14 @@ &BIG_CPU_SLEEP_1
+ &CLUSTER_SLEEP_0>;
+ };
+
++&lmh_cluster0 {
++ status = "disabled";
++};
++
++&lmh_cluster1 {
++ status = "disabled";
++};
++
+ /*
+ * Reserved memory changes
+ *
+--
+2.42.0
+
--- /dev/null
+From b36ffa0cbac10beb597e3517ed6a383724d1018f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Aug 2023 01:19:11 +0300
+Subject: arm64: dts: qcom: sdm845-mtp: fix WiFi configuration
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit b33868a52f342d9b1f20aa5bffe40cbd69bd0a4b ]
+
+Enable the host-cap-8bit quirk on this device. It is required for the
+WiFi to function properly.
+
+Fixes: 022bccb840b7 ("arm64: dts: sdm845: Add WCN3990 WLAN module device node")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230826221915.846937-2-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-mtp.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
+index de2d10e0315af..64958dee17d8b 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
+@@ -714,6 +714,8 @@ &wifi {
+ vdd-1.8-xo-supply = <&vreg_l7a_1p8>;
+ vdd-1.3-rfa-supply = <&vreg_l17a_1p3>;
+ vdd-3.3-ch0-supply = <&vreg_l25a_3p3>;
++
++ qcom,snoc-host-cap-8bit-quirk;
+ };
+
+ /* PINCTRL - additions to nodes defined in sdm845.dtsi */
+--
+2.42.0
+
--- /dev/null
+From 1e208d242ba0b708cd8f3bd7a8ab796530d1923e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Aug 2023 17:20:31 +0300
+Subject: arm64: dts: qcom: sm8150: add ref clock to PCIe PHYs
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit c204b3709409279ac019f3d374e444bb0b1424f0 ]
+
+Follow the rest of the platforms and add "ref" clocks to both PCIe PHYs
+found on the Qualcomm SM8150 platform.
+
+Fixes: a1c86c680533 ("arm64: dts: qcom: sm8150: Add PCIe nodes")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230820142035.89903-15-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index de794a5078dfc..c586378fc6bc7 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -1839,8 +1839,12 @@ pcie0_phy: phy@1c06000 {
+ ranges;
+ clocks = <&gcc GCC_PCIE_PHY_AUX_CLK>,
+ <&gcc GCC_PCIE_0_CFG_AHB_CLK>,
++ <&gcc GCC_PCIE_0_CLKREF_CLK>,
+ <&gcc GCC_PCIE0_PHY_REFGEN_CLK>;
+- clock-names = "aux", "cfg_ahb", "refgen";
++ clock-names = "aux",
++ "cfg_ahb",
++ "ref",
++ "refgen";
+
+ resets = <&gcc GCC_PCIE_0_PHY_BCR>;
+ reset-names = "phy";
+@@ -1938,8 +1942,12 @@ pcie1_phy: phy@1c0e000 {
+ ranges;
+ clocks = <&gcc GCC_PCIE_PHY_AUX_CLK>,
+ <&gcc GCC_PCIE_1_CFG_AHB_CLK>,
++ <&gcc GCC_PCIE_1_CLKREF_CLK>,
+ <&gcc GCC_PCIE1_PHY_REFGEN_CLK>;
+- clock-names = "aux", "cfg_ahb", "refgen";
++ clock-names = "aux",
++ "cfg_ahb",
++ "ref",
++ "refgen";
+
+ resets = <&gcc GCC_PCIE_1_PHY_BCR>;
+ reset-names = "phy";
+--
+2.42.0
+
--- /dev/null
+From 8d84d99ab0501f985fff6d5066ca9cb9c11ea564 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Aug 2023 00:45:48 +0300
+Subject: arm64: dts: qcom: sm8350: fix pinctrl for UART18
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit c1efa960114f743924b884da098298512a7e9983 ]
+
+On sm8350 QUP18 uses GPIO 68/69, not 58/59. Fix correponding UART18
+pinconf configuraion.
+
+Fixes: 98374e6925b8 ("arm64: dts: qcom: sm8350: Set up WRAP2 QUPs")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230825214550.1650938-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index b3245b13b2611..793768a2c9e1e 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -1778,7 +1778,7 @@ qup_uart6_default: qup-uart6-default-state {
+ };
+
+ qup_uart18_default: qup-uart18-default-state {
+- pins = "gpio58", "gpio59";
++ pins = "gpio68", "gpio69";
+ function = "qup18";
+ drive-strength = <2>;
+ bias-disable;
+--
+2.42.0
+
--- /dev/null
+From 83fc9fa7ddaa031ff98761ceedf3ab2aaa9c2986 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 14:41:32 +0530
+Subject: arm64: dts: ti: k3-am62a7-sk: Drop i2c-1 to 100Khz
+
+From: Jai Luthra <j-luthra@ti.com>
+
+[ Upstream commit 63e5aa69b821472a3203a29e17c025329c1b151f ]
+
+The TLV320AIC3106 audio codec is interfaced on the i2c-1 bus. With the
+default rate of 400Khz the i2c register writes fail to sync:
+
+[ 36.026387] tlv320aic3x 1-001b: Unable to sync registers 0x16-0x16. -110
+[ 38.101130] omap_i2c 20010000.i2c: controller timed out
+
+Dropping the rate to 100Khz fixes the issue.
+
+Fixes: 38c4a08c820c ("arm64: dts: ti: Add support for AM62A7-SK")
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Signed-off-by: Jai Luthra <j-luthra@ti.com>
+Link: https://lore.kernel.org/r/20231003-mcasp_am62a-v3-3-2b631ff319ca@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+index b08a083d722d4..7f265c671654d 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+@@ -172,7 +172,7 @@ &main_i2c1 {
+ status = "okay";
+ pinctrl-names = "default";
+ pinctrl-0 = <&main_i2c1_pins_default>;
+- clock-frequency = <400000>;
++ clock-frequency = <100000>;
+
+ exp1: gpio@22 {
+ compatible = "ti,tca6424";
+--
+2.42.0
+
--- /dev/null
+From 954e3a4f1b9f3d879cf8dd903e9047a21cb996bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 14:43:11 +0200
+Subject: arm64: tegra: Use correct interrupts for Tegra234 TKE
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit c0b80988eb78d6423249ab530bfbc6b238790a26 ]
+
+The shared interrupts 0-9 of the TKE are mapped to interrupts 0-9, but
+shared interrupts 10-15 are mapped to 256-261. Correct the mapping for
+the final 6 interrupts. This prevents the TKE from requesting the RTC
+interrupt (along with several GTE and watchdog interrupts).
+
+Reported-by: Shubhi Garg <shgarg@nvidia.com>
+Fixes: 28d860ed02c2 ("arm64: tegra: Enable native timers on Tegra234")
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra234.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+index dfe2cf2f4b218..6598e9ac52b81 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+@@ -532,12 +532,12 @@ timer@2080000 {
+ <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>;
++ <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 257 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 258 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 259 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 260 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 261 IRQ_TYPE_LEVEL_HIGH>;
+ status = "okay";
+ };
+
+--
+2.42.0
+
--- /dev/null
+From ab45e2e6a80e8da1c68ccb3fc536d30cd0593b18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Oct 2023 00:09:56 +0000
+Subject: ASoC: ams-delta.c: use component after check
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit bd0f7498bc9084d8cccc5484cd004b40f314b763 ]
+
+ static void cx81801_close()
+ {
+ ...
+(A) struct snd_soc_dapm_context *dapm = &component->card->dapm;
+ ...
+(B) if (!component)
+ return;
+ }
+
+(A) uses component before NULL check (B). This patch moves it after (B).
+
+Fixes: d0fdfe34080c ("ASoC: cx20442: replace codec to component")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/3e608474-e99a-4866-ae98-3054a4221f09@moroto.mountain
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87ttqdq623.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/ti/ams-delta.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/ti/ams-delta.c b/sound/soc/ti/ams-delta.c
+index 438e2fa843a03..1acc4505aa9a9 100644
+--- a/sound/soc/ti/ams-delta.c
++++ b/sound/soc/ti/ams-delta.c
+@@ -303,7 +303,7 @@ static int cx81801_open(struct tty_struct *tty)
+ static void cx81801_close(struct tty_struct *tty)
+ {
+ struct snd_soc_component *component = tty->disc_data;
+- struct snd_soc_dapm_context *dapm = &component->card->dapm;
++ struct snd_soc_dapm_context *dapm;
+
+ del_timer_sync(&cx81801_timer);
+
+@@ -315,6 +315,8 @@ static void cx81801_close(struct tty_struct *tty)
+
+ v253_ops.close(tty);
+
++ dapm = &component->card->dapm;
++
+ /* Revert back to default audio input/output constellation */
+ snd_soc_dapm_mutex_lock(dapm);
+
+--
+2.42.0
+
--- /dev/null
+From a927973ea776f6192d3c867914f96e25ffc1c74d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 20:10:05 +0300
+Subject: ASoC: cs35l41: Undo runtime PM changes at driver exit time
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 2d5661e6008ae1a1cd6df7cc844908fb8b982c58 ]
+
+According to the documentation, drivers are responsible for undoing at
+removal time all runtime PM changes done during probing.
+
+Hence, add the missing calls to pm_runtime_dont_use_autosuspend(), which
+are necessary for undoing pm_runtime_use_autosuspend().
+
+Note this would have been handled implicitly by
+devm_pm_runtime_enable(), but there is a need to continue using
+pm_runtime_enable()/pm_runtime_disable() in order to ensure the runtime
+PM is disabled as soon as the remove() callback is entered.
+
+Fixes: f517ba4924ad ("ASoC: cs35l41: Add support for hibernate memory retention mode")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20230907171010.1447274-7-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l41.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/cs35l41.c b/sound/soc/codecs/cs35l41.c
+index e428898e42112..e91c1a4640e46 100644
+--- a/sound/soc/codecs/cs35l41.c
++++ b/sound/soc/codecs/cs35l41.c
+@@ -1338,6 +1338,7 @@ int cs35l41_probe(struct cs35l41_private *cs35l41, const struct cs35l41_hw_cfg *
+ return 0;
+
+ err_pm:
++ pm_runtime_dont_use_autosuspend(cs35l41->dev);
+ pm_runtime_disable(cs35l41->dev);
+ pm_runtime_put_noidle(cs35l41->dev);
+
+@@ -1354,6 +1355,7 @@ EXPORT_SYMBOL_GPL(cs35l41_probe);
+ void cs35l41_remove(struct cs35l41_private *cs35l41)
+ {
+ pm_runtime_get_sync(cs35l41->dev);
++ pm_runtime_dont_use_autosuspend(cs35l41->dev);
+ pm_runtime_disable(cs35l41->dev);
+
+ regmap_write(cs35l41->regmap, CS35L41_IRQ1_MASK1, 0xFFFFFFFF);
+--
+2.42.0
+
--- /dev/null
+From 68e0783551f129624907fb6b468d7e6c1894f6ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 20:10:04 +0300
+Subject: ASoC: cs35l41: Verify PM runtime resume errors in IRQ handler
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 9f8948db9849d202dee3570507d3a0642f92d632 ]
+
+The interrupt handler invokes pm_runtime_get_sync() without checking the
+returned error code.
+
+Add a proper verification and switch to pm_runtime_resume_and_get(), to
+avoid the need to call pm_runtime_put_noidle() for decrementing the PM
+usage counter before returning from the error condition.
+
+Fixes: f517ba4924ad ("ASoC: cs35l41: Add support for hibernate memory retention mode")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20230907171010.1447274-6-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l41.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/cs35l41.c b/sound/soc/codecs/cs35l41.c
+index 2f4b0ee93aced..e428898e42112 100644
+--- a/sound/soc/codecs/cs35l41.c
++++ b/sound/soc/codecs/cs35l41.c
+@@ -374,10 +374,18 @@ static irqreturn_t cs35l41_irq(int irq, void *data)
+ struct cs35l41_private *cs35l41 = data;
+ unsigned int status[4] = { 0, 0, 0, 0 };
+ unsigned int masks[4] = { 0, 0, 0, 0 };
+- int ret = IRQ_NONE;
+ unsigned int i;
++ int ret;
+
+- pm_runtime_get_sync(cs35l41->dev);
++ ret = pm_runtime_resume_and_get(cs35l41->dev);
++ if (ret < 0) {
++ dev_err(cs35l41->dev,
++ "pm_runtime_resume_and_get failed in %s: %d\n",
++ __func__, ret);
++ return IRQ_NONE;
++ }
++
++ ret = IRQ_NONE;
+
+ for (i = 0; i < ARRAY_SIZE(status); i++) {
+ regmap_read(cs35l41->regmap,
+--
+2.42.0
+
--- /dev/null
+From 641d8eeddb9486bae41bff59110a1d5ca4f23b13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 21:03:15 +0800
+Subject: ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit 9e630efb5a4af56fdb15aa10405f5cfd3f5f5b83 ]
+
+The pm_runtime_enable will increase power disable depth. Thus
+a pairing decrement is needed on the error handling path to
+keep it balanced according to context. We fix it by calling
+pm_runtime_disable when error returns.
+
+Fixes: 955ac624058f ("ASoC: fsl_easrc: Add EASRC ASoC CPU DAI drivers")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Link: https://lore.kernel.org/r/tencent_C0D62E6D89818179A02A04A0C248F0DDC40A@qq.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_easrc.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_easrc.c b/sound/soc/fsl/fsl_easrc.c
+index 3153d19136b29..84e6f9eb784dc 100644
+--- a/sound/soc/fsl/fsl_easrc.c
++++ b/sound/soc/fsl/fsl_easrc.c
+@@ -1966,17 +1966,21 @@ static int fsl_easrc_probe(struct platform_device *pdev)
+ &fsl_easrc_dai, 1);
+ if (ret) {
+ dev_err(dev, "failed to register ASoC DAI\n");
+- return ret;
++ goto err_pm_disable;
+ }
+
+ ret = devm_snd_soc_register_component(dev, &fsl_asrc_component,
+ NULL, 0);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to register ASoC platform\n");
+- return ret;
++ goto err_pm_disable;
+ }
+
+ return 0;
++
++err_pm_disable:
++ pm_runtime_disable(&pdev->dev);
++ return ret;
+ }
+
+ static int fsl_easrc_remove(struct platform_device *pdev)
+--
+2.42.0
+
--- /dev/null
+From d9c965989b7ace64a8483f1ec7b6b3c86ab8ef94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2023 23:39:43 +0000
+Subject: ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member
+ not described
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 4a221b2e3340f4a3c2b414c46c846a26c6caf820 ]
+
+This patch fixes the warnings of "Function parameter or member 'xxx'
+not described".
+
+>> sound/soc/fsl/mpc5200_dma.c:116: warning: Function parameter or member 'component' not described in 'psc_dma_trigger'
+ sound/soc/fsl/mpc5200_dma.c:116: warning: Function parameter or member 'substream' not described in 'psc_dma_trigger'
+ sound/soc/fsl/mpc5200_dma.c:116: warning: Function parameter or member 'cmd' not described in 'psc_dma_trigger'
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202310061914.jJuekdHs-lkp@intel.com/
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Fixes: 6d1048bc1152 ("ASoC: fsl: mpc5200_dma: remove snd_pcm_ops")
+Link: https://lore.kernel.org/r/87il7fcqm8.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/mpc5200_dma.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/fsl/mpc5200_dma.c b/sound/soc/fsl/mpc5200_dma.c
+index 9014978100207..3f7ccae3f6b1a 100644
+--- a/sound/soc/fsl/mpc5200_dma.c
++++ b/sound/soc/fsl/mpc5200_dma.c
+@@ -100,6 +100,9 @@ static irqreturn_t psc_dma_bcom_irq(int irq, void *_psc_dma_stream)
+
+ /**
+ * psc_dma_trigger: start and stop the DMA transfer.
++ * @component: triggered component
++ * @substream: triggered substream
++ * @cmd: triggered command
+ *
+ * This function is called by ALSA to start, stop, pause, and resume the DMA
+ * transfer of data.
+--
+2.42.0
+
--- /dev/null
+From 0d24aec1905f250a1643354a8c0aae02502f0aad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Oct 2023 10:25:58 +0200
+Subject: ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit 168d97844a61db302dec76d44406e9d4d7106b8e ]
+
+Error path in snd_skl_parse_uuids() shall free last allocated module if
+its instance_id allocation fails.
+
+Fixes: f8e066521192 ("ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case")
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20231026082558.1864910-1-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/skylake/skl-sst-utils.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/intel/skylake/skl-sst-utils.c b/sound/soc/intel/skylake/skl-sst-utils.c
+index 57ea815d3f041..b776c58dcf47a 100644
+--- a/sound/soc/intel/skylake/skl-sst-utils.c
++++ b/sound/soc/intel/skylake/skl-sst-utils.c
+@@ -299,6 +299,7 @@ int snd_skl_parse_uuids(struct sst_dsp *ctx, const struct firmware *fw,
+ module->instance_id = devm_kzalloc(ctx->dev, size, GFP_KERNEL);
+ if (!module->instance_id) {
+ ret = -ENOMEM;
++ kfree(module);
+ goto free_uuid_list;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 33d21e734e384e54192e660d279522aa2e7d9e9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2023 13:54:25 +0200
+Subject: ASoC: SOF: core: Ensure sof_ops_free() is still called when probe
+ never ran.
+
+From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+
+[ Upstream commit f549a82aff57865c47b5abd17336b23cd9bb2d2c ]
+
+In an effort to not call sof_ops_free twice, we stopped running it when
+probe was aborted.
+
+Check the result of cancel_work_sync to see if this was the case.
+
+Fixes: 31bb7bd9ffee ("ASoC: SOF: core: Only call sof_ops_free() on remove if the probe was successful")
+Cc: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Acked-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: https://lore.kernel.org/r/20231009115437.99976-2-maarten.lankhorst@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/core.c b/sound/soc/sof/core.c
+index eaa16755a2704..93e1c38392a32 100644
+--- a/sound/soc/sof/core.c
++++ b/sound/soc/sof/core.c
+@@ -434,9 +434,10 @@ int snd_sof_device_remove(struct device *dev)
+ struct snd_sof_dev *sdev = dev_get_drvdata(dev);
+ struct snd_sof_pdata *pdata = sdev->pdata;
+ int ret;
++ bool aborted = false;
+
+ if (IS_ENABLED(CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE))
+- cancel_work_sync(&sdev->probe_work);
++ aborted = cancel_work_sync(&sdev->probe_work);
+
+ /*
+ * Unregister any registered client device first before IPC and debugfs
+@@ -462,6 +463,9 @@ int snd_sof_device_remove(struct device *dev)
+ snd_sof_free_debug(sdev);
+ snd_sof_remove(sdev);
+ sof_ops_free(sdev);
++ } else if (aborted) {
++ /* probe_work never ran */
++ sof_ops_free(sdev);
+ }
+
+ /* release firmware */
+--
+2.42.0
+
--- /dev/null
+From 92a8c26e3b45cfd6cdcf0bdc7053234890043e66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Oct 2023 16:47:35 +0200
+Subject: Bluetooth: hci_sync: Fix Opcode prints in bt_dev_dbg/err
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 530886897c789cf77c9a0d4a7cc5549f0768b5f8 ]
+
+Printed Opcodes may be missing leading zeros:
+
+ Bluetooth: hci0: Opcode 0x c03 failed: -110
+
+Fix this by always printing leading zeros:
+
+ Bluetooth: hci0: Opcode 0x0c03 failed: -110
+
+Fixes: d0b137062b2d ("Bluetooth: hci_sync: Rework init stages")
+Fixes: 6a98e3836fa2 ("Bluetooth: Add helper for serialized HCI command execution")
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index 5218c4dfe0a89..d74fe13f3dceb 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -151,7 +151,7 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen,
+ struct sk_buff *skb;
+ int err = 0;
+
+- bt_dev_dbg(hdev, "Opcode 0x%4x", opcode);
++ bt_dev_dbg(hdev, "Opcode 0x%4.4x", opcode);
+
+ hci_req_init(&req, hdev);
+
+@@ -247,7 +247,7 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen,
+ skb = __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, sk);
+ if (IS_ERR(skb)) {
+ if (!event)
+- bt_dev_err(hdev, "Opcode 0x%4x failed: %ld", opcode,
++ bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", opcode,
+ PTR_ERR(skb));
+ return PTR_ERR(skb);
+ }
+--
+2.42.0
+
--- /dev/null
+From ae85a9e6a1c09f87e43cf0cbec876d53b151401c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Oct 2023 22:57:41 -0700
+Subject: bpf: Fix unnecessary -EBUSY from htab_lock_bucket
+
+From: Song Liu <song@kernel.org>
+
+[ Upstream commit d35381aa73f7e1e8b25f3ed5283287a64d9ddff5 ]
+
+htab_lock_bucket uses the following logic to avoid recursion:
+
+1. preempt_disable();
+2. check percpu counter htab->map_locked[hash] for recursion;
+ 2.1. if map_lock[hash] is already taken, return -BUSY;
+3. raw_spin_lock_irqsave();
+
+However, if an IRQ hits between 2 and 3, BPF programs attached to the IRQ
+logic will not able to access the same hash of the hashtab and get -EBUSY.
+
+This -EBUSY is not really necessary. Fix it by disabling IRQ before
+checking map_locked:
+
+1. preempt_disable();
+2. local_irq_save();
+3. check percpu counter htab->map_locked[hash] for recursion;
+ 3.1. if map_lock[hash] is already taken, return -BUSY;
+4. raw_spin_lock().
+
+Similarly, use raw_spin_unlock() and local_irq_restore() in
+htab_unlock_bucket().
+
+Fixes: 20b6cc34ea74 ("bpf: Avoid hashtab deadlock with map_locked")
+Suggested-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/7a9576222aa40b1c84ad3a9ba3e64011d1a04d41.camel@linux.ibm.com
+Link: https://lore.kernel.org/bpf/20231012055741.3375999-1-song@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/hashtab.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index e4e7f343346f9..ce0051eee746e 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -155,13 +155,15 @@ static inline int htab_lock_bucket(const struct bpf_htab *htab,
+ hash = hash & min_t(u32, HASHTAB_MAP_LOCK_MASK, htab->n_buckets - 1);
+
+ preempt_disable();
++ local_irq_save(flags);
+ if (unlikely(__this_cpu_inc_return(*(htab->map_locked[hash])) != 1)) {
+ __this_cpu_dec(*(htab->map_locked[hash]));
++ local_irq_restore(flags);
+ preempt_enable();
+ return -EBUSY;
+ }
+
+- raw_spin_lock_irqsave(&b->raw_lock, flags);
++ raw_spin_lock(&b->raw_lock);
+ *pflags = flags;
+
+ return 0;
+@@ -172,8 +174,9 @@ static inline void htab_unlock_bucket(const struct bpf_htab *htab,
+ unsigned long flags)
+ {
+ hash = hash & min_t(u32, HASHTAB_MAP_LOCK_MASK, htab->n_buckets - 1);
+- raw_spin_unlock_irqrestore(&b->raw_lock, flags);
++ raw_spin_unlock(&b->raw_lock);
+ __this_cpu_dec(*(htab->map_locked[hash]));
++ local_irq_restore(flags);
+ preempt_enable();
+ }
+
+--
+2.42.0
+
--- /dev/null
+From e1671251146e68b9ebae50324ce015b29d44ecc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 10:23:47 +0200
+Subject: can: dev: can_put_echo_skb(): don't crash kernel if
+ can_priv::echo_skb is accessed out of bounds
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 6411959c10fe917288cbb1038886999148560057 ]
+
+If the "struct can_priv::echoo_skb" is accessed out of bounds, this
+would cause a kernel crash. Instead, issue a meaningful warning
+message and return with an error.
+
+Fixes: a6e4bc530403 ("can: make the number of echo skb's configurable")
+Link: https://lore.kernel.org/all/20231005-can-dev-fix-can-restart-v2-5-91b5c1fd922c@pengutronix.de
+Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/dev/skb.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/dev/skb.c b/drivers/net/can/dev/skb.c
+index f6d05b3ef59ab..3ebd4f779b9bd 100644
+--- a/drivers/net/can/dev/skb.c
++++ b/drivers/net/can/dev/skb.c
+@@ -49,7 +49,11 @@ int can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
+ {
+ struct can_priv *priv = netdev_priv(dev);
+
+- BUG_ON(idx >= priv->echo_skb_max);
++ if (idx >= priv->echo_skb_max) {
++ netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
++ __func__, idx, priv->echo_skb_max);
++ return -EINVAL;
++ }
+
+ /* check flag whether this packet has to be looped back */
+ if (!(dev->flags & IFF_ECHO) ||
+--
+2.42.0
+
--- /dev/null
+From 1574e246f7b721ef3ff59c1703f22965bb622443 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 21:58:23 +0200
+Subject: can: dev: can_restart(): don't crash kernel if carrier is OK
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit fe5c9940dfd8ba0c73672dddb30acd1b7a11d4c7 ]
+
+During testing, I triggered a can_restart() with the netif carrier
+being OK [1]. The BUG_ON, which checks if the carrier is OK, results
+in a fatal kernel crash. This is neither helpful for debugging nor for
+a production system.
+
+[1] The root cause is a race condition in can_restart() which will be
+fixed in the next patch.
+
+Do not crash the kernel, issue an error message instead, and continue
+restarting the CAN device anyway.
+
+Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
+Link: https://lore.kernel.org/all/20231005-can-dev-fix-can-restart-v2-1-91b5c1fd922c@pengutronix.de
+Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/dev/dev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
+index c1956b1e9faf7..f36bd9bd98517 100644
+--- a/drivers/net/can/dev/dev.c
++++ b/drivers/net/can/dev/dev.c
+@@ -132,7 +132,8 @@ static void can_restart(struct net_device *dev)
+ struct can_frame *cf;
+ int err;
+
+- BUG_ON(netif_carrier_ok(dev));
++ if (netif_carrier_ok(dev))
++ netdev_err(dev, "Attempt to restart for bus-off recovery, but carrier is OK?\n");
+
+ /* No synchronization needed because the device is bus-off and
+ * no messages can come in or go out.
+--
+2.42.0
+
--- /dev/null
+From f590579a60dd4f09dfb233b6b0efdf7cc83aa031 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 10:25:11 +0200
+Subject: can: dev: can_restart(): fix race condition between controller
+ restart and netif_carrier_on()
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 6841cab8c4504835e4011689cbdb3351dec693fd ]
+
+This race condition was discovered while updating the at91_can driver
+to use can_bus_off(). The following scenario describes how the
+converted at91_can driver would behave.
+
+When a CAN device goes into BUS-OFF state, the driver usually
+stops/resets the CAN device and calls can_bus_off().
+
+This function sets the netif carrier to off, and (if configured by
+user space) schedules a delayed work that calls can_restart() to
+restart the CAN device.
+
+The can_restart() function first checks if the carrier is off and
+triggers an error message if the carrier is OK.
+
+Then it calls the driver's do_set_mode() function to restart the
+device, then it sets the netif carrier to on. There is a race window
+between these two calls.
+
+The at91 CAN controller (observed on the sama5d3, a single core 32 bit
+ARM CPU) has a hardware limitation. If the device goes into bus-off
+while sending a CAN frame, there is no way to abort the sending of
+this frame. After the controller is enabled again, another attempt is
+made to send it.
+
+If the bus is still faulty, the device immediately goes back to the
+bus-off state. The driver calls can_bus_off(), the netif carrier is
+switched off and another can_restart is scheduled. This occurs within
+the race window before the original can_restart() handler marks the
+netif carrier as OK. This would cause the 2nd can_restart() to be
+called with an OK netif carrier, resulting in an error message.
+
+The flow of the 1st can_restart() looks like this:
+
+can_restart()
+ // bail out if netif_carrier is OK
+
+ netif_carrier_ok(dev)
+ priv->do_set_mode(dev, CAN_MODE_START)
+ // enable CAN controller
+ // sama5d3 restarts sending old message
+
+ // CAN devices goes into BUS_OFF, triggers IRQ
+
+// IRQ handler start
+ at91_irq()
+ at91_irq_err_line()
+ can_bus_off()
+ netif_carrier_off()
+ schedule_delayed_work()
+// IRQ handler end
+
+ netif_carrier_on()
+
+The 2nd can_restart() will be called with an OK netif carrier and the
+error message will be printed.
+
+To close the race window, first set the netif carrier to on, then
+restart the controller. In case the restart fails with an error code,
+roll back the netif carrier to off.
+
+Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
+Link: https://lore.kernel.org/all/20231005-can-dev-fix-can-restart-v2-2-91b5c1fd922c@pengutronix.de
+Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/dev/dev.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
+index f36bd9bd98517..f685479eda1be 100644
+--- a/drivers/net/can/dev/dev.c
++++ b/drivers/net/can/dev/dev.c
+@@ -154,11 +154,12 @@ static void can_restart(struct net_device *dev)
+ priv->can_stats.restarts++;
+
+ /* Now restart the device */
+- err = priv->do_set_mode(dev, CAN_MODE_START);
+-
+ netif_carrier_on(dev);
+- if (err)
++ err = priv->do_set_mode(dev, CAN_MODE_START);
++ if (err) {
+ netdev_err(dev, "Error %d during restart", err);
++ netif_carrier_off(dev);
++ }
+ }
+
+ static void can_restart_work(struct work_struct *work)
+--
+2.42.0
+
--- /dev/null
+From 7a24ecfb8b514bebe215d15fd3acd9df044acefc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 12:57:36 +0000
+Subject: chtls: fix tp->rcv_tstamp initialization
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 225d9ddbacb102621af6d28ff7bf5a0b4ce249d8 ]
+
+tp->rcv_tstamp should be set to tcp_jiffies, not tcp_time_stamp().
+
+Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Ayush Sawal <ayush.sawal@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
+index 7750702900fa6..6f6525983130e 100644
+--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
++++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
+@@ -2259,7 +2259,7 @@ static void chtls_rx_ack(struct sock *sk, struct sk_buff *skb)
+
+ if (tp->snd_una != snd_una) {
+ tp->snd_una = snd_una;
+- tp->rcv_tstamp = tcp_time_stamp(tp);
++ tp->rcv_tstamp = tcp_jiffies32;
+ if (tp->snd_una == tp->snd_nxt &&
+ !csk_flag_nochk(csk, CSK_TX_FAILOVER))
+ csk_reset_flag(csk, CSK_TX_WAIT_IDLE);
+--
+2.42.0
+
--- /dev/null
+From 64434d53136461420ee96c863338f917659df438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Oct 2023 20:26:18 +0800
+Subject: clk: imx: imx8mq: correct error handling path
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 577ad169966e6e75b10e004389a3f79813e84b5d ]
+
+Avoid memory leak in error handling path. It does not make
+much sense for the SoC without clk driver, to make program behavior
+correct, let's fix it.
+
+Fixes: b80522040cd3 ("clk: imx: Add clock driver for i.MX8MQ CCM")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Closes: https://lore.kernel.org/r/202309240551.e46NllPa-lkp@intel.com/
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/20231001122618.194498-1-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8mq.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8mq.c b/drivers/clk/imx/clk-imx8mq.c
+index 882dcad4817d7..0a75814b3bc77 100644
+--- a/drivers/clk/imx/clk-imx8mq.c
++++ b/drivers/clk/imx/clk-imx8mq.c
+@@ -288,8 +288,7 @@ static int imx8mq_clocks_probe(struct platform_device *pdev)
+ void __iomem *base;
+ int err;
+
+- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+- IMX8MQ_CLK_END), GFP_KERNEL);
++ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws, IMX8MQ_CLK_END), GFP_KERNEL);
+ if (WARN_ON(!clk_hw_data))
+ return -ENOMEM;
+
+@@ -306,10 +305,12 @@ static int imx8mq_clocks_probe(struct platform_device *pdev)
+ hws[IMX8MQ_CLK_EXT4] = imx_obtain_fixed_clk_hw(np, "clk_ext4");
+
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-anatop");
+- base = of_iomap(np, 0);
++ base = devm_of_iomap(dev, np, 0, NULL);
+ of_node_put(np);
+- if (WARN_ON(!base))
+- return -ENOMEM;
++ if (WARN_ON(IS_ERR(base))) {
++ err = PTR_ERR(base);
++ goto unregister_hws;
++ }
+
+ hws[IMX8MQ_ARM_PLL_REF_SEL] = imx_clk_hw_mux("arm_pll_ref_sel", base + 0x28, 16, 2, pll_ref_sels, ARRAY_SIZE(pll_ref_sels));
+ hws[IMX8MQ_GPU_PLL_REF_SEL] = imx_clk_hw_mux("gpu_pll_ref_sel", base + 0x18, 16, 2, pll_ref_sels, ARRAY_SIZE(pll_ref_sels));
+@@ -395,8 +396,10 @@ static int imx8mq_clocks_probe(struct platform_device *pdev)
+
+ np = dev->of_node;
+ base = devm_platform_ioremap_resource(pdev, 0);
+- if (WARN_ON(IS_ERR(base)))
+- return PTR_ERR(base);
++ if (WARN_ON(IS_ERR(base))) {
++ err = PTR_ERR(base);
++ goto unregister_hws;
++ }
+
+ /* CORE */
+ hws[IMX8MQ_CLK_A53_DIV] = imx8m_clk_hw_composite_core("arm_a53_div", imx8mq_a53_sels, base + 0x8000);
+--
+2.42.0
+
--- /dev/null
+From cba11f92033717c5092737ae83c9620eae50f10d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 17:19:00 +0800
+Subject: clk: imx: imx8qxp: Fix elcdif_pll clock
+
+From: Robert Chiras <robert.chiras@nxp.com>
+
+[ Upstream commit 15cee75dacb82ade710d61bfd536011933ef9bf2 ]
+
+Move the elcdif_pll clock initialization before the lcd_clk, since the
+elcdif_clk needs to be initialized ahead of lcd_clk, being its parent.
+This change fixes issues with the LCD clocks during suspend/resume.
+
+Fixes: babfaa9556d7 ("clk: imx: scu: add more scu clocks")
+Suggested-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com>
+Acked-by: Laurentiu Palcu <laurentiu.palcu@nxp.com>
+Signed-off-by: Robert Chiras <robert.chiras@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20230912-imx8-clk-v1-v1-2-69a34bcfcae1@nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8qxp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/imx/clk-imx8qxp.c b/drivers/clk/imx/clk-imx8qxp.c
+index 546a3703bfeb2..273de1f293076 100644
+--- a/drivers/clk/imx/clk-imx8qxp.c
++++ b/drivers/clk/imx/clk-imx8qxp.c
+@@ -148,10 +148,10 @@ static int imx8qxp_clk_probe(struct platform_device *pdev)
+ imx_clk_scu("adc0_clk", IMX_SC_R_ADC_0, IMX_SC_PM_CLK_PER);
+ imx_clk_scu("adc1_clk", IMX_SC_R_ADC_1, IMX_SC_PM_CLK_PER);
+ imx_clk_scu("pwm_clk", IMX_SC_R_LCD_0_PWM_0, IMX_SC_PM_CLK_PER);
++ imx_clk_scu("elcdif_pll", IMX_SC_R_ELCDIF_PLL, IMX_SC_PM_CLK_PLL);
+ imx_clk_scu2("lcd_clk", lcd_sels, ARRAY_SIZE(lcd_sels), IMX_SC_R_LCD_0, IMX_SC_PM_CLK_PER);
+ imx_clk_scu2("lcd_pxl_clk", lcd_pxl_sels, ARRAY_SIZE(lcd_pxl_sels), IMX_SC_R_LCD_0, IMX_SC_PM_CLK_MISC0);
+ imx_clk_scu("lcd_pxl_bypass_div_clk", IMX_SC_R_LCD_0, IMX_SC_PM_CLK_BYPASS);
+- imx_clk_scu("elcdif_pll", IMX_SC_R_ELCDIF_PLL, IMX_SC_PM_CLK_PLL);
+
+ /* Audio SS */
+ imx_clk_scu("audio_pll0_clk", IMX_SC_R_AUDIO_PLL_0, IMX_SC_PM_CLK_PLL);
+--
+2.42.0
+
--- /dev/null
+From 65cedd9ec846425385c8e634a2253450b7f52d67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 12:23:54 +0300
+Subject: clk: imx: Select MXC_CLK for CLK_IMX8QXP
+
+From: Abel Vesa <abel.vesa@linaro.org>
+
+[ Upstream commit 317e69c49b4ceef8aebb47d771498ccb3571bdf9 ]
+
+If the i.MX8QXP clock provider is built-in but the MXC_CLK is
+built as module, build fails:
+
+aarch64-linux-ld: drivers/clk/imx/clk-imx8-acm.o: in function `imx8_acm_clk_probe':
+clk-imx8-acm.c:(.text+0x3d0): undefined reference to `imx_check_clk_hws'
+
+Fix that by selecting MXC_CLK in case of CLK_IMX8QXP.
+
+Fixes: c2cccb6d0b33 ("clk: imx: add imx8qxp clk driver")
+Closes: https://lore.kernel.org/all/8b77219e-b59e-40f1-96f1-980a0b2debcf@infradead.org/
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/Kconfig b/drivers/clk/imx/Kconfig
+index 25785ec9c2762..f219004b8a337 100644
+--- a/drivers/clk/imx/Kconfig
++++ b/drivers/clk/imx/Kconfig
+@@ -96,6 +96,7 @@ config CLK_IMX8QXP
+ depends on (ARCH_MXC && ARM64) || COMPILE_TEST
+ depends on IMX_SCU && HAVE_ARM_SMCCC
+ select MXC_CLK_SCU
++ select MXC_CLK
+ help
+ Build the driver for IMX8QXP SCU based clocks.
+
+--
+2.42.0
+
--- /dev/null
+From 762cf727222ff321d6e2e91ad56984c96b1e44c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Oct 2023 17:01:57 +0300
+Subject: clk: keystone: pll: fix a couple NULL vs IS_ERR() checks
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit a5d14f8b551eb1551c10053653ee8e27f19672fa ]
+
+The clk_register_divider() and clk_register_mux() functions returns
+error pointers on error but this code checks for NULL. Fix that.
+
+Fixes: b9e0d40c0d83 ("clk: keystone: add Keystone PLL clock driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/d9da4c97-0da9-499f-9a21-1f8e3f148dc1@moroto.mountain
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/keystone/pll.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/keystone/pll.c b/drivers/clk/keystone/pll.c
+index ee5c72369334f..6bbdd4705d71f 100644
+--- a/drivers/clk/keystone/pll.c
++++ b/drivers/clk/keystone/pll.c
+@@ -281,12 +281,13 @@ static void __init of_pll_div_clk_init(struct device_node *node)
+
+ clk = clk_register_divider(NULL, clk_name, parent_name, 0, reg, shift,
+ mask, 0, NULL);
+- if (clk) {
+- of_clk_add_provider(node, of_clk_src_simple_get, clk);
+- } else {
++ if (IS_ERR(clk)) {
+ pr_err("%s: error registering divider %s\n", __func__, clk_name);
+ iounmap(reg);
++ return;
+ }
++
++ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ }
+ CLK_OF_DECLARE(pll_divider_clock, "ti,keystone,pll-divider-clock", of_pll_div_clk_init);
+
+@@ -328,10 +329,12 @@ static void __init of_pll_mux_clk_init(struct device_node *node)
+ clk = clk_register_mux(NULL, clk_name, (const char **)&parents,
+ ARRAY_SIZE(parents) , 0, reg, shift, mask,
+ 0, NULL);
+- if (clk)
+- of_clk_add_provider(node, of_clk_src_simple_get, clk);
+- else
++ if (IS_ERR(clk)) {
+ pr_err("%s: error registering mux %s\n", __func__, clk_name);
++ return;
++ }
++
++ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ }
+ CLK_OF_DECLARE(pll_mux_clock, "ti,keystone,pll-mux-clock", of_pll_mux_clk_init);
+
+--
+2.42.0
+
--- /dev/null
+From 5de6a73076c19faa4a736a2f2884130dc44d8857 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Sep 2023 15:14:26 -0700
+Subject: clk: linux/clk-provider.h: fix kernel-doc warnings and typos
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 84aefafe6b294041b7fa0757414c4a29c1bdeea2 ]
+
+Fix spelling of "Structure".
+
+Fix multiple kernel-doc warnings:
+
+clk-provider.h:269: warning: Function parameter or member 'recalc_rate' not described in 'clk_ops'
+clk-provider.h:468: warning: Function parameter or member 'parent_data' not described in 'clk_hw_register_fixed_rate_with_accuracy_parent_data'
+clk-provider.h:468: warning: Excess function parameter 'parent_name' description in 'clk_hw_register_fixed_rate_with_accuracy_parent_data'
+clk-provider.h:482: warning: Function parameter or member 'parent_data' not described in 'clk_hw_register_fixed_rate_parent_accuracy'
+clk-provider.h:482: warning: Excess function parameter 'parent_name' description in 'clk_hw_register_fixed_rate_parent_accuracy'
+clk-provider.h:687: warning: Function parameter or member 'flags' not described in 'clk_divider'
+clk-provider.h:1164: warning: Function parameter or member 'flags' not described in 'clk_fractional_divider'
+clk-provider.h:1164: warning: Function parameter or member 'approximation' not described in 'clk_fractional_divider'
+clk-provider.h:1213: warning: Function parameter or member 'flags' not described in 'clk_multiplier'
+
+Fixes: 9fba738a53dd ("clk: add duty cycle support")
+Fixes: b2476490ef11 ("clk: introduce the common clock framework")
+Fixes: 2d34f09e79c9 ("clk: fixed-rate: Add support for specifying parents via DT/pointers")
+Fixes: f5290d8e4f0c ("clk: asm9260: use parent index to link the reference clock")
+Fixes: 9d9f78ed9af0 ("clk: basic clock hardware types")
+Fixes: e2d0e90fae82 ("clk: new basic clk type for fractional divider")
+Fixes: f2e0a53271a4 ("clk: Add a basic multiplier clock")
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Michael Turquette <mturquette@baylibre.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: linux-clk@vger.kernel.org
+Link: https://lore.kernel.org/r/20230930221428.18463-1-rdunlap@infradead.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/clk-provider.h | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
+index aefb06373720f..15e336281d1f4 100644
+--- a/include/linux/clk-provider.h
++++ b/include/linux/clk-provider.h
+@@ -72,7 +72,7 @@ void clk_hw_forward_rate_request(const struct clk_hw *core,
+ unsigned long parent_rate);
+
+ /**
+- * struct clk_duty - Struture encoding the duty cycle ratio of a clock
++ * struct clk_duty - Structure encoding the duty cycle ratio of a clock
+ *
+ * @num: Numerator of the duty cycle ratio
+ * @den: Denominator of the duty cycle ratio
+@@ -127,7 +127,7 @@ struct clk_duty {
+ * @restore_context: Restore the context of the clock after a restoration
+ * of power.
+ *
+- * @recalc_rate Recalculate the rate of this clock, by querying hardware. The
++ * @recalc_rate: Recalculate the rate of this clock, by querying hardware. The
+ * parent rate is an input parameter. It is up to the caller to
+ * ensure that the prepare_mutex is held across this call. If the
+ * driver cannot figure out a rate for this clock, it must return
+@@ -454,7 +454,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
+ * clock with the clock framework
+ * @dev: device that is registering this clock
+ * @name: name of this clock
+- * @parent_name: name of clock's parent
++ * @parent_data: name of clock's parent
+ * @flags: framework-specific flags
+ * @fixed_rate: non-adjustable clock rate
+ * @fixed_accuracy: non-adjustable clock accuracy
+@@ -469,7 +469,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
+ * the clock framework
+ * @dev: device that is registering this clock
+ * @name: name of this clock
+- * @parent_name: name of clock's parent
++ * @parent_data: name of clock's parent
+ * @flags: framework-specific flags
+ * @fixed_rate: non-adjustable clock rate
+ */
+@@ -628,7 +628,7 @@ struct clk_div_table {
+ * Clock with an adjustable divider affecting its output frequency. Implements
+ * .recalc_rate, .set_rate and .round_rate
+ *
+- * Flags:
++ * @flags:
+ * CLK_DIVIDER_ONE_BASED - by default the divisor is the value read from the
+ * register plus one. If CLK_DIVIDER_ONE_BASED is set then the divider is
+ * the raw value read from the register, with the value of zero considered
+@@ -1109,11 +1109,12 @@ struct clk_hw *clk_hw_register_fixed_factor_parent_hw(struct device *dev,
+ * @mwidth: width of the numerator bit field
+ * @nshift: shift to the denominator bit field
+ * @nwidth: width of the denominator bit field
++ * @approximation: clk driver's callback for calculating the divider clock
+ * @lock: register lock
+ *
+ * Clock with adjustable fractional divider affecting its output frequency.
+ *
+- * Flags:
++ * @flags:
+ * CLK_FRAC_DIVIDER_ZERO_BASED - by default the numerator and denominator
+ * is the value read from the register. If CLK_FRAC_DIVIDER_ZERO_BASED
+ * is set then the numerator and denominator are both the value read
+@@ -1172,7 +1173,7 @@ void clk_hw_unregister_fractional_divider(struct clk_hw *hw);
+ * Clock with an adjustable multiplier affecting its output frequency.
+ * Implements .recalc_rate, .set_rate and .round_rate
+ *
+- * Flags:
++ * @flags:
+ * CLK_MULTIPLIER_ZERO_BYPASS - By default, the multiplier is the value read
+ * from the register, with 0 being a valid value effectively
+ * zeroing the output clock rate. If CLK_MULTIPLIER_ZERO_BYPASS is
+--
+2.42.0
+
--- /dev/null
+From 2841ab40fa7e54d295ec80df8256edb32f316b28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Sep 2023 10:46:58 +0800
+Subject: clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 0d6e24b422a2166a9297a8286ff2e6ab9a5e8cd3 ]
+
+Add the check for the return value of mtk_alloc_clk_data() in order to
+avoid NULL pointer dereference.
+
+Fixes: e9862118272a ("clk: mediatek: Add MT2701 clock support")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20230901024658.23405-1-jiasheng@iscas.ac.cn
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt2701.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/clk/mediatek/clk-mt2701.c b/drivers/clk/mediatek/clk-mt2701.c
+index 1c3a93143dc5e..00d2e81bdd43e 100644
+--- a/drivers/clk/mediatek/clk-mt2701.c
++++ b/drivers/clk/mediatek/clk-mt2701.c
+@@ -670,6 +670,8 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ return PTR_ERR(base);
+
+ clk_data = mtk_alloc_clk_data(CLK_TOP_NR);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks),
+ clk_data);
+@@ -749,6 +751,8 @@ static void __init mtk_infrasys_init_early(struct device_node *node)
+
+ if (!infra_clk_data) {
+ infra_clk_data = mtk_alloc_clk_data(CLK_INFRA_NR);
++ if (!infra_clk_data)
++ return;
+
+ for (i = 0; i < CLK_INFRA_NR; i++)
+ infra_clk_data->hws[i] = ERR_PTR(-EPROBE_DEFER);
+@@ -776,6 +780,8 @@ static int mtk_infrasys_init(struct platform_device *pdev)
+
+ if (!infra_clk_data) {
+ infra_clk_data = mtk_alloc_clk_data(CLK_INFRA_NR);
++ if (!infra_clk_data)
++ return -ENOMEM;
+ } else {
+ for (i = 0; i < CLK_INFRA_NR; i++) {
+ if (infra_clk_data->hws[i] == ERR_PTR(-EPROBE_DEFER))
+@@ -893,6 +899,8 @@ static int mtk_pericfg_init(struct platform_device *pdev)
+ return PTR_ERR(base);
+
+ clk_data = mtk_alloc_clk_data(CLK_PERI_NR);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks),
+ clk_data);
+--
+2.42.0
+
--- /dev/null
+From cc82427e8718f8b18298d7f024f3d8710b485467 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 17:34:03 +0800
+Subject: clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit b82681042724924ae3ba0f2f2eeec217fa31e830 ]
+
+Add the check for the return value of mtk_alloc_clk_data() in order to
+avoid NULL pointer dereference.
+
+Fixes: 1aca9939bf72 ("clk: mediatek: Add MT6765 clock support")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20230912093407.21505-1-jiasheng@iscas.ac.cn
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt6765.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/clk/mediatek/clk-mt6765.c b/drivers/clk/mediatek/clk-mt6765.c
+index 665981fc411f5..2c6a52ff5564e 100644
+--- a/drivers/clk/mediatek/clk-mt6765.c
++++ b/drivers/clk/mediatek/clk-mt6765.c
+@@ -738,6 +738,8 @@ static int clk_mt6765_apmixed_probe(struct platform_device *pdev)
+ }
+
+ clk_data = mtk_alloc_clk_data(CLK_APMIXED_NR_CLK);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
+
+@@ -773,6 +775,8 @@ static int clk_mt6765_top_probe(struct platform_device *pdev)
+ }
+
+ clk_data = mtk_alloc_clk_data(CLK_TOP_NR_CLK);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_fixed_clks(fixed_clks, ARRAY_SIZE(fixed_clks),
+ clk_data);
+@@ -813,6 +817,8 @@ static int clk_mt6765_ifr_probe(struct platform_device *pdev)
+ }
+
+ clk_data = mtk_alloc_clk_data(CLK_IFR_NR_CLK);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_gates(node, ifr_clks, ARRAY_SIZE(ifr_clks),
+ clk_data);
+--
+2.42.0
+
--- /dev/null
+From b99732a02bac3df129e13252f57cdcaf333f9157 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 17:34:04 +0800
+Subject: clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 1f57f78fbacf630430bf954e5a84caafdfea30c0 ]
+
+Add the check for the return value of mtk_alloc_clk_data() in order to
+avoid NULL pointer dereference.
+
+Fixes: 710774e04861 ("clk: mediatek: Add MT6779 clock support")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20230912093407.21505-2-jiasheng@iscas.ac.cn
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt6779.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/clk/mediatek/clk-mt6779.c b/drivers/clk/mediatek/clk-mt6779.c
+index 0d0a90ee5eb2c..39dadc9547088 100644
+--- a/drivers/clk/mediatek/clk-mt6779.c
++++ b/drivers/clk/mediatek/clk-mt6779.c
+@@ -1218,6 +1218,8 @@ static int clk_mt6779_apmixed_probe(struct platform_device *pdev)
+ struct device_node *node = pdev->dev.of_node;
+
+ clk_data = mtk_alloc_clk_data(CLK_APMIXED_NR_CLK);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
+
+@@ -1238,6 +1240,8 @@ static int clk_mt6779_top_probe(struct platform_device *pdev)
+ return PTR_ERR(base);
+
+ clk_data = mtk_alloc_clk_data(CLK_TOP_NR_CLK);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks),
+ clk_data);
+--
+2.42.0
+
--- /dev/null
+From 16a16d25447735e39f7e22b7167c5a2e9e2644d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 17:34:05 +0800
+Subject: clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 606f6366a35a3329545e38129804d65ef26ed7d2 ]
+
+Add the check for the return value of mtk_alloc_clk_data() in order to
+avoid NULL pointer dereference.
+
+Fixes: 96596aa06628 ("clk: mediatek: add clk support for MT6797")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20230912093407.21505-3-jiasheng@iscas.ac.cn
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt6797.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/clk/mediatek/clk-mt6797.c b/drivers/clk/mediatek/clk-mt6797.c
+index 78339cb35beb0..b362e99c8f53c 100644
+--- a/drivers/clk/mediatek/clk-mt6797.c
++++ b/drivers/clk/mediatek/clk-mt6797.c
+@@ -392,6 +392,8 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ return PTR_ERR(base);
+
+ clk_data = mtk_alloc_clk_data(CLK_TOP_NR);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_factors(top_fixed_divs, ARRAY_SIZE(top_fixed_divs),
+ clk_data);
+@@ -546,6 +548,8 @@ static void mtk_infrasys_init_early(struct device_node *node)
+
+ if (!infra_clk_data) {
+ infra_clk_data = mtk_alloc_clk_data(CLK_INFRA_NR);
++ if (!infra_clk_data)
++ return;
+
+ for (i = 0; i < CLK_INFRA_NR; i++)
+ infra_clk_data->hws[i] = ERR_PTR(-EPROBE_DEFER);
+@@ -571,6 +575,8 @@ static int mtk_infrasys_init(struct platform_device *pdev)
+
+ if (!infra_clk_data) {
+ infra_clk_data = mtk_alloc_clk_data(CLK_INFRA_NR);
++ if (!infra_clk_data)
++ return -ENOMEM;
+ } else {
+ for (i = 0; i < CLK_INFRA_NR; i++) {
+ if (infra_clk_data->hws[i] == ERR_PTR(-EPROBE_DEFER))
+--
+2.42.0
+
--- /dev/null
+From adc11fd769029dd3710544a5d0fd7a0f427ec839 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 17:34:07 +0800
+Subject: clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 2befa515c1bb6cdd33c262b909d93d1973a219aa ]
+
+Add the check for the return value of mtk_alloc_clk_data() in order to
+avoid NULL pointer dereference.
+
+Fixes: 3b5e748615e7 ("clk: mediatek: add clock support for MT7629 SoC")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20230912093407.21505-5-jiasheng@iscas.ac.cn
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt7629.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/clk/mediatek/clk-mt7629.c b/drivers/clk/mediatek/clk-mt7629.c
+index 0bc88b7d171b5..01ee45fcd7e34 100644
+--- a/drivers/clk/mediatek/clk-mt7629.c
++++ b/drivers/clk/mediatek/clk-mt7629.c
+@@ -557,6 +557,8 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ return PTR_ERR(base);
+
+ clk_data = mtk_alloc_clk_data(CLK_TOP_NR_CLK);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks),
+ clk_data);
+@@ -580,6 +582,8 @@ static int mtk_infrasys_init(struct platform_device *pdev)
+ struct clk_hw_onecell_data *clk_data;
+
+ clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+ clk_data);
+@@ -603,6 +607,8 @@ static int mtk_pericfg_init(struct platform_device *pdev)
+ return PTR_ERR(base);
+
+ clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks),
+ clk_data);
+--
+2.42.0
+
--- /dev/null
+From 08331df5e65827564c58201264d6cfe0c9eb1a2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 17:34:06 +0800
+Subject: clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 0884393c63cc9a1772f7121a6645ba7bd76feeb9 ]
+
+Add the check for the return value of mtk_alloc_clk_data() in order to
+avoid NULL pointer dereference.
+
+Fixes: 3b5e748615e7 ("clk: mediatek: add clock support for MT7629 SoC")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20230912093407.21505-4-jiasheng@iscas.ac.cn
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt7629-eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/clk/mediatek/clk-mt7629-eth.c b/drivers/clk/mediatek/clk-mt7629-eth.c
+index b0c8fa3b8bbec..e1d2635c72c10 100644
+--- a/drivers/clk/mediatek/clk-mt7629-eth.c
++++ b/drivers/clk/mediatek/clk-mt7629-eth.c
+@@ -79,6 +79,8 @@ static int clk_mt7629_ethsys_init(struct platform_device *pdev)
+ int r;
+
+ clk_data = mtk_alloc_clk_data(CLK_ETH_NR_CLK);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_gates(node, eth_clks, CLK_ETH_NR_CLK, clk_data);
+
+@@ -101,6 +103,8 @@ static int clk_mt7629_sgmiisys_init(struct platform_device *pdev)
+ int r;
+
+ clk_data = mtk_alloc_clk_data(CLK_SGMII_NR_CLK);
++ if (!clk_data)
++ return -ENOMEM;
+
+ mtk_clk_register_gates(node, sgmii_clks[id++], CLK_SGMII_NR_CLK,
+ clk_data);
+--
+2.42.0
+
--- /dev/null
+From 8f7486255c8c3f80a29d90aef8af23321f01f577 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Sep 2023 15:31:27 +0200
+Subject: clk: npcm7xx: Fix incorrect kfree
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+
+[ Upstream commit bbc5080bef4a245106aa8e8d424ba8847ca7c0ca ]
+
+The corresponding allocation is:
+
+> npcm7xx_clk_data = kzalloc(struct_size(npcm7xx_clk_data, hws,
+> NPCM7XX_NUM_CLOCKS), GFP_KERNEL);
+
+... so, kfree should be applied to npcm7xx_clk_data, not
+npcm7xx_clk_data->hws.
+
+Fixes: fcfd14369856 ("clk: npcm7xx: add clock controller")
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Link: https://lore.kernel.org/r/20230923133127.1815621-1-j.neuschaefer@gmx.net
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-npcm7xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk-npcm7xx.c b/drivers/clk/clk-npcm7xx.c
+index e319cfa51a8a3..030186def9c69 100644
+--- a/drivers/clk/clk-npcm7xx.c
++++ b/drivers/clk/clk-npcm7xx.c
+@@ -510,7 +510,7 @@ static void __init npcm7xx_clk_init(struct device_node *clk_np)
+ return;
+
+ npcm7xx_init_fail:
+- kfree(npcm7xx_clk_data->hws);
++ kfree(npcm7xx_clk_data);
+ npcm7xx_init_np_err:
+ iounmap(clk_base);
+ npcm7xx_init_error:
+--
+2.42.0
+
--- /dev/null
+From 992f44944c8d7d9ada8bd1ebc51f8ef847fe86b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Sep 2023 13:06:40 +0530
+Subject: clk: qcom: clk-rcg2: Fix clock rate overflow for high parent
+ frequencies
+
+From: Devi Priya <quic_devipriy@quicinc.com>
+
+[ Upstream commit f7b7d30158cff246667273bd2a62fc93ee0725d2 ]
+
+If the parent clock rate is greater than unsigned long max/2 then
+integer overflow happens when calculating the clock rate on 32-bit systems.
+As RCG2 uses half integer dividers, the clock rate is first being
+multiplied by 2 which will overflow the unsigned long max value.
+Hence, replace the common pattern of doing 64-bit multiplication
+and then a do_div() call with simpler mult_frac call.
+
+Fixes: bcd61c0f535a ("clk: qcom: Add support for root clock generators (RCGs)")
+Signed-off-by: Devi Priya <quic_devipriy@quicinc.com>
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Link: https://lore.kernel.org/r/20230901073640.4973-1-quic_devipriy@quicinc.com
+[bjorn: Also drop unnecessary {} around single statements]
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rcg2.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index 76551534f10df..dc797bd137caf 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -158,17 +158,11 @@ static int clk_rcg2_set_parent(struct clk_hw *hw, u8 index)
+ static unsigned long
+ calc_rate(unsigned long rate, u32 m, u32 n, u32 mode, u32 hid_div)
+ {
+- if (hid_div) {
+- rate *= 2;
+- rate /= hid_div + 1;
+- }
++ if (hid_div)
++ rate = mult_frac(rate, 2, hid_div + 1);
+
+- if (mode) {
+- u64 tmp = rate;
+- tmp *= m;
+- do_div(tmp, n);
+- rate = tmp;
+- }
++ if (mode)
++ rate = mult_frac(rate, m, n);
+
+ return rate;
+ }
+--
+2.42.0
+
--- /dev/null
+From 7c15cc7ae12b1f3b812c779650ab20a74456b940 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 11:49:31 +0530
+Subject: clk: qcom: config IPQ_APSS_6018 should depend on QCOM_SMEM
+
+From: Varadarajan Narayanan <quic_varada@quicinc.com>
+
+[ Upstream commit 6a15647d0adc686226045e8046369f34d6ab03ed ]
+
+The config IPQ_APSS_6018 should depend on QCOM_SMEM, to
+avoid the following error reported by 'kernel test robot'
+
+ loongarch64-linux-ld: drivers/clk/qcom/apss-ipq6018.o: in function `apss_ipq6018_probe':
+ >> apss-ipq6018.c:(.text+0xd0): undefined reference to `qcom_smem_get_soc_id'
+
+Fixes: 5e77b4ef1b19 ("clk: qcom: Add ipq6018 apss clock controller")
+Reported-by: kernel test robot <yujie.liu@intel.com>
+Closes: https://lore.kernel.org/r/202310181650.g8THtfsm-lkp@intel.com/
+Signed-off-by: Varadarajan Narayanan <quic_varada@quicinc.com>
+Link: https://lore.kernel.org/r/f4c4d65a7cb71e807d6d472c63c7718408c8f5f0.1697781921.git.quic_varada@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig
+index 76e6dee450d59..cbf55949c6493 100644
+--- a/drivers/clk/qcom/Kconfig
++++ b/drivers/clk/qcom/Kconfig
+@@ -127,6 +127,7 @@ config IPQ_APSS_6018
+ tristate "IPQ APSS Clock Controller"
+ select IPQ_APSS_PLL
+ depends on QCOM_APCS_IPC || COMPILE_TEST
++ depends on QCOM_SMEM
+ help
+ Support for APSS clock controller on IPQ platforms. The
+ APSS clock controller manages the Mux and enable block that feeds the
+--
+2.42.0
+
--- /dev/null
+From 2e368bcbe873548d96f044c6e17be00c47349302 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Aug 2023 11:39:14 +0200
+Subject: clk: qcom: gcc-msm8996: Remove RPM bus clocks
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 4afda5f6bcdf673ef2556fcfa458daf3a5a648d8 ]
+
+The GCC driver contains clocks that are owned (meaning configured and
+scaled) by the RPM core.
+
+Remove them from Linux to stop interjecting the RPM's logic.
+
+Fixes: b1e010c0730a ("clk: qcom: Add MSM8996 Global Clock Control (GCC) driver")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230830-topic-rpmbusclocks8996gcc-v1-1-9e99bedcdc3b@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8996.c | 237 +--------------------------------
+ 1 file changed, 5 insertions(+), 232 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
+index e161637067351..ff5a16700ef71 100644
+--- a/drivers/clk/qcom/gcc-msm8996.c
++++ b/drivers/clk/qcom/gcc-msm8996.c
+@@ -245,71 +245,6 @@ static const struct clk_parent_data gcc_xo_gpll0_gpll4_gpll0_early_div[] = {
+ { .hw = &gpll0_early_div.hw }
+ };
+
+-static const struct freq_tbl ftbl_system_noc_clk_src[] = {
+- F(19200000, P_XO, 1, 0, 0),
+- F(50000000, P_GPLL0_EARLY_DIV, 6, 0, 0),
+- F(100000000, P_GPLL0, 6, 0, 0),
+- F(150000000, P_GPLL0, 4, 0, 0),
+- F(200000000, P_GPLL0, 3, 0, 0),
+- F(240000000, P_GPLL0, 2.5, 0, 0),
+- { }
+-};
+-
+-static struct clk_rcg2 system_noc_clk_src = {
+- .cmd_rcgr = 0x0401c,
+- .hid_width = 5,
+- .parent_map = gcc_xo_gpll0_gpll0_early_div_map,
+- .freq_tbl = ftbl_system_noc_clk_src,
+- .clkr.hw.init = &(struct clk_init_data){
+- .name = "system_noc_clk_src",
+- .parent_data = gcc_xo_gpll0_gpll0_early_div,
+- .num_parents = ARRAY_SIZE(gcc_xo_gpll0_gpll0_early_div),
+- .ops = &clk_rcg2_ops,
+- },
+-};
+-
+-static const struct freq_tbl ftbl_config_noc_clk_src[] = {
+- F(19200000, P_XO, 1, 0, 0),
+- F(37500000, P_GPLL0, 16, 0, 0),
+- F(75000000, P_GPLL0, 8, 0, 0),
+- { }
+-};
+-
+-static struct clk_rcg2 config_noc_clk_src = {
+- .cmd_rcgr = 0x0500c,
+- .hid_width = 5,
+- .parent_map = gcc_xo_gpll0_map,
+- .freq_tbl = ftbl_config_noc_clk_src,
+- .clkr.hw.init = &(struct clk_init_data){
+- .name = "config_noc_clk_src",
+- .parent_data = gcc_xo_gpll0,
+- .num_parents = ARRAY_SIZE(gcc_xo_gpll0),
+- .ops = &clk_rcg2_ops,
+- },
+-};
+-
+-static const struct freq_tbl ftbl_periph_noc_clk_src[] = {
+- F(19200000, P_XO, 1, 0, 0),
+- F(37500000, P_GPLL0, 16, 0, 0),
+- F(50000000, P_GPLL0, 12, 0, 0),
+- F(75000000, P_GPLL0, 8, 0, 0),
+- F(100000000, P_GPLL0, 6, 0, 0),
+- { }
+-};
+-
+-static struct clk_rcg2 periph_noc_clk_src = {
+- .cmd_rcgr = 0x06014,
+- .hid_width = 5,
+- .parent_map = gcc_xo_gpll0_map,
+- .freq_tbl = ftbl_periph_noc_clk_src,
+- .clkr.hw.init = &(struct clk_init_data){
+- .name = "periph_noc_clk_src",
+- .parent_data = gcc_xo_gpll0,
+- .num_parents = ARRAY_SIZE(gcc_xo_gpll0),
+- .ops = &clk_rcg2_ops,
+- },
+-};
+-
+ static const struct freq_tbl ftbl_usb30_master_clk_src[] = {
+ F(19200000, P_XO, 1, 0, 0),
+ F(120000000, P_GPLL0, 5, 0, 0),
+@@ -1298,11 +1233,7 @@ static struct clk_branch gcc_mmss_noc_cfg_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_mmss_noc_cfg_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT | CLK_IGNORE_UNUSED,
++ .flags = CLK_IGNORE_UNUSED,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1465,11 +1396,6 @@ static struct clk_branch gcc_usb_phy_cfg_ahb2phy_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_usb_phy_cfg_ahb2phy_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &periph_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1499,11 +1425,6 @@ static struct clk_branch gcc_sdcc1_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_sdcc1_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &periph_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1550,11 +1471,6 @@ static struct clk_branch gcc_sdcc2_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_sdcc2_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &periph_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1584,11 +1500,6 @@ static struct clk_branch gcc_sdcc3_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_sdcc3_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &periph_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1618,11 +1529,6 @@ static struct clk_branch gcc_sdcc4_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_sdcc4_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &periph_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1636,11 +1542,6 @@ static struct clk_branch gcc_blsp1_ahb_clk = {
+ .enable_mask = BIT(17),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_blsp1_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &periph_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1978,11 +1879,6 @@ static struct clk_branch gcc_blsp2_ahb_clk = {
+ .enable_mask = BIT(15),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_blsp2_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &periph_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2319,11 +2215,6 @@ static struct clk_branch gcc_pdm_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pdm_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &periph_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2354,11 +2245,6 @@ static struct clk_branch gcc_prng_ahb_clk = {
+ .enable_mask = BIT(13),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_prng_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2371,11 +2257,6 @@ static struct clk_branch gcc_tsif_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_tsif_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &periph_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2423,11 +2304,6 @@ static struct clk_branch gcc_boot_rom_ahb_clk = {
+ .enable_mask = BIT(10),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_boot_rom_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2521,11 +2397,6 @@ static struct clk_branch gcc_pcie_0_slv_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_0_slv_axi_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &system_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2538,11 +2409,6 @@ static struct clk_branch gcc_pcie_0_mstr_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_0_mstr_axi_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &system_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2555,11 +2421,6 @@ static struct clk_branch gcc_pcie_0_cfg_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_0_cfg_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2607,11 +2468,6 @@ static struct clk_branch gcc_pcie_1_slv_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_1_slv_axi_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &system_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2624,11 +2480,6 @@ static struct clk_branch gcc_pcie_1_mstr_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_1_mstr_axi_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &system_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2641,11 +2492,6 @@ static struct clk_branch gcc_pcie_1_cfg_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_1_cfg_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2693,11 +2539,6 @@ static struct clk_branch gcc_pcie_2_slv_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_2_slv_axi_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &system_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2710,11 +2551,6 @@ static struct clk_branch gcc_pcie_2_mstr_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_2_mstr_axi_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &system_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2727,11 +2563,6 @@ static struct clk_branch gcc_pcie_2_cfg_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_2_cfg_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2779,11 +2610,6 @@ static struct clk_branch gcc_pcie_phy_cfg_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_phy_cfg_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2830,11 +2656,6 @@ static struct clk_branch gcc_ufs_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3061,11 +2882,7 @@ static struct clk_branch gcc_aggre0_snoc_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_aggre0_snoc_axi_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &system_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
++ .flags = CLK_IS_CRITICAL,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3078,11 +2895,7 @@ static struct clk_branch gcc_aggre0_cnoc_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_aggre0_cnoc_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
++ .flags = CLK_IS_CRITICAL,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3095,11 +2908,7 @@ static struct clk_branch gcc_smmu_aggre0_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_smmu_aggre0_axi_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &system_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
++ .flags = CLK_IS_CRITICAL,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3112,11 +2921,7 @@ static struct clk_branch gcc_smmu_aggre0_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_smmu_aggre0_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
++ .flags = CLK_IS_CRITICAL,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3163,10 +2968,6 @@ static struct clk_branch gcc_dcc_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_dcc_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3179,10 +2980,6 @@ static struct clk_branch gcc_aggre0_noc_mpu_cfg_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_aggre0_noc_mpu_cfg_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3195,11 +2992,6 @@ static struct clk_branch gcc_qspi_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_qspi_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &periph_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3348,10 +3140,6 @@ static struct clk_branch gcc_mss_cfg_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_mss_cfg_ahb_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &config_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3364,10 +3152,6 @@ static struct clk_branch gcc_mss_mnoc_bimc_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_mss_mnoc_bimc_axi_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &system_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3380,10 +3164,6 @@ static struct clk_branch gcc_mss_snoc_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_mss_snoc_axi_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &system_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3396,10 +3176,6 @@ static struct clk_branch gcc_mss_q6_bimc_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_mss_q6_bimc_axi_clk",
+- .parent_hws = (const struct clk_hw*[]){
+- &system_noc_clk_src.clkr.hw,
+- },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -3495,9 +3271,6 @@ static struct clk_regmap *gcc_msm8996_clocks[] = {
+ [GPLL0] = &gpll0.clkr,
+ [GPLL4_EARLY] = &gpll4_early.clkr,
+ [GPLL4] = &gpll4.clkr,
+- [SYSTEM_NOC_CLK_SRC] = &system_noc_clk_src.clkr,
+- [CONFIG_NOC_CLK_SRC] = &config_noc_clk_src.clkr,
+- [PERIPH_NOC_CLK_SRC] = &periph_noc_clk_src.clkr,
+ [USB30_MASTER_CLK_SRC] = &usb30_master_clk_src.clkr,
+ [USB30_MOCK_UTMI_CLK_SRC] = &usb30_mock_utmi_clk_src.clkr,
+ [USB3_PHY_AUX_CLK_SRC] = &usb3_phy_aux_clk_src.clkr,
+--
+2.42.0
+
--- /dev/null
+From 6b0df6bb89aa63bed10dc1aa436d178f99686a40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 20:56:11 +0300
+Subject: clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src
+
+From: Danila Tikhonov <danila@jiaxyga.com>
+
+[ Upstream commit 7138c244fb293f24ce8ab782961022eff00a10c4 ]
+
+Set .flags = CLK_OPS_PARENT_ENABLE to fix "gcc_sdcc2_apps_clk_src: rcg
+didn't update its configuration" error.
+
+Fixes: 2a1d7eb854bb ("clk: qcom: gcc: Add global clock controller driver for SM8150")
+Tested-by: Arseniy Velikanov <adomerlee@gmail.com>
+Signed-off-by: Danila Tikhonov <danila@jiaxyga.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230913175612.8685-1-danila@jiaxyga.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sm8150.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-sm8150.c b/drivers/clk/qcom/gcc-sm8150.c
+index 09cf827addabe..4501c15c4a417 100644
+--- a/drivers/clk/qcom/gcc-sm8150.c
++++ b/drivers/clk/qcom/gcc-sm8150.c
+@@ -792,7 +792,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
+ .name = "gcc_sdcc2_apps_clk_src",
+ .parent_data = gcc_parents_6,
+ .num_parents = ARRAY_SIZE(gcc_parents_6),
+- .flags = CLK_SET_RATE_PARENT,
++ .flags = CLK_OPS_PARENT_ENABLE,
+ .ops = &clk_rcg2_floor_ops,
+ },
+ };
+--
+2.42.0
+
--- /dev/null
+From 7941d37d86bf21de362f9c8a6d81a2412be7bc76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Aug 2023 21:20:27 +0200
+Subject: clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 9906c4140897bbdbff7bb71c6ae67903cb9954ce ]
+
+Some branch clocks are governed externally and we're only supposed to
+send a request concerning their shutdown, not actually ensure it happens.
+
+Use the BRANCH_HALT_SKIP define to skip checking the halt bit.
+
+Fixes: d14b15b5931c ("clk: qcom: Add MSM8998 Multimedia Clock Controller (MMCC) driver")
+Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230531-topic-8998_mmssclk-v3-4-ba1b1fd9ee75@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-msm8998.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/qcom/mmcc-msm8998.c b/drivers/clk/qcom/mmcc-msm8998.c
+index c421b12916516..0702a9f00cc1b 100644
+--- a/drivers/clk/qcom/mmcc-msm8998.c
++++ b/drivers/clk/qcom/mmcc-msm8998.c
+@@ -2478,6 +2478,7 @@ static struct clk_branch fd_ahb_clk = {
+
+ static struct clk_branch mnoc_ahb_clk = {
+ .halt_reg = 0x5024,
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x5024,
+ .enable_mask = BIT(0),
+@@ -2493,6 +2494,7 @@ static struct clk_branch mnoc_ahb_clk = {
+
+ static struct clk_branch bimc_smmu_ahb_clk = {
+ .halt_reg = 0xe004,
++ .halt_check = BRANCH_HALT_SKIP,
+ .hwcg_reg = 0xe004,
+ .hwcg_bit = 1,
+ .clkr = {
+@@ -2510,6 +2512,7 @@ static struct clk_branch bimc_smmu_ahb_clk = {
+
+ static struct clk_branch bimc_smmu_axi_clk = {
+ .halt_reg = 0xe008,
++ .halt_check = BRANCH_HALT_SKIP,
+ .hwcg_reg = 0xe008,
+ .hwcg_bit = 1,
+ .clkr = {
+--
+2.42.0
+
--- /dev/null
+From 37813bcc4e97163f60717d5c35d55bf63a73b01b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Aug 2023 21:20:28 +0200
+Subject: clk: qcom: mmcc-msm8998: Fix the SMMU GDSC
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 1fc62c8347397faf4e18249e88ecd4470c0a5357 ]
+
+The SMMU GDSC doesn't have to be ALWAYS-ON and shouldn't feature the
+HW_CTRL flag (it's separate from hw_ctrl_addr). In addition to that,
+it should feature a cxc entry for bimc_smmu_axi_clk and be marked as
+votable.
+
+Fix all of these issues.
+
+Fixes: d14b15b5931c ("clk: qcom: Add MSM8998 Multimedia Clock Controller (MMCC) driver")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Link: https://lore.kernel.org/r/20230531-topic-8998_mmssclk-v3-5-ba1b1fd9ee75@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-msm8998.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/mmcc-msm8998.c b/drivers/clk/qcom/mmcc-msm8998.c
+index 0702a9f00cc1b..e5a72c2f080f8 100644
+--- a/drivers/clk/qcom/mmcc-msm8998.c
++++ b/drivers/clk/qcom/mmcc-msm8998.c
+@@ -2653,11 +2653,13 @@ static struct gdsc camss_cpp_gdsc = {
+ static struct gdsc bimc_smmu_gdsc = {
+ .gdscr = 0xe020,
+ .gds_hw_ctrl = 0xe024,
++ .cxcs = (unsigned int []){ 0xe008 },
++ .cxc_count = 1,
+ .pd = {
+ .name = "bimc_smmu",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
+- .flags = HW_CTRL | ALWAYS_ON,
++ .flags = VOTABLE,
+ };
+
+ static struct clk_regmap *mmcc_msm8998_clocks[] = {
+--
+2.42.0
+
--- /dev/null
+From b18f5b915347d5fadb4b404287620a57ea39fbc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 10:03:17 +0200
+Subject: clk: renesas: rcar-gen3: Extend SDnH divider table
+
+From: Dirk Behme <dirk.behme@de.bosch.com>
+
+[ Upstream commit d5252d9697a3e7007c741e9c103073868955a304 ]
+
+The clock dividers might be used with clock stop bit enabled or not.
+Current tables only support recommended values from the datasheet. This
+might result in warnings like below because no valid clock divider is
+found. Resulting in a 0 divider.
+
+There are Renesas ARM Trusted Firmware version out there which e.g.
+configure 0x201 (shifted logical right by 2: 0x80) and with this match
+the added { STPnHCK | 0, 1 }:
+
+https://github.com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.3/drivers/renesas/rcar/emmc/emmc_init.c#L108
+
+------------[ cut here ]------------
+sd1h: Zero divisor and CLK_DIVIDER_ALLOW_ZERO not set
+WARNING: CPU: 1 PID: 1 at drivers/clk/clk-divider.c:141 divider_recalc_rate+0x48/0x70
+Modules linked in:
+CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.1.52 #1
+Hardware name: Custom board based on r8a7796 (DT)
+pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : divider_recalc_rate+0x48/0x70
+...
+------------[ cut here ]------------
+
+Fixes: bb6d3fa98a41 ("clk: renesas: rcar-gen3: Switch to new SD clock handling")
+Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
+[wsa: extended the table to 5 entries, added comments, reword commit message a little]
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Tested-by: Dirk Behme <dirk.behme@de.bosch.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230928080317.28224-1-wsa+renesas@sang-engineering.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rcar-cpg-lib.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/renesas/rcar-cpg-lib.c b/drivers/clk/renesas/rcar-cpg-lib.c
+index e2e0447de1901..5a15f8788b922 100644
+--- a/drivers/clk/renesas/rcar-cpg-lib.c
++++ b/drivers/clk/renesas/rcar-cpg-lib.c
+@@ -70,8 +70,21 @@ void cpg_simple_notifier_register(struct raw_notifier_head *notifiers,
+ #define STPnHCK BIT(9 - SDnSRCFC_SHIFT)
+
+ static const struct clk_div_table cpg_sdh_div_table[] = {
++ /*
++ * These values are recommended by the datasheet. Because they come
++ * first, Linux will only use these.
++ */
+ { 0, 1 }, { 1, 2 }, { STPnHCK | 2, 4 }, { STPnHCK | 3, 8 },
+- { STPnHCK | 4, 16 }, { 0, 0 },
++ { STPnHCK | 4, 16 },
++ /*
++ * These values are not recommended because STPnHCK is wrong. But they
++ * have been seen because of broken firmware. So, we support reading
++ * them but Linux will sanitize them when initializing through
++ * recalc_rate.
++ */
++ { STPnHCK | 0, 1 }, { STPnHCK | 1, 2 }, { 2, 4 }, { 3, 8 }, { 4, 16 },
++ /* Sentinel */
++ { 0, 0 }
+ };
+
+ struct clk * __init cpg_sdh_clk_register(const char *name,
+--
+2.42.0
+
--- /dev/null
+From 47e0d008b7b0261044fbba5611cc011ad62a9bb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 08:38:52 +0300
+Subject: clk: renesas: rzg2l: Fix computation formula
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit a2b23159499efd36b2d63b3c4534075d12ddc97a ]
+
+According to the hardware manual for RZ/G2L
+(r01uh0914ej0130-rzg2l-rzg2lc.pdf), the computation formula for PLL rate
+is as follows:
+
+ Fout = ((m + k/65536) * Fin) / (p * 2^s)
+
+and k has values in the range [-32768, 32767]. Dividing k by 65536 with
+integer arithmetic gives zero all the time, causing slight differences
+b/w what has been set vs. what is displayed. Thus, get rid of this and
+decompose the formula before dividing k by 65536.
+
+Fixes: ef3c613ccd68a ("clk: renesas: Add CPG core wrapper for RZ/G2L SoC")
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230929053915.1530607-6-claudiu.beznea@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index 917ce62d8c397..84767cfc1e739 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -43,7 +43,7 @@
+ #define GET_SHIFT(val) ((val >> 12) & 0xff)
+ #define GET_WIDTH(val) ((val >> 8) & 0xf)
+
+-#define KDIV(val) FIELD_GET(GENMASK(31, 16), val)
++#define KDIV(val) ((s16)FIELD_GET(GENMASK(31, 16), val))
+ #define MDIV(val) FIELD_GET(GENMASK(15, 6), val)
+ #define PDIV(val) FIELD_GET(GENMASK(5, 0), val)
+ #define SDIV(val) FIELD_GET(GENMASK(2, 0), val)
+@@ -699,18 +699,18 @@ static unsigned long rzg2l_cpg_pll_clk_recalc_rate(struct clk_hw *hw,
+ struct pll_clk *pll_clk = to_pll(hw);
+ struct rzg2l_cpg_priv *priv = pll_clk->priv;
+ unsigned int val1, val2;
+- unsigned int mult = 1;
+- unsigned int div = 1;
++ u64 rate;
+
+ if (pll_clk->type != CLK_TYPE_SAM_PLL)
+ return parent_rate;
+
+ val1 = readl(priv->base + GET_REG_SAMPLL_CLK1(pll_clk->conf));
+ val2 = readl(priv->base + GET_REG_SAMPLL_CLK2(pll_clk->conf));
+- mult = MDIV(val1) + KDIV(val1) / 65536;
+- div = PDIV(val1) << SDIV(val2);
+
+- return DIV_ROUND_CLOSEST_ULL((u64)parent_rate * mult, div);
++ rate = mul_u64_u32_shr(parent_rate, (MDIV(val1) << 16) + KDIV(val1),
++ 16 + SDIV(val2));
++
++ return DIV_ROUND_CLOSEST_ULL(rate, PDIV(val1));
+ }
+
+ static const struct clk_ops rzg2l_cpg_pll_ops = {
+--
+2.42.0
+
--- /dev/null
+From 09fec353ff9e99416bde5324c4898d3e84e42dc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 08:38:50 +0300
+Subject: clk: renesas: rzg2l: Lock around writes to mux register
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit d2692ed490e680a41401cef879adebcfafb4298f ]
+
+The SD MUX output (SD0) is further divided by 4 in G2{L,UL}. The
+divided clock is SD0_DIV4. SD0_DIV4 is registered with
+CLK_SET_RATE_PARENT which means a rate request for it is propagated to
+the MUX and could reach rzg2l_cpg_sd_clk_mux_set_parent() concurrently
+with the users of SD0.
+Add proper locking to avoid concurrent accesses on SD MUX set rate
+registers.
+
+Fixes: eaff33646f4cb ("clk: renesas: rzg2l: Add SDHI clk mux support")
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230929053915.1530607-4-claudiu.beznea@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 23 +++++++++++++----------
+ drivers/clk/renesas/rzg2l-cpg.h | 2 +-
+ 2 files changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index 85e49f4eb6a50..a703a3b35e642 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -193,6 +193,7 @@ static int rzg2l_cpg_sd_clk_mux_set_parent(struct clk_hw *hw, u8 index)
+ u32 shift = GET_SHIFT(hwdata->conf);
+ const u32 clk_src_266 = 2;
+ u32 msk, val, bitmask;
++ unsigned long flags;
+ int ret;
+
+ /*
+@@ -208,23 +209,25 @@ static int rzg2l_cpg_sd_clk_mux_set_parent(struct clk_hw *hw, u8 index)
+ */
+ bitmask = (GENMASK(GET_WIDTH(hwdata->conf) - 1, 0) << shift) << 16;
+ msk = off ? CPG_CLKSTATUS_SELSDHI1_STS : CPG_CLKSTATUS_SELSDHI0_STS;
++ spin_lock_irqsave(&priv->rmw_lock, flags);
+ if (index != clk_src_266) {
+ writel(bitmask | ((clk_src_266 + 1) << shift), priv->base + off);
+
+- ret = readl_poll_timeout(priv->base + CPG_CLKSTATUS, val,
+- !(val & msk), 100,
+- CPG_SDHI_CLK_SWITCH_STATUS_TIMEOUT_US);
+- if (ret) {
+- dev_err(priv->dev, "failed to switch clk source\n");
+- return ret;
+- }
++ ret = readl_poll_timeout_atomic(priv->base + CPG_CLKSTATUS, val,
++ !(val & msk), 10,
++ CPG_SDHI_CLK_SWITCH_STATUS_TIMEOUT_US);
++ if (ret)
++ goto unlock;
+ }
+
+ writel(bitmask | ((index + 1) << shift), priv->base + off);
+
+- ret = readl_poll_timeout(priv->base + CPG_CLKSTATUS, val,
+- !(val & msk), 100,
+- CPG_SDHI_CLK_SWITCH_STATUS_TIMEOUT_US);
++ ret = readl_poll_timeout_atomic(priv->base + CPG_CLKSTATUS, val,
++ !(val & msk), 10,
++ CPG_SDHI_CLK_SWITCH_STATUS_TIMEOUT_US);
++unlock:
++ spin_unlock_irqrestore(&priv->rmw_lock, flags);
++
+ if (ret)
+ dev_err(priv->dev, "failed to switch clk source\n");
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.h b/drivers/clk/renesas/rzg2l-cpg.h
+index b33a3e79161b6..aefa53a900597 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.h
++++ b/drivers/clk/renesas/rzg2l-cpg.h
+@@ -43,7 +43,7 @@
+ #define CPG_CLKSTATUS_SELSDHI0_STS BIT(28)
+ #define CPG_CLKSTATUS_SELSDHI1_STS BIT(29)
+
+-#define CPG_SDHI_CLK_SWITCH_STATUS_TIMEOUT_US 20000
++#define CPG_SDHI_CLK_SWITCH_STATUS_TIMEOUT_US 200
+
+ /* n = 0/1/2 for PLL1/4/6 */
+ #define CPG_SAMPLL_CLK1(n) (0x04 + (16 * n))
+--
+2.42.0
+
--- /dev/null
+From 8795b4707208afa9edd1f9d4096af250ae1672a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 08:38:51 +0300
+Subject: clk: renesas: rzg2l: Trust value returned by hardware
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit bf51d3b2d048c312764a55d91d67a85ee5535e31 ]
+
+The onitial value of the CPG_PL2SDHI_DSEL bits 0..1 or 4..6 is 01b. The
+hardware user's manual (r01uh0914ej0130-rzg2l-rzg2lc.pdf) specifies that
+setting 0 is prohibited. Hence rzg2l_cpg_sd_clk_mux_get_parent() should
+just read CPG_PL2SDHI_DSEL, trust the value, and return the proper clock
+parent index based on the value read.
+
+Fixes: eaff33646f4cb ("clk: renesas: rzg2l: Add SDHI clk mux support")
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230929053915.1530607-5-claudiu.beznea@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index a703a3b35e642..f2fc14f60ca0b 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -242,14 +242,8 @@ static u8 rzg2l_cpg_sd_clk_mux_get_parent(struct clk_hw *hw)
+
+ val >>= GET_SHIFT(hwdata->conf);
+ val &= GENMASK(GET_WIDTH(hwdata->conf) - 1, 0);
+- if (val) {
+- val--;
+- } else {
+- /* Prohibited clk source, change it to 533 MHz(reset value) */
+- rzg2l_cpg_sd_clk_mux_set_parent(hw, 0);
+- }
+
+- return val;
++ return val ? val - 1 : 0;
+ }
+
+ static const struct clk_ops rzg2l_cpg_sd_clk_mux_ops = {
+--
+2.42.0
+
--- /dev/null
+From c1efb53774fcd50151fa71ad6e740e94cade0e98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 07:51:33 +0300
+Subject: clk: renesas: rzg2l: Use FIELD_GET() for PLL register fields
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit 72977f07b035e488c3f1928832a1616c6cae7278 ]
+
+Use FIELD_GET() for PLL register fields. This is its purpose.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230912045157.177966-14-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Stable-dep-of: a2b23159499e ("clk: renesas: rzg2l: Fix computation formula")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index f2fc14f60ca0b..917ce62d8c397 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -11,6 +11,7 @@
+ * Copyright (C) 2015 Renesas Electronics Corp.
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/clk-provider.h>
+ #include <linux/clk/renesas.h>
+@@ -39,14 +40,13 @@
+ #define WARN_DEBUG(x) do { } while (0)
+ #endif
+
+-#define DIV_RSMASK(v, s, m) ((v >> s) & m)
+ #define GET_SHIFT(val) ((val >> 12) & 0xff)
+ #define GET_WIDTH(val) ((val >> 8) & 0xf)
+
+-#define KDIV(val) DIV_RSMASK(val, 16, 0xffff)
+-#define MDIV(val) DIV_RSMASK(val, 6, 0x3ff)
+-#define PDIV(val) DIV_RSMASK(val, 0, 0x3f)
+-#define SDIV(val) DIV_RSMASK(val, 0, 0x7)
++#define KDIV(val) FIELD_GET(GENMASK(31, 16), val)
++#define MDIV(val) FIELD_GET(GENMASK(15, 6), val)
++#define PDIV(val) FIELD_GET(GENMASK(5, 0), val)
++#define SDIV(val) FIELD_GET(GENMASK(2, 0), val)
+
+ #define CLK_ON_R(reg) (reg)
+ #define CLK_MON_R(reg) (0x180 + (reg))
+--
+2.42.0
+
--- /dev/null
+From 535e0f8b6c92332d5326e1b6db81d54c5521bb13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 08:38:49 +0300
+Subject: clk: renesas: rzg2l: Wait for status bit of SD mux before continuing
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit 549f4ae2601f968e2474c6031fb4799468882f64 ]
+
+The hardware user manual for RZ/G2L (r01uh0914ej0130-rzg2l-rzg2lc.pdf,
+chapter 7.4.7 Procedure for Switching Clocks by the Dynamic Switching
+Frequency Selectors) specifies that we need to check CPG_PL2SDHI_DSEL
+for SD clock switching status.
+
+Fixes: eaff33646f4cb ("clk: renesas: rzg2l: Add SDHI clk mux support")
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230929053915.1530607-3-claudiu.beznea@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index 2c877576c5729..85e49f4eb6a50 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -192,7 +192,8 @@ static int rzg2l_cpg_sd_clk_mux_set_parent(struct clk_hw *hw, u8 index)
+ u32 off = GET_REG_OFFSET(hwdata->conf);
+ u32 shift = GET_SHIFT(hwdata->conf);
+ const u32 clk_src_266 = 2;
+- u32 bitmask;
++ u32 msk, val, bitmask;
++ int ret;
+
+ /*
+ * As per the HW manual, we should not directly switch from 533 MHz to
+@@ -206,14 +207,10 @@ static int rzg2l_cpg_sd_clk_mux_set_parent(struct clk_hw *hw, u8 index)
+ * the index to value mapping is done by adding 1 to the index.
+ */
+ bitmask = (GENMASK(GET_WIDTH(hwdata->conf) - 1, 0) << shift) << 16;
++ msk = off ? CPG_CLKSTATUS_SELSDHI1_STS : CPG_CLKSTATUS_SELSDHI0_STS;
+ if (index != clk_src_266) {
+- u32 msk, val;
+- int ret;
+-
+ writel(bitmask | ((clk_src_266 + 1) << shift), priv->base + off);
+
+- msk = off ? CPG_CLKSTATUS_SELSDHI1_STS : CPG_CLKSTATUS_SELSDHI0_STS;
+-
+ ret = readl_poll_timeout(priv->base + CPG_CLKSTATUS, val,
+ !(val & msk), 100,
+ CPG_SDHI_CLK_SWITCH_STATUS_TIMEOUT_US);
+@@ -225,7 +222,13 @@ static int rzg2l_cpg_sd_clk_mux_set_parent(struct clk_hw *hw, u8 index)
+
+ writel(bitmask | ((index + 1) << shift), priv->base + off);
+
+- return 0;
++ ret = readl_poll_timeout(priv->base + CPG_CLKSTATUS, val,
++ !(val & msk), 100,
++ CPG_SDHI_CLK_SWITCH_STATUS_TIMEOUT_US);
++ if (ret)
++ dev_err(priv->dev, "failed to switch clk source\n");
++
++ return ret;
+ }
+
+ static u8 rzg2l_cpg_sd_clk_mux_get_parent(struct clk_hw *hw)
+--
+2.42.0
+
--- /dev/null
+From 616b1c8e9d9a3e955fc6d6439e9fd7c1e745ac8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 20:36:00 +0100
+Subject: clk: scmi: Free scmi_clk allocated when the clocks with invalid info
+ are skipped
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 3537a75e73f3420614a358d0c8b390ea483cc87d ]
+
+Add the missing devm_kfree() when we skip the clocks with invalid or
+missing information from the firmware.
+
+Cc: Cristian Marussi <cristian.marussi@arm.com>
+Cc: Michael Turquette <mturquette@baylibre.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: linux-clk@vger.kernel.org
+Fixes: 6d6a1d82eaef ("clk: add support for clocks provided by SCMI")
+Link: https://lore.kernel.org/r/20231004193600.66232-1-sudeep.holla@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-scmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c
+index 2c7a830ce3080..fdec715c9ba9b 100644
+--- a/drivers/clk/clk-scmi.c
++++ b/drivers/clk/clk-scmi.c
+@@ -213,6 +213,7 @@ static int scmi_clocks_probe(struct scmi_device *sdev)
+ sclk->info = scmi_proto_clk_ops->info_get(ph, idx);
+ if (!sclk->info) {
+ dev_dbg(dev, "invalid clock info for idx %d\n", idx);
++ devm_kfree(dev, sclk);
+ continue;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 2d7e3230e7ebfbf5d1f23dfc10f0c5e63a815ada Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Nov 2022 19:11:46 +0100
+Subject: clk: ti: change ti_clk_register[_omap_hw]() API
+
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+
+[ Upstream commit 3400d546a741a2b2001d88e7fa29110d45a3930d ]
+
+The ti_clk_register() and ti_clk_register_omap_hw() functions are always
+called with the parameter of type "struct device" set to NULL, since the
+functions from which they are called always have a parameter of type
+"struct device_node". Replacing "struct device" type parameter with
+"struct device_node" will allow you to register a TI clock to the common
+clock framework by taking advantage of the facilities provided by the
+"struct device_node" type. Further, adding the "of_" prefix to the name
+of these functions explicitly binds them to the "struct device_node"
+type.
+
+The patch has been tested on a Beaglebone board.
+
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Tested-by: Tony Lindgren <tony@atomide.com>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20221113181147.1626585-1-dario.binacchi@amarulasolutions.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Stable-dep-of: 7af5b9eadd64 ("clk: ti: fix double free in of_ti_divider_clk_setup()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/apll.c | 4 ++--
+ drivers/clk/ti/clk-dra7-atl.c | 2 +-
+ drivers/clk/ti/clk.c | 34 ++++++++++++++++------------------
+ drivers/clk/ti/clkctrl.c | 4 ++--
+ drivers/clk/ti/clock.h | 10 +++++-----
+ drivers/clk/ti/composite.c | 2 +-
+ drivers/clk/ti/divider.c | 2 +-
+ drivers/clk/ti/dpll.c | 4 ++--
+ drivers/clk/ti/fixed-factor.c | 2 +-
+ drivers/clk/ti/gate.c | 6 +++---
+ drivers/clk/ti/interface.c | 7 ++++---
+ drivers/clk/ti/mux.c | 6 +++---
+ 12 files changed, 41 insertions(+), 42 deletions(-)
+
+diff --git a/drivers/clk/ti/apll.c b/drivers/clk/ti/apll.c
+index dd0709c9c2498..93183287c58db 100644
+--- a/drivers/clk/ti/apll.c
++++ b/drivers/clk/ti/apll.c
+@@ -160,7 +160,7 @@ static void __init omap_clk_register_apll(void *user,
+ ad->clk_bypass = __clk_get_hw(clk);
+
+ name = ti_dt_clk_name(node);
+- clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
++ clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
+ if (!IS_ERR(clk)) {
+ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ kfree(init->parent_names);
+@@ -400,7 +400,7 @@ static void __init of_omap2_apll_setup(struct device_node *node)
+ goto cleanup;
+
+ name = ti_dt_clk_name(node);
+- clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
++ clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
+ if (!IS_ERR(clk)) {
+ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ kfree(init);
+diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
+index ff4d6a9516813..1c576599f6dbd 100644
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -197,7 +197,7 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
+
+ init.parent_names = parent_names;
+
+- clk = ti_clk_register(NULL, &clk_hw->hw, name);
++ clk = of_ti_clk_register(node, &clk_hw->hw, name);
+
+ if (!IS_ERR(clk)) {
+ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c
+index 1dc2f15fb75b2..269355010cdce 100644
+--- a/drivers/clk/ti/clk.c
++++ b/drivers/clk/ti/clk.c
+@@ -475,7 +475,7 @@ void __init ti_clk_add_aliases(void)
+ clkspec.np = np;
+ clk = of_clk_get_from_provider(&clkspec);
+
+- ti_clk_add_alias(NULL, clk, ti_dt_clk_name(np));
++ ti_clk_add_alias(clk, ti_dt_clk_name(np));
+ }
+ }
+
+@@ -528,7 +528,6 @@ void omap2_clk_enable_init_clocks(const char **clk_names, u8 num_clocks)
+
+ /**
+ * ti_clk_add_alias - add a clock alias for a TI clock
+- * @dev: device alias for this clock
+ * @clk: clock handle to create alias for
+ * @con: connection ID for this clock
+ *
+@@ -536,7 +535,7 @@ void omap2_clk_enable_init_clocks(const char **clk_names, u8 num_clocks)
+ * and assigns the data to it. Returns 0 if successful, negative error
+ * value otherwise.
+ */
+-int ti_clk_add_alias(struct device *dev, struct clk *clk, const char *con)
++int ti_clk_add_alias(struct clk *clk, const char *con)
+ {
+ struct clk_lookup *cl;
+
+@@ -550,8 +549,6 @@ int ti_clk_add_alias(struct device *dev, struct clk *clk, const char *con)
+ if (!cl)
+ return -ENOMEM;
+
+- if (dev)
+- cl->dev_id = dev_name(dev);
+ cl->con_id = con;
+ cl->clk = clk;
+
+@@ -561,8 +558,8 @@ int ti_clk_add_alias(struct device *dev, struct clk *clk, const char *con)
+ }
+
+ /**
+- * ti_clk_register - register a TI clock to the common clock framework
+- * @dev: device for this clock
++ * of_ti_clk_register - register a TI clock to the common clock framework
++ * @node: device node for this clock
+ * @hw: hardware clock handle
+ * @con: connection ID for this clock
+ *
+@@ -570,17 +567,18 @@ int ti_clk_add_alias(struct device *dev, struct clk *clk, const char *con)
+ * alias for it. Returns a handle to the registered clock if successful,
+ * ERR_PTR value in failure.
+ */
+-struct clk *ti_clk_register(struct device *dev, struct clk_hw *hw,
+- const char *con)
++struct clk *of_ti_clk_register(struct device_node *node, struct clk_hw *hw,
++ const char *con)
+ {
+ struct clk *clk;
+ int ret;
+
+- clk = clk_register(dev, hw);
+- if (IS_ERR(clk))
+- return clk;
++ ret = of_clk_hw_register(node, hw);
++ if (ret)
++ return ERR_PTR(ret);
+
+- ret = ti_clk_add_alias(dev, clk, con);
++ clk = hw->clk;
++ ret = ti_clk_add_alias(clk, con);
+ if (ret) {
+ clk_unregister(clk);
+ return ERR_PTR(ret);
+@@ -590,8 +588,8 @@ struct clk *ti_clk_register(struct device *dev, struct clk_hw *hw,
+ }
+
+ /**
+- * ti_clk_register_omap_hw - register a clk_hw_omap to the clock framework
+- * @dev: device for this clock
++ * of_ti_clk_register_omap_hw - register a clk_hw_omap to the clock framework
++ * @node: device node for this clock
+ * @hw: hardware clock handle
+ * @con: connection ID for this clock
+ *
+@@ -600,13 +598,13 @@ struct clk *ti_clk_register(struct device *dev, struct clk_hw *hw,
+ * Returns a handle to the registered clock if successful, ERR_PTR value
+ * in failure.
+ */
+-struct clk *ti_clk_register_omap_hw(struct device *dev, struct clk_hw *hw,
+- const char *con)
++struct clk *of_ti_clk_register_omap_hw(struct device_node *node,
++ struct clk_hw *hw, const char *con)
+ {
+ struct clk *clk;
+ struct clk_hw_omap *oclk;
+
+- clk = ti_clk_register(dev, hw, con);
++ clk = of_ti_clk_register(node, hw, con);
+ if (IS_ERR(clk))
+ return clk;
+
+diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
+index 57611bfb299c1..87e5624789ef6 100644
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -308,7 +308,7 @@ _ti_clkctrl_clk_register(struct omap_clkctrl_provider *provider,
+ init.ops = ops;
+ init.flags = 0;
+
+- clk = ti_clk_register(NULL, clk_hw, init.name);
++ clk = of_ti_clk_register(node, clk_hw, init.name);
+ if (IS_ERR_OR_NULL(clk)) {
+ ret = -EINVAL;
+ goto cleanup;
+@@ -689,7 +689,7 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node)
+ init.ops = &omap4_clkctrl_clk_ops;
+ hw->hw.init = &init;
+
+- clk = ti_clk_register_omap_hw(NULL, &hw->hw, init.name);
++ clk = of_ti_clk_register_omap_hw(node, &hw->hw, init.name);
+ if (IS_ERR_OR_NULL(clk))
+ goto cleanup;
+
+diff --git a/drivers/clk/ti/clock.h b/drivers/clk/ti/clock.h
+index 37ab53339a9be..16a9f7c2280a5 100644
+--- a/drivers/clk/ti/clock.h
++++ b/drivers/clk/ti/clock.h
+@@ -199,12 +199,12 @@ extern const struct omap_clkctrl_data dm816_clkctrl_data[];
+
+ typedef void (*ti_of_clk_init_cb_t)(void *, struct device_node *);
+
+-struct clk *ti_clk_register(struct device *dev, struct clk_hw *hw,
+- const char *con);
+-struct clk *ti_clk_register_omap_hw(struct device *dev, struct clk_hw *hw,
+- const char *con);
++struct clk *of_ti_clk_register(struct device_node *node, struct clk_hw *hw,
++ const char *con);
++struct clk *of_ti_clk_register_omap_hw(struct device_node *node,
++ struct clk_hw *hw, const char *con);
+ const char *ti_dt_clk_name(struct device_node *np);
+-int ti_clk_add_alias(struct device *dev, struct clk *clk, const char *con);
++int ti_clk_add_alias(struct clk *clk, const char *con);
+ void ti_clk_add_aliases(void);
+
+ void ti_clk_latch(struct clk_omap_reg *reg, s8 shift);
+diff --git a/drivers/clk/ti/composite.c b/drivers/clk/ti/composite.c
+index 77b771dd050a9..b85382c370f7e 100644
+--- a/drivers/clk/ti/composite.c
++++ b/drivers/clk/ti/composite.c
+@@ -176,7 +176,7 @@ static void __init _register_composite(void *user,
+ &ti_composite_gate_ops, 0);
+
+ if (!IS_ERR(clk)) {
+- ret = ti_clk_add_alias(NULL, clk, name);
++ ret = ti_clk_add_alias(clk, name);
+ if (ret) {
+ clk_unregister(clk);
+ goto cleanup;
+diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
+index 488d3da60c317..768a1f3398b47 100644
+--- a/drivers/clk/ti/divider.c
++++ b/drivers/clk/ti/divider.c
+@@ -326,7 +326,7 @@ static struct clk *_register_divider(struct device_node *node,
+ div->hw.init = &init;
+
+ /* register the clock */
+- clk = ti_clk_register(NULL, &div->hw, name);
++ clk = of_ti_clk_register(node, &div->hw, name);
+
+ if (IS_ERR(clk))
+ kfree(div);
+diff --git a/drivers/clk/ti/dpll.c b/drivers/clk/ti/dpll.c
+index 8ed43bc6b7cc8..403ec81f561b6 100644
+--- a/drivers/clk/ti/dpll.c
++++ b/drivers/clk/ti/dpll.c
+@@ -187,7 +187,7 @@ static void __init _register_dpll(void *user,
+
+ /* register the clock */
+ name = ti_dt_clk_name(node);
+- clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
++ clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
+
+ if (!IS_ERR(clk)) {
+ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+@@ -259,7 +259,7 @@ static void _register_dpll_x2(struct device_node *node,
+ #endif
+
+ /* register the clock */
+- clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
++ clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
+
+ if (IS_ERR(clk))
+ kfree(clk_hw);
+diff --git a/drivers/clk/ti/fixed-factor.c b/drivers/clk/ti/fixed-factor.c
+index c80cee0f5d3d7..c102c53201686 100644
+--- a/drivers/clk/ti/fixed-factor.c
++++ b/drivers/clk/ti/fixed-factor.c
+@@ -54,7 +54,7 @@ static void __init of_ti_fixed_factor_clk_setup(struct device_node *node)
+ if (!IS_ERR(clk)) {
+ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ of_ti_clk_autoidle_setup(node);
+- ti_clk_add_alias(NULL, clk, clk_name);
++ ti_clk_add_alias(clk, clk_name);
+ }
+ }
+ CLK_OF_DECLARE(ti_fixed_factor_clk, "ti,fixed-factor-clock",
+diff --git a/drivers/clk/ti/gate.c b/drivers/clk/ti/gate.c
+index 307702921431d..8e477d50d0fdb 100644
+--- a/drivers/clk/ti/gate.c
++++ b/drivers/clk/ti/gate.c
+@@ -85,7 +85,7 @@ static int omap36xx_gate_clk_enable_with_hsdiv_restore(struct clk_hw *hw)
+ return ret;
+ }
+
+-static struct clk *_register_gate(struct device *dev, const char *name,
++static struct clk *_register_gate(struct device_node *node, const char *name,
+ const char *parent_name, unsigned long flags,
+ struct clk_omap_reg *reg, u8 bit_idx,
+ u8 clk_gate_flags, const struct clk_ops *ops,
+@@ -115,7 +115,7 @@ static struct clk *_register_gate(struct device *dev, const char *name,
+
+ init.flags = flags;
+
+- clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
++ clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
+
+ if (IS_ERR(clk))
+ kfree(clk_hw);
+@@ -158,7 +158,7 @@ static void __init _of_ti_gate_clk_setup(struct device_node *node,
+ clk_gate_flags |= INVERT_ENABLE;
+
+ name = ti_dt_clk_name(node);
+- clk = _register_gate(NULL, name, parent_name, flags, ®,
++ clk = _register_gate(node, name, parent_name, flags, ®,
+ enable_bit, clk_gate_flags, ops, hw_ops);
+
+ if (!IS_ERR(clk))
+diff --git a/drivers/clk/ti/interface.c b/drivers/clk/ti/interface.c
+index f47beeea211e8..172301c646f85 100644
+--- a/drivers/clk/ti/interface.c
++++ b/drivers/clk/ti/interface.c
+@@ -24,7 +24,8 @@ static const struct clk_ops ti_interface_clk_ops = {
+ .is_enabled = &omap2_dflt_clk_is_enabled,
+ };
+
+-static struct clk *_register_interface(struct device *dev, const char *name,
++static struct clk *_register_interface(struct device_node *node,
++ const char *name,
+ const char *parent_name,
+ struct clk_omap_reg *reg, u8 bit_idx,
+ const struct clk_hw_omap_ops *ops)
+@@ -49,7 +50,7 @@ static struct clk *_register_interface(struct device *dev, const char *name,
+ init.num_parents = 1;
+ init.parent_names = &parent_name;
+
+- clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
++ clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
+
+ if (IS_ERR(clk))
+ kfree(clk_hw);
+@@ -80,7 +81,7 @@ static void __init _of_ti_interface_clk_setup(struct device_node *node,
+ }
+
+ name = ti_dt_clk_name(node);
+- clk = _register_interface(NULL, name, parent_name, ®,
++ clk = _register_interface(node, name, parent_name, ®,
+ enable_bit, ops);
+
+ if (!IS_ERR(clk))
+diff --git a/drivers/clk/ti/mux.c b/drivers/clk/ti/mux.c
+index 46b45b3e8319a..1ebafa386be61 100644
+--- a/drivers/clk/ti/mux.c
++++ b/drivers/clk/ti/mux.c
+@@ -118,7 +118,7 @@ const struct clk_ops ti_clk_mux_ops = {
+ .restore_context = clk_mux_restore_context,
+ };
+
+-static struct clk *_register_mux(struct device *dev, const char *name,
++static struct clk *_register_mux(struct device_node *node, const char *name,
+ const char * const *parent_names,
+ u8 num_parents, unsigned long flags,
+ struct clk_omap_reg *reg, u8 shift, u32 mask,
+@@ -148,7 +148,7 @@ static struct clk *_register_mux(struct device *dev, const char *name,
+ mux->table = table;
+ mux->hw.init = &init;
+
+- clk = ti_clk_register(dev, &mux->hw, name);
++ clk = of_ti_clk_register(node, &mux->hw, name);
+
+ if (IS_ERR(clk))
+ kfree(mux);
+@@ -207,7 +207,7 @@ static void of_mux_clk_setup(struct device_node *node)
+ mask = (1 << fls(mask)) - 1;
+
+ name = ti_dt_clk_name(node);
+- clk = _register_mux(NULL, name, parent_names, num_parents,
++ clk = _register_mux(node, name, parent_names, num_parents,
+ flags, ®, shift, mask, latch, clk_mux_flags,
+ NULL);
+
+--
+2.42.0
+
--- /dev/null
+From f9d6c7c198515c86f7069b6c280dddd40e69bd90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Oct 2023 10:04:36 +0300
+Subject: clk: ti: fix double free in of_ti_divider_clk_setup()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 7af5b9eadd64c9e02a71f97c45bcdf3b64841f6b ]
+
+The "div" pointer is freed in _register_divider() and again in
+of_ti_divider_clk_setup(). Delete the free in _register_divider()
+
+Fixes: fbbc18591585 ("clk: ti: divider: cleanup _register_divider and ti_clk_get_div_table")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/6d36eeec-6c8a-4f11-a579-aa3cd7c38749@moroto.mountain
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/divider.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
+index 768a1f3398b47..5d5bb123ba949 100644
+--- a/drivers/clk/ti/divider.c
++++ b/drivers/clk/ti/divider.c
+@@ -309,7 +309,6 @@ static struct clk *_register_divider(struct device_node *node,
+ u32 flags,
+ struct clk_omap_divider *div)
+ {
+- struct clk *clk;
+ struct clk_init_data init;
+ const char *parent_name;
+ const char *name;
+@@ -326,12 +325,7 @@ static struct clk *_register_divider(struct device_node *node,
+ div->hw.init = &init;
+
+ /* register the clock */
+- clk = of_ti_clk_register(node, &div->hw, name);
+-
+- if (IS_ERR(clk))
+- kfree(div);
+-
+- return clk;
++ return of_ti_clk_register(node, &div->hw, name);
+ }
+
+ int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div,
+--
+2.42.0
+
--- /dev/null
+From 0d84fac153bc692d3f88f0857e5f94a55ecf5a46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 16:31:27 +0100
+Subject: clocksource/drivers/arm_arch_timer: limit XGene-1 workaround
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 851354cbd12bb9500909733c3d4054306f61df87 ]
+
+The AppliedMicro XGene-1 CPU has an erratum where the timer condition
+would only consider TVAL, not CVAL. We currently apply a workaround when
+seeing the PartNum field of MIDR_EL1 being 0x000, under the assumption
+that this would match only the XGene-1 CPU model.
+However even the Ampere eMAG (aka XGene-3) uses that same part number, and
+only differs in the "Variant" and "Revision" fields: XGene-1's MIDR is
+0x500f0000, our eMAG reports 0x503f0002. Experiments show the latter
+doesn't show the faulty behaviour.
+
+Increase the specificity of the check to only consider partnum 0x000 and
+variant 0x00, to exclude the Ampere eMAG.
+
+Fixes: 012f18850452 ("clocksource/drivers/arm_arch_timer: Work around broken CVAL implementations")
+Reported-by: Ross Burton <ross.burton@arm.com>
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
+Link: https://lore.kernel.org/r/20231016153127.116101-1-andre.przywara@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/cputype.h | 3 ++-
+ arch/arm64/kvm/guest.c | 2 +-
+ drivers/clocksource/arm_arch_timer.c | 5 +++--
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
+index 357932938b5ab..7dce9c0aa7836 100644
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -85,7 +85,8 @@
+ #define ARM_CPU_PART_NEOVERSE_N2 0xD49
+ #define ARM_CPU_PART_CORTEX_A78C 0xD4B
+
+-#define APM_CPU_PART_POTENZA 0x000
++#define APM_CPU_PART_XGENE 0x000
++#define APM_CPU_VAR_POTENZA 0x00
+
+ #define CAVIUM_CPU_PART_THUNDERX 0x0A1
+ #define CAVIUM_CPU_PART_THUNDERX_81XX 0x0A2
+diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
+index dd20b8688d230..f44ae09a51956 100644
+--- a/arch/arm64/kvm/guest.c
++++ b/arch/arm64/kvm/guest.c
+@@ -863,7 +863,7 @@ u32 __attribute_const__ kvm_target_cpu(void)
+ break;
+ case ARM_CPU_IMP_APM:
+ switch (part_number) {
+- case APM_CPU_PART_POTENZA:
++ case APM_CPU_PART_XGENE:
+ return KVM_ARM_TARGET_XGENE_POTENZA;
+ }
+ break;
+diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
+index 239c70ac120e8..fee1c4bf10214 100644
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -817,8 +817,9 @@ static u64 __arch_timer_check_delta(void)
+ * Note that TVAL is signed, thus has only 31 of its
+ * 32 bits to express magnitude.
+ */
+- MIDR_ALL_VERSIONS(MIDR_CPU_MODEL(ARM_CPU_IMP_APM,
+- APM_CPU_PART_POTENZA)),
++ MIDR_REV_RANGE(MIDR_CPU_MODEL(ARM_CPU_IMP_APM,
++ APM_CPU_PART_XGENE),
++ APM_CPU_VAR_POTENZA, 0x0, 0xf),
+ {},
+ };
+
+--
+2.42.0
+
--- /dev/null
+From 33ff29e3f486c62f8dbeaeee69cd7abef56172f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 18:12:37 +0530
+Subject: crypto: caam/jr - fix Chacha20 + Poly1305 self test failure
+
+From: Gaurav Jain <gaurav.jain@nxp.com>
+
+[ Upstream commit a8d3cdcc092fb2f2882acb6c20473a1be0ef4484 ]
+
+key buffer is not copied in chachapoly_setkey function,
+results in wrong output for encryption/decryption operation.
+
+fix this by memcpy the key in caam_ctx key arrary
+
+Fixes: d6bbd4eea243 ("crypto: caam/jr - add support for Chacha20 + Poly1305")
+Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caamalg.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index d3d8bb0a69900..e156238b4da90 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -566,7 +566,8 @@ static int chachapoly_setkey(struct crypto_aead *aead, const u8 *key,
+ if (keylen != CHACHA_KEY_SIZE + saltlen)
+ return -EINVAL;
+
+- ctx->cdata.key_virt = key;
++ memcpy(ctx->key, key, keylen);
++ ctx->cdata.key_virt = ctx->key;
+ ctx->cdata.keylen = keylen - saltlen;
+
+ return chachapoly_set_sh_desc(aead);
+--
+2.42.0
+
--- /dev/null
+From 64ad7ea4d2c92fa90ba77b8c86dbc401eba168b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 15:14:44 +0530
+Subject: crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure
+
+From: Gaurav Jain <gaurav.jain@nxp.com>
+
+[ Upstream commit 7b8c6aee0d5b864e70c0da82583f9862e374eaf3 ]
+
+key buffer is not copied in chachapoly_setkey function,
+results in wrong output for encryption/decryption operation.
+
+fix this by memcpy the key in caam_ctx key arrary
+
+Fixes: c10a53367901 ("crypto: caam/qi2 - add support for Chacha20 + Poly1305")
+Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caamalg_qi2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c
+index 4482cb145d051..56058d4992cc4 100644
+--- a/drivers/crypto/caam/caamalg_qi2.c
++++ b/drivers/crypto/caam/caamalg_qi2.c
+@@ -639,7 +639,8 @@ static int chachapoly_setkey(struct crypto_aead *aead, const u8 *key,
+ if (keylen != CHACHA_KEY_SIZE + saltlen)
+ return -EINVAL;
+
+- ctx->cdata.key_virt = key;
++ memcpy(ctx->key, key, keylen);
++ ctx->cdata.key_virt = ctx->key;
+ ctx->cdata.keylen = keylen - saltlen;
+
+ return chachapoly_set_sh_desc(aead);
+--
+2.42.0
+
--- /dev/null
+From bfc64c312f734086d0d775d16959553b74771d0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 20:24:39 +0100
+Subject: crypto: ccp - Name -1 return value as SEV_RET_NO_FW_CALL
+
+From: Peter Gonda <pgonda@google.com>
+
+[ Upstream commit efb339a83368ab25de1a18c0fdff85e01c13a1ea ]
+
+The PSP can return a "firmware error" code of -1 in circumstances where
+the PSP has not actually been called. To make this protocol unambiguous,
+name the value SEV_RET_NO_FW_CALL.
+
+ [ bp: Massage a bit. ]
+
+Signed-off-by: Peter Gonda <pgonda@google.com>
+Signed-off-by: Dionna Glaze <dionnaglaze@google.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20221207010210.2563293-2-dionnaglaze@google.com
+Stable-dep-of: db10cb9b5746 ("virt: sevguest: Fix passing a stack buffer as a scatterlist target")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/virt/coco/sev-guest.rst | 4 ++--
+ drivers/crypto/ccp/sev-dev.c | 8 +++++---
+ include/uapi/linux/psp-sev.h | 7 +++++++
+ 3 files changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/Documentation/virt/coco/sev-guest.rst b/Documentation/virt/coco/sev-guest.rst
+index bf593e88cfd9d..aa3e4c6a1f90c 100644
+--- a/Documentation/virt/coco/sev-guest.rst
++++ b/Documentation/virt/coco/sev-guest.rst
+@@ -40,8 +40,8 @@ along with a description:
+ The guest ioctl should be issued on a file descriptor of the /dev/sev-guest device.
+ The ioctl accepts struct snp_user_guest_request. The input and output structure is
+ specified through the req_data and resp_data field respectively. If the ioctl fails
+-to execute due to a firmware error, then fw_err code will be set otherwise the
+-fw_err will be set to 0x00000000000000ff.
++to execute due to a firmware error, then fw_err code will be set. Otherwise, fw_err
++will be set to 0x00000000ffffffff, i.e., the lower 32-bits are -1.
+
+ The firmware checks that the message sequence counter is one greater than
+ the guests message sequence counter. If guest driver fails to increment message
+diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
+index 3e583f0324874..b8e02c3a19610 100644
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -443,10 +443,10 @@ static int __sev_init_ex_locked(int *error)
+
+ static int __sev_platform_init_locked(int *error)
+ {
++ int rc = 0, psp_ret = SEV_RET_NO_FW_CALL;
+ struct psp_device *psp = psp_master;
+- struct sev_device *sev;
+- int rc = 0, psp_ret = -1;
+ int (*init_function)(int *error);
++ struct sev_device *sev;
+
+ if (!psp || !psp->sev_data)
+ return -ENODEV;
+@@ -474,9 +474,11 @@ static int __sev_platform_init_locked(int *error)
+ * initialization function should succeed by replacing the state
+ * with a reset state.
+ */
+- dev_err(sev->dev, "SEV: retrying INIT command because of SECURE_DATA_INVALID error. Retrying once to reset PSP SEV state.");
++ dev_err(sev->dev,
++"SEV: retrying INIT command because of SECURE_DATA_INVALID error. Retrying once to reset PSP SEV state.");
+ rc = init_function(&psp_ret);
+ }
++
+ if (error)
+ *error = psp_ret;
+
+diff --git a/include/uapi/linux/psp-sev.h b/include/uapi/linux/psp-sev.h
+index 91b4c63d5cbf4..1c9da485318f9 100644
+--- a/include/uapi/linux/psp-sev.h
++++ b/include/uapi/linux/psp-sev.h
+@@ -36,6 +36,13 @@ enum {
+ * SEV Firmware status code
+ */
+ typedef enum {
++ /*
++ * This error code is not in the SEV spec. Its purpose is to convey that
++ * there was an error that prevented the SEV firmware from being called.
++ * The SEV API error codes are 16 bits, so the -1 value will not overlap
++ * with possible values from the specification.
++ */
++ SEV_RET_NO_FW_CALL = -1,
+ SEV_RET_SUCCESS = 0,
+ SEV_RET_INVALID_PLATFORM_STATE,
+ SEV_RET_INVALID_GUEST_STATE,
+--
+2.42.0
+
--- /dev/null
+From a9f1d8b23ae79d99398002b2d44d17ceff0933a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Sep 2023 22:17:29 +0200
+Subject: crypto: hisilicon/hpre - Fix a erroneous check after snprintf()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit c977950146720abff14e46d8c53f5638b06a9182 ]
+
+This error handling looks really strange.
+Check if the string has been truncated instead.
+
+Fixes: 02ab994635eb ("crypto: hisilicon - Fixed some tiny bugs of HPRE")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index baf1faec7046f..2a4418f781a3f 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -1031,7 +1031,7 @@ static int hpre_cluster_debugfs_init(struct hisi_qm *qm)
+
+ for (i = 0; i < clusters_num; i++) {
+ ret = snprintf(buf, HPRE_DBGFS_VAL_MAX_LEN, "cluster%d", i);
+- if (ret < 0)
++ if (ret >= HPRE_DBGFS_VAL_MAX_LEN)
+ return -EINVAL;
+ tmp_d = debugfs_create_dir(buf, qm->debug.debug_root);
+
+--
+2.42.0
+
--- /dev/null
+From 47a17a3221709fe766d8ae3b4b3eec5edc55007e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Nov 2022 02:12:50 +0000
+Subject: crypto: hisilicon/qm - delete redundant null assignment operations
+
+From: Kai Ye <yekai13@huawei.com>
+
+[ Upstream commit 7bbbc9d81be588ae4fb28b5b202e4421dbfef197 ]
+
+There is no security data in the pointer. It is only a value transferred
+as a structure. It makes no sense to zero a variable that is on the stack.
+So not need to set the pointer to null.
+
+Signed-off-by: Kai Ye <yekai13@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 5831fc1fd4a5 ("crypto: hisilicon/qm - fix PF queue parameter issue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 07e1e39a5e378..a878a232ef5b5 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -1773,7 +1773,6 @@ static void dfx_regs_uninit(struct hisi_qm *qm,
+ dregs[i].regs = NULL;
+ }
+ kfree(dregs);
+- dregs = NULL;
+ }
+
+ /**
+--
+2.42.0
+
--- /dev/null
+From e4955edf3343ebb654db074930f1d827db36c06d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 16:57:22 +0800
+Subject: crypto: hisilicon/qm - fix PF queue parameter issue
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+[ Upstream commit 5831fc1fd4a578232fea708b82de0c666ed17153 ]
+
+If the queue isolation feature is enabled, the number of queues
+supported by the device changes. When PF is enabled using the
+current default number of queues, the default number of queues may
+be greater than the number supported by the device. As a result,
+the PF fails to be bound to the driver.
+
+After modification, if queue isolation feature is enabled, when
+the default queue parameter is greater than the number supported
+by the device, the number of enabled queues will be changed to
+the number supported by the device, so that the PF and driver
+can be properly bound.
+
+Fixes: 8bbecfb402f7 ("crypto: hisilicon/qm - add queue isolation support for Kunpeng930")
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 5 +++++
+ drivers/crypto/hisilicon/qm.c | 18 ++++++++++++------
+ drivers/crypto/hisilicon/qm_common.h | 1 -
+ drivers/crypto/hisilicon/sec2/sec_main.c | 5 +++++
+ drivers/crypto/hisilicon/zip/zip_main.c | 5 +++++
+ include/linux/hisi_acc_qm.h | 7 +++++++
+ 6 files changed, 34 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 5470920f37ee0..ff8a5f20a5df0 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -431,8 +431,11 @@ static u32 uacce_mode = UACCE_MODE_NOUACCE;
+ module_param_cb(uacce_mode, &hpre_uacce_mode_ops, &uacce_mode, 0444);
+ MODULE_PARM_DESC(uacce_mode, UACCE_MODE_DESC);
+
++static bool pf_q_num_flag;
+ static int pf_q_num_set(const char *val, const struct kernel_param *kp)
+ {
++ pf_q_num_flag = true;
++
+ return q_num_set(val, kp, PCI_DEVICE_ID_HUAWEI_HPRE_PF);
+ }
+
+@@ -1155,6 +1158,8 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ qm->qp_num = pf_q_num;
+ qm->debug.curr_qm_qp_num = pf_q_num;
+ qm->qm_list = &hpre_devices;
++ if (pf_q_num_flag)
++ set_bit(QM_MODULE_PARAM, &qm->misc_ctl);
+ }
+
+ ret = hisi_qm_init(qm);
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 35c59818b3e7f..a4a3895c74181 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -209,8 +209,6 @@
+ #define WAIT_PERIOD 20
+ #define REMOVE_WAIT_DELAY 10
+
+-#define QM_DRIVER_REMOVING 0
+-#define QM_RST_SCHED 1
+ #define QM_QOS_PARAM_NUM 2
+ #define QM_QOS_VAL_NUM 1
+ #define QM_QOS_BDF_PARAM_NUM 4
+@@ -2689,7 +2687,6 @@ static void hisi_qm_pre_init(struct hisi_qm *qm)
+ mutex_init(&qm->mailbox_lock);
+ init_rwsem(&qm->qps_lock);
+ qm->qp_in_used = 0;
+- qm->misc_ctl = false;
+ if (test_bit(QM_SUPPORT_RPM, &qm->caps)) {
+ if (!acpi_device_power_manageable(ACPI_COMPANION(&pdev->dev)))
+ dev_info(&pdev->dev, "_PS0 and _PR0 are not defined");
+@@ -4969,6 +4966,7 @@ static int qm_irqs_register(struct hisi_qm *qm)
+
+ static int qm_get_qp_num(struct hisi_qm *qm)
+ {
++ struct device *dev = &qm->pdev->dev;
+ bool is_db_isolation;
+
+ /* VF's qp_num assigned by PF in v2, and VF can get qp_num by vft. */
+@@ -4985,13 +4983,21 @@ static int qm_get_qp_num(struct hisi_qm *qm)
+ qm->max_qp_num = hisi_qm_get_hw_info(qm, qm_basic_info,
+ QM_FUNC_MAX_QP_CAP, is_db_isolation);
+
+- /* check if qp number is valid */
+- if (qm->qp_num > qm->max_qp_num) {
+- dev_err(&qm->pdev->dev, "qp num(%u) is more than max qp num(%u)!\n",
++ if (qm->qp_num <= qm->max_qp_num)
++ return 0;
++
++ if (test_bit(QM_MODULE_PARAM, &qm->misc_ctl)) {
++ /* Check whether the set qp number is valid */
++ dev_err(dev, "qp num(%u) is more than max qp num(%u)!\n",
+ qm->qp_num, qm->max_qp_num);
+ return -EINVAL;
+ }
+
++ dev_info(dev, "Default qp num(%u) is too big, reset it to Function's max qp num(%u)!\n",
++ qm->qp_num, qm->max_qp_num);
++ qm->qp_num = qm->max_qp_num;
++ qm->debug.curr_qm_qp_num = qm->qp_num;
++
+ return 0;
+ }
+
+diff --git a/drivers/crypto/hisilicon/qm_common.h b/drivers/crypto/hisilicon/qm_common.h
+index 1406a422d4551..8e36aa9c681be 100644
+--- a/drivers/crypto/hisilicon/qm_common.h
++++ b/drivers/crypto/hisilicon/qm_common.h
+@@ -4,7 +4,6 @@
+ #define QM_COMMON_H
+
+ #define QM_DBG_READ_LEN 256
+-#define QM_RESETTING 2
+
+ struct qm_cqe {
+ __le32 rsvd0;
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 5e056b75c468a..e384988bda917 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -312,8 +312,11 @@ static int sec_diff_regs_show(struct seq_file *s, void *unused)
+ }
+ DEFINE_SHOW_ATTRIBUTE(sec_diff_regs);
+
++static bool pf_q_num_flag;
+ static int sec_pf_q_num_set(const char *val, const struct kernel_param *kp)
+ {
++ pf_q_num_flag = true;
++
+ return q_num_set(val, kp, PCI_DEVICE_ID_HUAWEI_SEC_PF);
+ }
+
+@@ -1122,6 +1125,8 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ qm->qp_num = pf_q_num;
+ qm->debug.curr_qm_qp_num = pf_q_num;
+ qm->qm_list = &sec_devices;
++ if (pf_q_num_flag)
++ set_bit(QM_MODULE_PARAM, &qm->misc_ctl);
+ } else if (qm->fun_type == QM_HW_VF && qm->ver == QM_HW_V1) {
+ /*
+ * have no way to get qm configure in VM in v1 hardware,
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 1549bec3aea59..190b4fecfc747 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -365,8 +365,11 @@ static u32 uacce_mode = UACCE_MODE_NOUACCE;
+ module_param_cb(uacce_mode, &zip_uacce_mode_ops, &uacce_mode, 0444);
+ MODULE_PARM_DESC(uacce_mode, UACCE_MODE_DESC);
+
++static bool pf_q_num_flag;
+ static int pf_q_num_set(const char *val, const struct kernel_param *kp)
+ {
++ pf_q_num_flag = true;
++
+ return q_num_set(val, kp, PCI_DEVICE_ID_HUAWEI_ZIP_PF);
+ }
+
+@@ -1140,6 +1143,8 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ qm->qp_num = pf_q_num;
+ qm->debug.curr_qm_qp_num = pf_q_num;
+ qm->qm_list = &zip_devices;
++ if (pf_q_num_flag)
++ set_bit(QM_MODULE_PARAM, &qm->misc_ctl);
+ } else if (qm->fun_type == QM_HW_VF && qm->ver == QM_HW_V1) {
+ /*
+ * have no way to get qm configure in VM in v1 hardware,
+diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h
+index be3aedaa96dc1..41203ce27d64c 100644
+--- a/include/linux/hisi_acc_qm.h
++++ b/include/linux/hisi_acc_qm.h
+@@ -145,6 +145,13 @@ enum qm_vf_state {
+ QM_NOT_READY,
+ };
+
++enum qm_misc_ctl_bits {
++ QM_DRIVER_REMOVING = 0x0,
++ QM_RST_SCHED,
++ QM_RESETTING,
++ QM_MODULE_PARAM,
++};
++
+ enum qm_cap_bits {
+ QM_SUPPORT_DB_ISOLATION = 0x0,
+ QM_SUPPORT_FUNC_QOS,
+--
+2.42.0
+
--- /dev/null
+From 35aeafc58233579183b98cad7748fe5a1c50385a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Nov 2022 02:12:51 +0000
+Subject: crypto: hisilicon/qm - modify the process of regs dfx
+
+From: Kai Ye <yekai13@huawei.com>
+
+[ Upstream commit b40b62ed7b0ffe8eb2e6fe8bcfb47027c9a93e93 ]
+
+The last register logic and different register logic are combined.
+Use "u32" instead of 'int' in the regs function input parameter to
+simplify some checks.
+
+Signed-off-by: Kai Ye <yekai13@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 5831fc1fd4a5 ("crypto: hisilicon/qm - fix PF queue parameter issue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 7 +-
+ drivers/crypto/hisilicon/qm.c | 151 ++++++++++++----------
+ drivers/crypto/hisilicon/sec2/sec_main.c | 7 +-
+ drivers/crypto/hisilicon/zip/zip_main.c | 7 +-
+ include/linux/hisi_acc_qm.h | 8 +-
+ 5 files changed, 99 insertions(+), 81 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 2a4418f781a3f..5470920f37ee0 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -1101,8 +1101,7 @@ static int hpre_debugfs_init(struct hisi_qm *qm)
+
+ qm->debug.sqe_mask_offset = HPRE_SQE_MASK_OFFSET;
+ qm->debug.sqe_mask_len = HPRE_SQE_MASK_LEN;
+- ret = hisi_qm_diff_regs_init(qm, hpre_diff_regs,
+- ARRAY_SIZE(hpre_diff_regs));
++ ret = hisi_qm_regs_debugfs_init(qm, hpre_diff_regs, ARRAY_SIZE(hpre_diff_regs));
+ if (ret) {
+ dev_warn(dev, "Failed to init HPRE diff regs!\n");
+ goto debugfs_remove;
+@@ -1121,7 +1120,7 @@ static int hpre_debugfs_init(struct hisi_qm *qm)
+ return 0;
+
+ failed_to_create:
+- hisi_qm_diff_regs_uninit(qm, ARRAY_SIZE(hpre_diff_regs));
++ hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(hpre_diff_regs));
+ debugfs_remove:
+ debugfs_remove_recursive(qm->debug.debug_root);
+ return ret;
+@@ -1129,7 +1128,7 @@ static int hpre_debugfs_init(struct hisi_qm *qm)
+
+ static void hpre_debugfs_exit(struct hisi_qm *qm)
+ {
+- hisi_qm_diff_regs_uninit(qm, ARRAY_SIZE(hpre_diff_regs));
++ hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(hpre_diff_regs));
+
+ debugfs_remove_recursive(qm->debug.debug_root);
+ }
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index a878a232ef5b5..0a5056108b94f 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -1722,8 +1722,21 @@ static int qm_regs_show(struct seq_file *s, void *unused)
+
+ DEFINE_SHOW_ATTRIBUTE(qm_regs);
+
++static void dfx_regs_uninit(struct hisi_qm *qm,
++ struct dfx_diff_registers *dregs, int reg_len)
++{
++ int i;
++
++ /* Setting the pointer is NULL to prevent double free */
++ for (i = 0; i < reg_len; i++) {
++ kfree(dregs[i].regs);
++ dregs[i].regs = NULL;
++ }
++ kfree(dregs);
++}
++
+ static struct dfx_diff_registers *dfx_regs_init(struct hisi_qm *qm,
+- const struct dfx_diff_registers *cregs, int reg_len)
++ const struct dfx_diff_registers *cregs, u32 reg_len)
+ {
+ struct dfx_diff_registers *diff_regs;
+ u32 j, base_offset;
+@@ -1762,64 +1775,107 @@ static struct dfx_diff_registers *dfx_regs_init(struct hisi_qm *qm,
+ return ERR_PTR(-ENOMEM);
+ }
+
+-static void dfx_regs_uninit(struct hisi_qm *qm,
+- struct dfx_diff_registers *dregs, int reg_len)
++static int qm_diff_regs_init(struct hisi_qm *qm,
++ struct dfx_diff_registers *dregs, u32 reg_len)
++{
++ qm->debug.qm_diff_regs = dfx_regs_init(qm, qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
++ if (IS_ERR(qm->debug.qm_diff_regs))
++ return PTR_ERR(qm->debug.qm_diff_regs);
++
++ qm->debug.acc_diff_regs = dfx_regs_init(qm, dregs, reg_len);
++ if (IS_ERR(qm->debug.acc_diff_regs)) {
++ dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
++ return PTR_ERR(qm->debug.acc_diff_regs);
++ }
++
++ return 0;
++}
++
++static void qm_last_regs_uninit(struct hisi_qm *qm)
++{
++ struct qm_debug *debug = &qm->debug;
++
++ if (qm->fun_type == QM_HW_VF || !debug->qm_last_words)
++ return;
++
++ kfree(debug->qm_last_words);
++ debug->qm_last_words = NULL;
++}
++
++static int qm_last_regs_init(struct hisi_qm *qm)
+ {
++ int dfx_regs_num = ARRAY_SIZE(qm_dfx_regs);
++ struct qm_debug *debug = &qm->debug;
+ int i;
+
+- /* Setting the pointer is NULL to prevent double free */
+- for (i = 0; i < reg_len; i++) {
+- kfree(dregs[i].regs);
+- dregs[i].regs = NULL;
++ if (qm->fun_type == QM_HW_VF)
++ return 0;
++
++ debug->qm_last_words = kcalloc(dfx_regs_num, sizeof(unsigned int), GFP_KERNEL);
++ if (!debug->qm_last_words)
++ return -ENOMEM;
++
++ for (i = 0; i < dfx_regs_num; i++) {
++ debug->qm_last_words[i] = readl_relaxed(qm->io_base +
++ qm_dfx_regs[i].offset);
+ }
+- kfree(dregs);
++
++ return 0;
++}
++
++static void qm_diff_regs_uninit(struct hisi_qm *qm, u32 reg_len)
++{
++ dfx_regs_uninit(qm, qm->debug.acc_diff_regs, reg_len);
++ dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
+ }
+
+ /**
+- * hisi_qm_diff_regs_init() - Allocate memory for registers.
++ * hisi_qm_regs_debugfs_init() - Allocate memory for registers.
+ * @qm: device qm handle.
+ * @dregs: diff registers handle.
+ * @reg_len: diff registers region length.
+ */
+-int hisi_qm_diff_regs_init(struct hisi_qm *qm,
+- struct dfx_diff_registers *dregs, int reg_len)
++int hisi_qm_regs_debugfs_init(struct hisi_qm *qm,
++ struct dfx_diff_registers *dregs, u32 reg_len)
+ {
+- if (!qm || !dregs || reg_len <= 0)
++ int ret;
++
++ if (!qm || !dregs)
+ return -EINVAL;
+
+ if (qm->fun_type != QM_HW_PF)
+ return 0;
+
+- qm->debug.qm_diff_regs = dfx_regs_init(qm, qm_diff_regs,
+- ARRAY_SIZE(qm_diff_regs));
+- if (IS_ERR(qm->debug.qm_diff_regs))
+- return PTR_ERR(qm->debug.qm_diff_regs);
++ ret = qm_last_regs_init(qm);
++ if (ret) {
++ dev_info(&qm->pdev->dev, "failed to init qm words memory!\n");
++ return ret;
++ }
+
+- qm->debug.acc_diff_regs = dfx_regs_init(qm, dregs, reg_len);
+- if (IS_ERR(qm->debug.acc_diff_regs)) {
+- dfx_regs_uninit(qm, qm->debug.qm_diff_regs,
+- ARRAY_SIZE(qm_diff_regs));
+- return PTR_ERR(qm->debug.acc_diff_regs);
++ ret = qm_diff_regs_init(qm, dregs, reg_len);
++ if (ret) {
++ qm_last_regs_uninit(qm);
++ return ret;
+ }
+
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(hisi_qm_diff_regs_init);
++EXPORT_SYMBOL_GPL(hisi_qm_regs_debugfs_init);
+
+ /**
+- * hisi_qm_diff_regs_uninit() - Free memory for registers.
++ * hisi_qm_regs_debugfs_uninit() - Free memory for registers.
+ * @qm: device qm handle.
+ * @reg_len: diff registers region length.
+ */
+-void hisi_qm_diff_regs_uninit(struct hisi_qm *qm, int reg_len)
++void hisi_qm_regs_debugfs_uninit(struct hisi_qm *qm, u32 reg_len)
+ {
+- if (!qm || reg_len <= 0 || qm->fun_type != QM_HW_PF)
++ if (!qm || qm->fun_type != QM_HW_PF)
+ return;
+
+- dfx_regs_uninit(qm, qm->debug.acc_diff_regs, reg_len);
+- dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
++ qm_diff_regs_uninit(qm, reg_len);
++ qm_last_regs_uninit(qm);
+ }
+-EXPORT_SYMBOL_GPL(hisi_qm_diff_regs_uninit);
++EXPORT_SYMBOL_GPL(hisi_qm_regs_debugfs_uninit);
+
+ /**
+ * hisi_qm_acc_diff_regs_dump() - Dump registers's value.
+@@ -1829,12 +1885,12 @@ EXPORT_SYMBOL_GPL(hisi_qm_diff_regs_uninit);
+ * @regs_len: diff registers region length.
+ */
+ void hisi_qm_acc_diff_regs_dump(struct hisi_qm *qm, struct seq_file *s,
+- struct dfx_diff_registers *dregs, int regs_len)
++ struct dfx_diff_registers *dregs, u32 regs_len)
+ {
+ u32 j, val, base_offset;
+ int i, ret;
+
+- if (!qm || !s || !dregs || regs_len <= 0)
++ if (!qm || !s || !dregs)
+ return;
+
+ ret = hisi_qm_get_dfx_access(qm);
+@@ -3719,17 +3775,6 @@ static void hisi_qm_set_state(struct hisi_qm *qm, u8 state)
+ writel(state, qm->io_base + QM_VF_STATE);
+ }
+
+-static void qm_last_regs_uninit(struct hisi_qm *qm)
+-{
+- struct qm_debug *debug = &qm->debug;
+-
+- if (qm->fun_type == QM_HW_VF || !debug->qm_last_words)
+- return;
+-
+- kfree(debug->qm_last_words);
+- debug->qm_last_words = NULL;
+-}
+-
+ static void hisi_qm_unint_work(struct hisi_qm *qm)
+ {
+ destroy_workqueue(qm->wq);
+@@ -3760,8 +3805,6 @@ static void hisi_qm_memory_uninit(struct hisi_qm *qm)
+ */
+ void hisi_qm_uninit(struct hisi_qm *qm)
+ {
+- qm_last_regs_uninit(qm);
+-
+ qm_cmd_uninit(qm);
+ hisi_qm_unint_work(qm);
+ down_write(&qm->qps_lock);
+@@ -6357,26 +6400,6 @@ static int hisi_qm_memory_init(struct hisi_qm *qm)
+ return ret;
+ }
+
+-static void qm_last_regs_init(struct hisi_qm *qm)
+-{
+- int dfx_regs_num = ARRAY_SIZE(qm_dfx_regs);
+- struct qm_debug *debug = &qm->debug;
+- int i;
+-
+- if (qm->fun_type == QM_HW_VF)
+- return;
+-
+- debug->qm_last_words = kcalloc(dfx_regs_num, sizeof(unsigned int),
+- GFP_KERNEL);
+- if (!debug->qm_last_words)
+- return;
+-
+- for (i = 0; i < dfx_regs_num; i++) {
+- debug->qm_last_words[i] = readl_relaxed(qm->io_base +
+- qm_dfx_regs[i].offset);
+- }
+-}
+-
+ /**
+ * hisi_qm_init() - Initialize configures about qm.
+ * @qm: The qm needing init.
+@@ -6425,8 +6448,6 @@ int hisi_qm_init(struct hisi_qm *qm)
+ qm_cmd_init(qm);
+ atomic_set(&qm->status.flags, QM_INIT);
+
+- qm_last_regs_init(qm);
+-
+ return 0;
+
+ err_free_qm_memory:
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 3705412bac5f1..5e056b75c468a 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -899,8 +899,7 @@ static int sec_debugfs_init(struct hisi_qm *qm)
+ qm->debug.sqe_mask_offset = SEC_SQE_MASK_OFFSET;
+ qm->debug.sqe_mask_len = SEC_SQE_MASK_LEN;
+
+- ret = hisi_qm_diff_regs_init(qm, sec_diff_regs,
+- ARRAY_SIZE(sec_diff_regs));
++ ret = hisi_qm_regs_debugfs_init(qm, sec_diff_regs, ARRAY_SIZE(sec_diff_regs));
+ if (ret) {
+ dev_warn(dev, "Failed to init SEC diff regs!\n");
+ goto debugfs_remove;
+@@ -915,7 +914,7 @@ static int sec_debugfs_init(struct hisi_qm *qm)
+ return 0;
+
+ failed_to_create:
+- hisi_qm_diff_regs_uninit(qm, ARRAY_SIZE(sec_diff_regs));
++ hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(sec_diff_regs));
+ debugfs_remove:
+ debugfs_remove_recursive(sec_debugfs_root);
+ return ret;
+@@ -923,7 +922,7 @@ static int sec_debugfs_init(struct hisi_qm *qm)
+
+ static void sec_debugfs_exit(struct hisi_qm *qm)
+ {
+- hisi_qm_diff_regs_uninit(qm, ARRAY_SIZE(sec_diff_regs));
++ hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(sec_diff_regs));
+
+ debugfs_remove_recursive(qm->debug.debug_root);
+ }
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index c863435e8c75a..1549bec3aea59 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -849,8 +849,7 @@ static int hisi_zip_debugfs_init(struct hisi_qm *qm)
+ qm->debug.sqe_mask_offset = HZIP_SQE_MASK_OFFSET;
+ qm->debug.sqe_mask_len = HZIP_SQE_MASK_LEN;
+ qm->debug.debug_root = dev_d;
+- ret = hisi_qm_diff_regs_init(qm, hzip_diff_regs,
+- ARRAY_SIZE(hzip_diff_regs));
++ ret = hisi_qm_regs_debugfs_init(qm, hzip_diff_regs, ARRAY_SIZE(hzip_diff_regs));
+ if (ret) {
+ dev_warn(dev, "Failed to init ZIP diff regs!\n");
+ goto debugfs_remove;
+@@ -869,7 +868,7 @@ static int hisi_zip_debugfs_init(struct hisi_qm *qm)
+ return 0;
+
+ failed_to_create:
+- hisi_qm_diff_regs_uninit(qm, ARRAY_SIZE(hzip_diff_regs));
++ hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(hzip_diff_regs));
+ debugfs_remove:
+ debugfs_remove_recursive(hzip_debugfs_root);
+ return ret;
+@@ -895,7 +894,7 @@ static void hisi_zip_debug_regs_clear(struct hisi_qm *qm)
+
+ static void hisi_zip_debugfs_exit(struct hisi_qm *qm)
+ {
+- hisi_qm_diff_regs_uninit(qm, ARRAY_SIZE(hzip_diff_regs));
++ hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(hzip_diff_regs));
+
+ debugfs_remove_recursive(qm->debug.debug_root);
+
+diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h
+index c3618255b1504..be3aedaa96dc1 100644
+--- a/include/linux/hisi_acc_qm.h
++++ b/include/linux/hisi_acc_qm.h
+@@ -471,11 +471,11 @@ int hisi_qm_sriov_disable(struct pci_dev *pdev, bool is_frozen);
+ int hisi_qm_sriov_configure(struct pci_dev *pdev, int num_vfs);
+ void hisi_qm_dev_err_init(struct hisi_qm *qm);
+ void hisi_qm_dev_err_uninit(struct hisi_qm *qm);
+-int hisi_qm_diff_regs_init(struct hisi_qm *qm,
+- struct dfx_diff_registers *dregs, int reg_len);
+-void hisi_qm_diff_regs_uninit(struct hisi_qm *qm, int reg_len);
++int hisi_qm_regs_debugfs_init(struct hisi_qm *qm,
++ struct dfx_diff_registers *dregs, u32 reg_len);
++void hisi_qm_regs_debugfs_uninit(struct hisi_qm *qm, u32 reg_len);
+ void hisi_qm_acc_diff_regs_dump(struct hisi_qm *qm, struct seq_file *s,
+- struct dfx_diff_registers *dregs, int regs_len);
++ struct dfx_diff_registers *dregs, u32 regs_len);
+
+ pci_ers_result_t hisi_qm_dev_err_detected(struct pci_dev *pdev,
+ pci_channel_state_t state);
+--
+2.42.0
+
--- /dev/null
+From c748cc3312f1332782e34d7a26c0a4204c7728e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Nov 2022 02:12:52 +0000
+Subject: crypto: hisilicon/qm - split a debugfs.c from qm
+
+From: Kai Ye <yekai13@huawei.com>
+
+[ Upstream commit 94476b2b6d60bc926a585ae62e1bf69bd22c1dff ]
+
+Considering that the qm feature and debugfs feature are independent.
+The code related to debugfs is getting larger and larger. It should be
+separate as a debugfs file. So move some debugfs code to new file from
+qm file. The qm code logic is not modified. And maintainability is
+enhanced.
+
+Signed-off-by: Kai Ye <yekai13@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 5831fc1fd4a5 ("crypto: hisilicon/qm - fix PF queue parameter issue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/Makefile | 2 +-
+ drivers/crypto/hisilicon/debugfs.c | 1097 +++++++++++++++++++++
+ drivers/crypto/hisilicon/qm.c | 1348 ++------------------------
+ drivers/crypto/hisilicon/qm_common.h | 87 ++
+ 4 files changed, 1277 insertions(+), 1257 deletions(-)
+ create mode 100644 drivers/crypto/hisilicon/debugfs.c
+ create mode 100644 drivers/crypto/hisilicon/qm_common.h
+
+diff --git a/drivers/crypto/hisilicon/Makefile b/drivers/crypto/hisilicon/Makefile
+index 1e89269a2e4b0..8595a5a5d2288 100644
+--- a/drivers/crypto/hisilicon/Makefile
++++ b/drivers/crypto/hisilicon/Makefile
+@@ -3,6 +3,6 @@ obj-$(CONFIG_CRYPTO_DEV_HISI_HPRE) += hpre/
+ obj-$(CONFIG_CRYPTO_DEV_HISI_SEC) += sec/
+ obj-$(CONFIG_CRYPTO_DEV_HISI_SEC2) += sec2/
+ obj-$(CONFIG_CRYPTO_DEV_HISI_QM) += hisi_qm.o
+-hisi_qm-objs = qm.o sgl.o
++hisi_qm-objs = qm.o sgl.o debugfs.o
+ obj-$(CONFIG_CRYPTO_DEV_HISI_ZIP) += zip/
+ obj-$(CONFIG_CRYPTO_DEV_HISI_TRNG) += trng/
+diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c
+new file mode 100644
+index 0000000000000..13bec8b2d7237
+--- /dev/null
++++ b/drivers/crypto/hisilicon/debugfs.c
+@@ -0,0 +1,1097 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2022 HiSilicon Limited. */
++#include <linux/hisi_acc_qm.h>
++#include "qm_common.h"
++
++#define QM_DFX_BASE 0x0100000
++#define QM_DFX_STATE1 0x0104000
++#define QM_DFX_STATE2 0x01040C8
++#define QM_DFX_COMMON 0x0000
++#define QM_DFX_BASE_LEN 0x5A
++#define QM_DFX_STATE1_LEN 0x2E
++#define QM_DFX_STATE2_LEN 0x11
++#define QM_DFX_COMMON_LEN 0xC3
++#define QM_DFX_REGS_LEN 4UL
++#define QM_DBG_TMP_BUF_LEN 22
++#define CURRENT_FUN_MASK GENMASK(5, 0)
++#define CURRENT_Q_MASK GENMASK(31, 16)
++#define QM_SQE_ADDR_MASK GENMASK(7, 0)
++
++#define QM_DFX_MB_CNT_VF 0x104010
++#define QM_DFX_DB_CNT_VF 0x104020
++#define QM_DFX_SQE_CNT_VF_SQN 0x104030
++#define QM_DFX_CQE_CNT_VF_CQN 0x104040
++#define QM_DFX_QN_SHIFT 16
++#define QM_DFX_CNT_CLR_CE 0x100118
++#define QM_DBG_WRITE_LEN 1024
++
++static const char * const qm_debug_file_name[] = {
++ [CURRENT_QM] = "current_qm",
++ [CURRENT_Q] = "current_q",
++ [CLEAR_ENABLE] = "clear_enable",
++};
++
++struct qm_dfx_item {
++ const char *name;
++ u32 offset;
++};
++
++static struct qm_dfx_item qm_dfx_files[] = {
++ {"err_irq", offsetof(struct qm_dfx, err_irq_cnt)},
++ {"aeq_irq", offsetof(struct qm_dfx, aeq_irq_cnt)},
++ {"abnormal_irq", offsetof(struct qm_dfx, abnormal_irq_cnt)},
++ {"create_qp_err", offsetof(struct qm_dfx, create_qp_err_cnt)},
++ {"mb_err", offsetof(struct qm_dfx, mb_err_cnt)},
++};
++
++#define CNT_CYC_REGS_NUM 10
++static const struct debugfs_reg32 qm_dfx_regs[] = {
++ /* XXX_CNT are reading clear register */
++ {"QM_ECC_1BIT_CNT ", 0x104000ull},
++ {"QM_ECC_MBIT_CNT ", 0x104008ull},
++ {"QM_DFX_MB_CNT ", 0x104018ull},
++ {"QM_DFX_DB_CNT ", 0x104028ull},
++ {"QM_DFX_SQE_CNT ", 0x104038ull},
++ {"QM_DFX_CQE_CNT ", 0x104048ull},
++ {"QM_DFX_SEND_SQE_TO_ACC_CNT ", 0x104050ull},
++ {"QM_DFX_WB_SQE_FROM_ACC_CNT ", 0x104058ull},
++ {"QM_DFX_ACC_FINISH_CNT ", 0x104060ull},
++ {"QM_DFX_CQE_ERR_CNT ", 0x1040b4ull},
++ {"QM_DFX_FUNS_ACTIVE_ST ", 0x200ull},
++ {"QM_ECC_1BIT_INF ", 0x104004ull},
++ {"QM_ECC_MBIT_INF ", 0x10400cull},
++ {"QM_DFX_ACC_RDY_VLD0 ", 0x1040a0ull},
++ {"QM_DFX_ACC_RDY_VLD1 ", 0x1040a4ull},
++ {"QM_DFX_AXI_RDY_VLD ", 0x1040a8ull},
++ {"QM_DFX_FF_ST0 ", 0x1040c8ull},
++ {"QM_DFX_FF_ST1 ", 0x1040ccull},
++ {"QM_DFX_FF_ST2 ", 0x1040d0ull},
++ {"QM_DFX_FF_ST3 ", 0x1040d4ull},
++ {"QM_DFX_FF_ST4 ", 0x1040d8ull},
++ {"QM_DFX_FF_ST5 ", 0x1040dcull},
++ {"QM_DFX_FF_ST6 ", 0x1040e0ull},
++ {"QM_IN_IDLE_ST ", 0x1040e4ull},
++};
++
++static const struct debugfs_reg32 qm_vf_dfx_regs[] = {
++ {"QM_DFX_FUNS_ACTIVE_ST ", 0x200ull},
++};
++
++/* define the QM's dfx regs region and region length */
++static struct dfx_diff_registers qm_diff_regs[] = {
++ {
++ .reg_offset = QM_DFX_BASE,
++ .reg_len = QM_DFX_BASE_LEN,
++ }, {
++ .reg_offset = QM_DFX_STATE1,
++ .reg_len = QM_DFX_STATE1_LEN,
++ }, {
++ .reg_offset = QM_DFX_STATE2,
++ .reg_len = QM_DFX_STATE2_LEN,
++ }, {
++ .reg_offset = QM_DFX_COMMON,
++ .reg_len = QM_DFX_COMMON_LEN,
++ },
++};
++
++static struct hisi_qm *file_to_qm(struct debugfs_file *file)
++{
++ struct qm_debug *debug = file->debug;
++
++ return container_of(debug, struct hisi_qm, debug);
++}
++
++static ssize_t qm_cmd_read(struct file *filp, char __user *buffer,
++ size_t count, loff_t *pos)
++{
++ char buf[QM_DBG_READ_LEN];
++ int len;
++
++ len = scnprintf(buf, QM_DBG_READ_LEN, "%s\n",
++ "Please echo help to cmd to get help information");
++
++ return simple_read_from_buffer(buffer, count, pos, buf, len);
++}
++
++static void dump_show(struct hisi_qm *qm, void *info,
++ unsigned int info_size, char *info_name)
++{
++ struct device *dev = &qm->pdev->dev;
++ u8 *info_curr = info;
++ u32 i;
++#define BYTE_PER_DW 4
++
++ dev_info(dev, "%s DUMP\n", info_name);
++ for (i = 0; i < info_size; i += BYTE_PER_DW, info_curr += BYTE_PER_DW) {
++ pr_info("DW%u: %02X%02X %02X%02X\n", i / BYTE_PER_DW,
++ *(info_curr + 3), *(info_curr + 2), *(info_curr + 1), *(info_curr));
++ }
++}
++
++static int qm_sqc_dump(struct hisi_qm *qm, const char *s)
++{
++ struct device *dev = &qm->pdev->dev;
++ struct qm_sqc *sqc, *sqc_curr;
++ dma_addr_t sqc_dma;
++ u32 qp_id;
++ int ret;
++
++ if (!s)
++ return -EINVAL;
++
++ ret = kstrtou32(s, 0, &qp_id);
++ if (ret || qp_id >= qm->qp_num) {
++ dev_err(dev, "Please input qp num (0-%u)", qm->qp_num - 1);
++ return -EINVAL;
++ }
++
++ sqc = hisi_qm_ctx_alloc(qm, sizeof(*sqc), &sqc_dma);
++ if (IS_ERR(sqc))
++ return PTR_ERR(sqc);
++
++ ret = hisi_qm_mb(qm, QM_MB_CMD_SQC, sqc_dma, qp_id, 1);
++ if (ret) {
++ down_read(&qm->qps_lock);
++ if (qm->sqc) {
++ sqc_curr = qm->sqc + qp_id;
++
++ dump_show(qm, sqc_curr, sizeof(*sqc), "SOFT SQC");
++ }
++ up_read(&qm->qps_lock);
++
++ goto free_ctx;
++ }
++
++ dump_show(qm, sqc, sizeof(*sqc), "SQC");
++
++free_ctx:
++ hisi_qm_ctx_free(qm, sizeof(*sqc), sqc, &sqc_dma);
++ return 0;
++}
++
++static int qm_cqc_dump(struct hisi_qm *qm, const char *s)
++{
++ struct device *dev = &qm->pdev->dev;
++ struct qm_cqc *cqc, *cqc_curr;
++ dma_addr_t cqc_dma;
++ u32 qp_id;
++ int ret;
++
++ if (!s)
++ return -EINVAL;
++
++ ret = kstrtou32(s, 0, &qp_id);
++ if (ret || qp_id >= qm->qp_num) {
++ dev_err(dev, "Please input qp num (0-%u)", qm->qp_num - 1);
++ return -EINVAL;
++ }
++
++ cqc = hisi_qm_ctx_alloc(qm, sizeof(*cqc), &cqc_dma);
++ if (IS_ERR(cqc))
++ return PTR_ERR(cqc);
++
++ ret = hisi_qm_mb(qm, QM_MB_CMD_CQC, cqc_dma, qp_id, 1);
++ if (ret) {
++ down_read(&qm->qps_lock);
++ if (qm->cqc) {
++ cqc_curr = qm->cqc + qp_id;
++
++ dump_show(qm, cqc_curr, sizeof(*cqc), "SOFT CQC");
++ }
++ up_read(&qm->qps_lock);
++
++ goto free_ctx;
++ }
++
++ dump_show(qm, cqc, sizeof(*cqc), "CQC");
++
++free_ctx:
++ hisi_qm_ctx_free(qm, sizeof(*cqc), cqc, &cqc_dma);
++ return 0;
++}
++
++static int qm_eqc_aeqc_dump(struct hisi_qm *qm, char *s, size_t size,
++ int cmd, char *name)
++{
++ struct device *dev = &qm->pdev->dev;
++ dma_addr_t xeqc_dma;
++ void *xeqc;
++ int ret;
++
++ if (strsep(&s, " ")) {
++ dev_err(dev, "Please do not input extra characters!\n");
++ return -EINVAL;
++ }
++
++ xeqc = hisi_qm_ctx_alloc(qm, size, &xeqc_dma);
++ if (IS_ERR(xeqc))
++ return PTR_ERR(xeqc);
++
++ ret = hisi_qm_mb(qm, cmd, xeqc_dma, 0, 1);
++ if (ret)
++ goto err_free_ctx;
++
++ dump_show(qm, xeqc, size, name);
++
++err_free_ctx:
++ hisi_qm_ctx_free(qm, size, xeqc, &xeqc_dma);
++ return ret;
++}
++
++static int q_dump_param_parse(struct hisi_qm *qm, char *s,
++ u32 *e_id, u32 *q_id, u16 q_depth)
++{
++ struct device *dev = &qm->pdev->dev;
++ unsigned int qp_num = qm->qp_num;
++ char *presult;
++ int ret;
++
++ presult = strsep(&s, " ");
++ if (!presult) {
++ dev_err(dev, "Please input qp number!\n");
++ return -EINVAL;
++ }
++
++ ret = kstrtou32(presult, 0, q_id);
++ if (ret || *q_id >= qp_num) {
++ dev_err(dev, "Please input qp num (0-%u)", qp_num - 1);
++ return -EINVAL;
++ }
++
++ presult = strsep(&s, " ");
++ if (!presult) {
++ dev_err(dev, "Please input sqe number!\n");
++ return -EINVAL;
++ }
++
++ ret = kstrtou32(presult, 0, e_id);
++ if (ret || *e_id >= q_depth) {
++ dev_err(dev, "Please input sqe num (0-%u)", q_depth - 1);
++ return -EINVAL;
++ }
++
++ if (strsep(&s, " ")) {
++ dev_err(dev, "Please do not input extra characters!\n");
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++static int qm_sq_dump(struct hisi_qm *qm, char *s)
++{
++ u16 sq_depth = qm->qp_array->cq_depth;
++ void *sqe, *sqe_curr;
++ struct hisi_qp *qp;
++ u32 qp_id, sqe_id;
++ int ret;
++
++ ret = q_dump_param_parse(qm, s, &sqe_id, &qp_id, sq_depth);
++ if (ret)
++ return ret;
++
++ sqe = kzalloc(qm->sqe_size * sq_depth, GFP_KERNEL);
++ if (!sqe)
++ return -ENOMEM;
++
++ qp = &qm->qp_array[qp_id];
++ memcpy(sqe, qp->sqe, qm->sqe_size * sq_depth);
++ sqe_curr = sqe + (u32)(sqe_id * qm->sqe_size);
++ memset(sqe_curr + qm->debug.sqe_mask_offset, QM_SQE_ADDR_MASK,
++ qm->debug.sqe_mask_len);
++
++ dump_show(qm, sqe_curr, qm->sqe_size, "SQE");
++
++ kfree(sqe);
++
++ return 0;
++}
++
++static int qm_cq_dump(struct hisi_qm *qm, char *s)
++{
++ struct qm_cqe *cqe_curr;
++ struct hisi_qp *qp;
++ u32 qp_id, cqe_id;
++ int ret;
++
++ ret = q_dump_param_parse(qm, s, &cqe_id, &qp_id, qm->qp_array->cq_depth);
++ if (ret)
++ return ret;
++
++ qp = &qm->qp_array[qp_id];
++ cqe_curr = qp->cqe + cqe_id;
++ dump_show(qm, cqe_curr, sizeof(struct qm_cqe), "CQE");
++
++ return 0;
++}
++
++static int qm_eq_aeq_dump(struct hisi_qm *qm, const char *s,
++ size_t size, char *name)
++{
++ struct device *dev = &qm->pdev->dev;
++ void *xeqe;
++ u32 xeqe_id;
++ int ret;
++
++ if (!s)
++ return -EINVAL;
++
++ ret = kstrtou32(s, 0, &xeqe_id);
++ if (ret)
++ return -EINVAL;
++
++ if (!strcmp(name, "EQE") && xeqe_id >= qm->eq_depth) {
++ dev_err(dev, "Please input eqe num (0-%u)", qm->eq_depth - 1);
++ return -EINVAL;
++ } else if (!strcmp(name, "AEQE") && xeqe_id >= qm->aeq_depth) {
++ dev_err(dev, "Please input aeqe num (0-%u)", qm->eq_depth - 1);
++ return -EINVAL;
++ }
++
++ down_read(&qm->qps_lock);
++
++ if (qm->eqe && !strcmp(name, "EQE")) {
++ xeqe = qm->eqe + xeqe_id;
++ } else if (qm->aeqe && !strcmp(name, "AEQE")) {
++ xeqe = qm->aeqe + xeqe_id;
++ } else {
++ ret = -EINVAL;
++ goto err_unlock;
++ }
++
++ dump_show(qm, xeqe, size, name);
++
++err_unlock:
++ up_read(&qm->qps_lock);
++ return ret;
++}
++
++static int qm_dbg_help(struct hisi_qm *qm, char *s)
++{
++ struct device *dev = &qm->pdev->dev;
++
++ if (strsep(&s, " ")) {
++ dev_err(dev, "Please do not input extra characters!\n");
++ return -EINVAL;
++ }
++
++ dev_info(dev, "available commands:\n");
++ dev_info(dev, "sqc <num>\n");
++ dev_info(dev, "cqc <num>\n");
++ dev_info(dev, "eqc\n");
++ dev_info(dev, "aeqc\n");
++ dev_info(dev, "sq <num> <e>\n");
++ dev_info(dev, "cq <num> <e>\n");
++ dev_info(dev, "eq <e>\n");
++ dev_info(dev, "aeq <e>\n");
++
++ return 0;
++}
++
++static int qm_cmd_write_dump(struct hisi_qm *qm, const char *cmd_buf)
++{
++ struct device *dev = &qm->pdev->dev;
++ char *presult, *s, *s_tmp;
++ int ret;
++
++ s = kstrdup(cmd_buf, GFP_KERNEL);
++ if (!s)
++ return -ENOMEM;
++
++ s_tmp = s;
++ presult = strsep(&s, " ");
++ if (!presult) {
++ ret = -EINVAL;
++ goto err_buffer_free;
++ }
++
++ if (!strcmp(presult, "sqc"))
++ ret = qm_sqc_dump(qm, s);
++ else if (!strcmp(presult, "cqc"))
++ ret = qm_cqc_dump(qm, s);
++ else if (!strcmp(presult, "eqc"))
++ ret = qm_eqc_aeqc_dump(qm, s, sizeof(struct qm_eqc),
++ QM_MB_CMD_EQC, "EQC");
++ else if (!strcmp(presult, "aeqc"))
++ ret = qm_eqc_aeqc_dump(qm, s, sizeof(struct qm_aeqc),
++ QM_MB_CMD_AEQC, "AEQC");
++ else if (!strcmp(presult, "sq"))
++ ret = qm_sq_dump(qm, s);
++ else if (!strcmp(presult, "cq"))
++ ret = qm_cq_dump(qm, s);
++ else if (!strcmp(presult, "eq"))
++ ret = qm_eq_aeq_dump(qm, s, sizeof(struct qm_eqe), "EQE");
++ else if (!strcmp(presult, "aeq"))
++ ret = qm_eq_aeq_dump(qm, s, sizeof(struct qm_aeqe), "AEQE");
++ else if (!strcmp(presult, "help"))
++ ret = qm_dbg_help(qm, s);
++ else
++ ret = -EINVAL;
++
++ if (ret)
++ dev_info(dev, "Please echo help\n");
++
++err_buffer_free:
++ kfree(s_tmp);
++
++ return ret;
++}
++
++static ssize_t qm_cmd_write(struct file *filp, const char __user *buffer,
++ size_t count, loff_t *pos)
++{
++ struct hisi_qm *qm = filp->private_data;
++ char *cmd_buf, *cmd_buf_tmp;
++ int ret;
++
++ if (*pos)
++ return 0;
++
++ ret = hisi_qm_get_dfx_access(qm);
++ if (ret)
++ return ret;
++
++ /* Judge if the instance is being reset. */
++ if (unlikely(atomic_read(&qm->status.flags) == QM_STOP)) {
++ ret = 0;
++ goto put_dfx_access;
++ }
++
++ if (count > QM_DBG_WRITE_LEN) {
++ ret = -ENOSPC;
++ goto put_dfx_access;
++ }
++
++ cmd_buf = memdup_user_nul(buffer, count);
++ if (IS_ERR(cmd_buf)) {
++ ret = PTR_ERR(cmd_buf);
++ goto put_dfx_access;
++ }
++
++ cmd_buf_tmp = strchr(cmd_buf, '\n');
++ if (cmd_buf_tmp) {
++ *cmd_buf_tmp = '\0';
++ count = cmd_buf_tmp - cmd_buf + 1;
++ }
++
++ ret = qm_cmd_write_dump(qm, cmd_buf);
++ if (ret) {
++ kfree(cmd_buf);
++ goto put_dfx_access;
++ }
++
++ kfree(cmd_buf);
++
++ ret = count;
++
++put_dfx_access:
++ hisi_qm_put_dfx_access(qm);
++ return ret;
++}
++
++static const struct file_operations qm_cmd_fops = {
++ .owner = THIS_MODULE,
++ .open = simple_open,
++ .read = qm_cmd_read,
++ .write = qm_cmd_write,
++};
++
++/**
++ * hisi_qm_regs_dump() - Dump registers's value.
++ * @s: debugfs file handle.
++ * @regset: accelerator registers information.
++ *
++ * Dump accelerator registers.
++ */
++void hisi_qm_regs_dump(struct seq_file *s, struct debugfs_regset32 *regset)
++{
++ struct pci_dev *pdev = to_pci_dev(regset->dev);
++ struct hisi_qm *qm = pci_get_drvdata(pdev);
++ const struct debugfs_reg32 *regs = regset->regs;
++ int regs_len = regset->nregs;
++ int i, ret;
++ u32 val;
++
++ ret = hisi_qm_get_dfx_access(qm);
++ if (ret)
++ return;
++
++ for (i = 0; i < regs_len; i++) {
++ val = readl(regset->base + regs[i].offset);
++ seq_printf(s, "%s= 0x%08x\n", regs[i].name, val);
++ }
++
++ hisi_qm_put_dfx_access(qm);
++}
++EXPORT_SYMBOL_GPL(hisi_qm_regs_dump);
++
++static int qm_regs_show(struct seq_file *s, void *unused)
++{
++ struct hisi_qm *qm = s->private;
++ struct debugfs_regset32 regset;
++
++ if (qm->fun_type == QM_HW_PF) {
++ regset.regs = qm_dfx_regs;
++ regset.nregs = ARRAY_SIZE(qm_dfx_regs);
++ } else {
++ regset.regs = qm_vf_dfx_regs;
++ regset.nregs = ARRAY_SIZE(qm_vf_dfx_regs);
++ }
++
++ regset.base = qm->io_base;
++ regset.dev = &qm->pdev->dev;
++
++ hisi_qm_regs_dump(s, ®set);
++
++ return 0;
++}
++
++DEFINE_SHOW_ATTRIBUTE(qm_regs);
++
++static u32 current_q_read(struct hisi_qm *qm)
++{
++ return readl(qm->io_base + QM_DFX_SQE_CNT_VF_SQN) >> QM_DFX_QN_SHIFT;
++}
++
++static int current_q_write(struct hisi_qm *qm, u32 val)
++{
++ u32 tmp;
++
++ if (val >= qm->debug.curr_qm_qp_num)
++ return -EINVAL;
++
++ tmp = val << QM_DFX_QN_SHIFT |
++ (readl(qm->io_base + QM_DFX_SQE_CNT_VF_SQN) & CURRENT_FUN_MASK);
++ writel(tmp, qm->io_base + QM_DFX_SQE_CNT_VF_SQN);
++
++ tmp = val << QM_DFX_QN_SHIFT |
++ (readl(qm->io_base + QM_DFX_CQE_CNT_VF_CQN) & CURRENT_FUN_MASK);
++ writel(tmp, qm->io_base + QM_DFX_CQE_CNT_VF_CQN);
++
++ return 0;
++}
++
++static u32 clear_enable_read(struct hisi_qm *qm)
++{
++ return readl(qm->io_base + QM_DFX_CNT_CLR_CE);
++}
++
++/* rd_clr_ctrl 1 enable read clear, otherwise 0 disable it */
++static int clear_enable_write(struct hisi_qm *qm, u32 rd_clr_ctrl)
++{
++ if (rd_clr_ctrl > 1)
++ return -EINVAL;
++
++ writel(rd_clr_ctrl, qm->io_base + QM_DFX_CNT_CLR_CE);
++
++ return 0;
++}
++
++static u32 current_qm_read(struct hisi_qm *qm)
++{
++ return readl(qm->io_base + QM_DFX_MB_CNT_VF);
++}
++
++static int qm_get_vf_qp_num(struct hisi_qm *qm, u32 fun_num)
++{
++ u32 remain_q_num, vfq_num;
++ u32 num_vfs = qm->vfs_num;
++
++ vfq_num = (qm->ctrl_qp_num - qm->qp_num) / num_vfs;
++ if (vfq_num >= qm->max_qp_num)
++ return qm->max_qp_num;
++
++ remain_q_num = (qm->ctrl_qp_num - qm->qp_num) % num_vfs;
++ if (vfq_num + remain_q_num <= qm->max_qp_num)
++ return fun_num == num_vfs ? vfq_num + remain_q_num : vfq_num;
++
++ /*
++ * if vfq_num + remain_q_num > max_qp_num, the last VFs,
++ * each with one more queue.
++ */
++ return fun_num + remain_q_num > num_vfs ? vfq_num + 1 : vfq_num;
++}
++
++static int current_qm_write(struct hisi_qm *qm, u32 val)
++{
++ u32 tmp;
++
++ if (val > qm->vfs_num)
++ return -EINVAL;
++
++ /* According PF or VF Dev ID to calculation curr_qm_qp_num and store */
++ if (!val)
++ qm->debug.curr_qm_qp_num = qm->qp_num;
++ else
++ qm->debug.curr_qm_qp_num = qm_get_vf_qp_num(qm, val);
++
++ writel(val, qm->io_base + QM_DFX_MB_CNT_VF);
++ writel(val, qm->io_base + QM_DFX_DB_CNT_VF);
++
++ tmp = val |
++ (readl(qm->io_base + QM_DFX_SQE_CNT_VF_SQN) & CURRENT_Q_MASK);
++ writel(tmp, qm->io_base + QM_DFX_SQE_CNT_VF_SQN);
++
++ tmp = val |
++ (readl(qm->io_base + QM_DFX_CQE_CNT_VF_CQN) & CURRENT_Q_MASK);
++ writel(tmp, qm->io_base + QM_DFX_CQE_CNT_VF_CQN);
++
++ return 0;
++}
++
++static ssize_t qm_debug_read(struct file *filp, char __user *buf,
++ size_t count, loff_t *pos)
++{
++ struct debugfs_file *file = filp->private_data;
++ enum qm_debug_file index = file->index;
++ struct hisi_qm *qm = file_to_qm(file);
++ char tbuf[QM_DBG_TMP_BUF_LEN];
++ u32 val;
++ int ret;
++
++ ret = hisi_qm_get_dfx_access(qm);
++ if (ret)
++ return ret;
++
++ mutex_lock(&file->lock);
++ switch (index) {
++ case CURRENT_QM:
++ val = current_qm_read(qm);
++ break;
++ case CURRENT_Q:
++ val = current_q_read(qm);
++ break;
++ case CLEAR_ENABLE:
++ val = clear_enable_read(qm);
++ break;
++ default:
++ goto err_input;
++ }
++ mutex_unlock(&file->lock);
++
++ hisi_qm_put_dfx_access(qm);
++ ret = scnprintf(tbuf, QM_DBG_TMP_BUF_LEN, "%u\n", val);
++ return simple_read_from_buffer(buf, count, pos, tbuf, ret);
++
++err_input:
++ mutex_unlock(&file->lock);
++ hisi_qm_put_dfx_access(qm);
++ return -EINVAL;
++}
++
++static ssize_t qm_debug_write(struct file *filp, const char __user *buf,
++ size_t count, loff_t *pos)
++{
++ struct debugfs_file *file = filp->private_data;
++ enum qm_debug_file index = file->index;
++ struct hisi_qm *qm = file_to_qm(file);
++ unsigned long val;
++ char tbuf[QM_DBG_TMP_BUF_LEN];
++ int len, ret;
++
++ if (*pos != 0)
++ return 0;
++
++ if (count >= QM_DBG_TMP_BUF_LEN)
++ return -ENOSPC;
++
++ len = simple_write_to_buffer(tbuf, QM_DBG_TMP_BUF_LEN - 1, pos, buf,
++ count);
++ if (len < 0)
++ return len;
++
++ tbuf[len] = '\0';
++ if (kstrtoul(tbuf, 0, &val))
++ return -EFAULT;
++
++ ret = hisi_qm_get_dfx_access(qm);
++ if (ret)
++ return ret;
++
++ mutex_lock(&file->lock);
++ switch (index) {
++ case CURRENT_QM:
++ ret = current_qm_write(qm, val);
++ break;
++ case CURRENT_Q:
++ ret = current_q_write(qm, val);
++ break;
++ case CLEAR_ENABLE:
++ ret = clear_enable_write(qm, val);
++ break;
++ default:
++ ret = -EINVAL;
++ }
++ mutex_unlock(&file->lock);
++
++ hisi_qm_put_dfx_access(qm);
++
++ if (ret)
++ return ret;
++
++ return count;
++}
++
++static const struct file_operations qm_debug_fops = {
++ .owner = THIS_MODULE,
++ .open = simple_open,
++ .read = qm_debug_read,
++ .write = qm_debug_write,
++};
++
++static void dfx_regs_uninit(struct hisi_qm *qm,
++ struct dfx_diff_registers *dregs, int reg_len)
++{
++ int i;
++
++ /* Setting the pointer is NULL to prevent double free */
++ for (i = 0; i < reg_len; i++) {
++ kfree(dregs[i].regs);
++ dregs[i].regs = NULL;
++ }
++ kfree(dregs);
++}
++
++static struct dfx_diff_registers *dfx_regs_init(struct hisi_qm *qm,
++ const struct dfx_diff_registers *cregs, u32 reg_len)
++{
++ struct dfx_diff_registers *diff_regs;
++ u32 j, base_offset;
++ int i;
++
++ diff_regs = kcalloc(reg_len, sizeof(*diff_regs), GFP_KERNEL);
++ if (!diff_regs)
++ return ERR_PTR(-ENOMEM);
++
++ for (i = 0; i < reg_len; i++) {
++ if (!cregs[i].reg_len)
++ continue;
++
++ diff_regs[i].reg_offset = cregs[i].reg_offset;
++ diff_regs[i].reg_len = cregs[i].reg_len;
++ diff_regs[i].regs = kcalloc(QM_DFX_REGS_LEN, cregs[i].reg_len,
++ GFP_KERNEL);
++ if (!diff_regs[i].regs)
++ goto alloc_error;
++
++ for (j = 0; j < diff_regs[i].reg_len; j++) {
++ base_offset = diff_regs[i].reg_offset +
++ j * QM_DFX_REGS_LEN;
++ diff_regs[i].regs[j] = readl(qm->io_base + base_offset);
++ }
++ }
++
++ return diff_regs;
++
++alloc_error:
++ while (i > 0) {
++ i--;
++ kfree(diff_regs[i].regs);
++ }
++ kfree(diff_regs);
++ return ERR_PTR(-ENOMEM);
++}
++
++static int qm_diff_regs_init(struct hisi_qm *qm,
++ struct dfx_diff_registers *dregs, u32 reg_len)
++{
++ qm->debug.qm_diff_regs = dfx_regs_init(qm, qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
++ if (IS_ERR(qm->debug.qm_diff_regs))
++ return PTR_ERR(qm->debug.qm_diff_regs);
++
++ qm->debug.acc_diff_regs = dfx_regs_init(qm, dregs, reg_len);
++ if (IS_ERR(qm->debug.acc_diff_regs)) {
++ dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
++ return PTR_ERR(qm->debug.acc_diff_regs);
++ }
++
++ return 0;
++}
++
++static void qm_last_regs_uninit(struct hisi_qm *qm)
++{
++ struct qm_debug *debug = &qm->debug;
++
++ if (qm->fun_type == QM_HW_VF || !debug->qm_last_words)
++ return;
++
++ kfree(debug->qm_last_words);
++ debug->qm_last_words = NULL;
++}
++
++static int qm_last_regs_init(struct hisi_qm *qm)
++{
++ int dfx_regs_num = ARRAY_SIZE(qm_dfx_regs);
++ struct qm_debug *debug = &qm->debug;
++ int i;
++
++ if (qm->fun_type == QM_HW_VF)
++ return 0;
++
++ debug->qm_last_words = kcalloc(dfx_regs_num, sizeof(unsigned int), GFP_KERNEL);
++ if (!debug->qm_last_words)
++ return -ENOMEM;
++
++ for (i = 0; i < dfx_regs_num; i++) {
++ debug->qm_last_words[i] = readl_relaxed(qm->io_base +
++ qm_dfx_regs[i].offset);
++ }
++
++ return 0;
++}
++
++static void qm_diff_regs_uninit(struct hisi_qm *qm, u32 reg_len)
++{
++ dfx_regs_uninit(qm, qm->debug.acc_diff_regs, reg_len);
++ dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
++}
++
++/**
++ * hisi_qm_regs_debugfs_init() - Allocate memory for registers.
++ * @qm: device qm handle.
++ * @dregs: diff registers handle.
++ * @reg_len: diff registers region length.
++ */
++int hisi_qm_regs_debugfs_init(struct hisi_qm *qm,
++ struct dfx_diff_registers *dregs, u32 reg_len)
++{
++ int ret;
++
++ if (!qm || !dregs)
++ return -EINVAL;
++
++ if (qm->fun_type != QM_HW_PF)
++ return 0;
++
++ ret = qm_last_regs_init(qm);
++ if (ret) {
++ dev_info(&qm->pdev->dev, "failed to init qm words memory!\n");
++ return ret;
++ }
++
++ ret = qm_diff_regs_init(qm, dregs, reg_len);
++ if (ret) {
++ qm_last_regs_uninit(qm);
++ return ret;
++ }
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(hisi_qm_regs_debugfs_init);
++
++/**
++ * hisi_qm_regs_debugfs_uninit() - Free memory for registers.
++ * @qm: device qm handle.
++ * @reg_len: diff registers region length.
++ */
++void hisi_qm_regs_debugfs_uninit(struct hisi_qm *qm, u32 reg_len)
++{
++ if (!qm || qm->fun_type != QM_HW_PF)
++ return;
++
++ qm_diff_regs_uninit(qm, reg_len);
++ qm_last_regs_uninit(qm);
++}
++EXPORT_SYMBOL_GPL(hisi_qm_regs_debugfs_uninit);
++
++/**
++ * hisi_qm_acc_diff_regs_dump() - Dump registers's value.
++ * @qm: device qm handle.
++ * @s: Debugfs file handle.
++ * @dregs: diff registers handle.
++ * @regs_len: diff registers region length.
++ */
++void hisi_qm_acc_diff_regs_dump(struct hisi_qm *qm, struct seq_file *s,
++ struct dfx_diff_registers *dregs, u32 regs_len)
++{
++ u32 j, val, base_offset;
++ int i, ret;
++
++ if (!qm || !s || !dregs)
++ return;
++
++ ret = hisi_qm_get_dfx_access(qm);
++ if (ret)
++ return;
++
++ down_read(&qm->qps_lock);
++ for (i = 0; i < regs_len; i++) {
++ if (!dregs[i].reg_len)
++ continue;
++
++ for (j = 0; j < dregs[i].reg_len; j++) {
++ base_offset = dregs[i].reg_offset + j * QM_DFX_REGS_LEN;
++ val = readl(qm->io_base + base_offset);
++ if (val != dregs[i].regs[j])
++ seq_printf(s, "0x%08x = 0x%08x ---> 0x%08x\n",
++ base_offset, dregs[i].regs[j], val);
++ }
++ }
++ up_read(&qm->qps_lock);
++
++ hisi_qm_put_dfx_access(qm);
++}
++EXPORT_SYMBOL_GPL(hisi_qm_acc_diff_regs_dump);
++
++void hisi_qm_show_last_dfx_regs(struct hisi_qm *qm)
++{
++ struct qm_debug *debug = &qm->debug;
++ struct pci_dev *pdev = qm->pdev;
++ u32 val;
++ int i;
++
++ if (qm->fun_type == QM_HW_VF || !debug->qm_last_words)
++ return;
++
++ for (i = 0; i < ARRAY_SIZE(qm_dfx_regs); i++) {
++ val = readl_relaxed(qm->io_base + qm_dfx_regs[i].offset);
++ if (debug->qm_last_words[i] != val)
++ pci_info(pdev, "%s \t= 0x%08x => 0x%08x\n",
++ qm_dfx_regs[i].name, debug->qm_last_words[i], val);
++ }
++}
++
++static int qm_diff_regs_show(struct seq_file *s, void *unused)
++{
++ struct hisi_qm *qm = s->private;
++
++ hisi_qm_acc_diff_regs_dump(qm, s, qm->debug.qm_diff_regs,
++ ARRAY_SIZE(qm_diff_regs));
++
++ return 0;
++}
++DEFINE_SHOW_ATTRIBUTE(qm_diff_regs);
++
++static ssize_t qm_status_read(struct file *filp, char __user *buffer,
++ size_t count, loff_t *pos)
++{
++ struct hisi_qm *qm = filp->private_data;
++ char buf[QM_DBG_READ_LEN];
++ int val, len;
++
++ val = atomic_read(&qm->status.flags);
++ len = scnprintf(buf, QM_DBG_READ_LEN, "%s\n", qm_s[val]);
++
++ return simple_read_from_buffer(buffer, count, pos, buf, len);
++}
++
++static const struct file_operations qm_status_fops = {
++ .owner = THIS_MODULE,
++ .open = simple_open,
++ .read = qm_status_read,
++};
++
++static void qm_create_debugfs_file(struct hisi_qm *qm, struct dentry *dir,
++ enum qm_debug_file index)
++{
++ struct debugfs_file *file = qm->debug.files + index;
++
++ debugfs_create_file(qm_debug_file_name[index], 0600, dir, file,
++ &qm_debug_fops);
++
++ file->index = index;
++ mutex_init(&file->lock);
++ file->debug = &qm->debug;
++}
++
++static int qm_debugfs_atomic64_set(void *data, u64 val)
++{
++ if (val)
++ return -EINVAL;
++
++ atomic64_set((atomic64_t *)data, 0);
++
++ return 0;
++}
++
++static int qm_debugfs_atomic64_get(void *data, u64 *val)
++{
++ *val = atomic64_read((atomic64_t *)data);
++
++ return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(qm_atomic64_ops, qm_debugfs_atomic64_get,
++ qm_debugfs_atomic64_set, "%llu\n");
++
++/**
++ * hisi_qm_debug_init() - Initialize qm related debugfs files.
++ * @qm: The qm for which we want to add debugfs files.
++ *
++ * Create qm related debugfs files.
++ */
++void hisi_qm_debug_init(struct hisi_qm *qm)
++{
++ struct dfx_diff_registers *qm_regs = qm->debug.qm_diff_regs;
++ struct qm_dfx *dfx = &qm->debug.dfx;
++ struct dentry *qm_d;
++ void *data;
++ int i;
++
++ qm_d = debugfs_create_dir("qm", qm->debug.debug_root);
++ qm->debug.qm_d = qm_d;
++
++ /* only show this in PF */
++ if (qm->fun_type == QM_HW_PF) {
++ qm_create_debugfs_file(qm, qm->debug.debug_root, CURRENT_QM);
++ for (i = CURRENT_Q; i < DEBUG_FILE_NUM; i++)
++ qm_create_debugfs_file(qm, qm->debug.qm_d, i);
++ }
++
++ if (qm_regs)
++ debugfs_create_file("diff_regs", 0444, qm->debug.qm_d,
++ qm, &qm_diff_regs_fops);
++
++ debugfs_create_file("regs", 0444, qm->debug.qm_d, qm, &qm_regs_fops);
++
++ debugfs_create_file("cmd", 0600, qm->debug.qm_d, qm, &qm_cmd_fops);
++
++ debugfs_create_file("status", 0444, qm->debug.qm_d, qm,
++ &qm_status_fops);
++ for (i = 0; i < ARRAY_SIZE(qm_dfx_files); i++) {
++ data = (atomic64_t *)((uintptr_t)dfx + qm_dfx_files[i].offset);
++ debugfs_create_file(qm_dfx_files[i].name,
++ 0644,
++ qm_d,
++ data,
++ &qm_atomic64_ops);
++ }
++
++ if (test_bit(QM_SUPPORT_FUNC_QOS, &qm->caps))
++ hisi_qm_set_algqos_init(qm);
++}
++EXPORT_SYMBOL_GPL(hisi_qm_debug_init);
++
++/**
++ * hisi_qm_debug_regs_clear() - clear qm debug related registers.
++ * @qm: The qm for which we want to clear its debug registers.
++ */
++void hisi_qm_debug_regs_clear(struct hisi_qm *qm)
++{
++ const struct debugfs_reg32 *regs;
++ int i;
++
++ /* clear current_qm */
++ writel(0x0, qm->io_base + QM_DFX_MB_CNT_VF);
++ writel(0x0, qm->io_base + QM_DFX_DB_CNT_VF);
++
++ /* clear current_q */
++ writel(0x0, qm->io_base + QM_DFX_SQE_CNT_VF_SQN);
++ writel(0x0, qm->io_base + QM_DFX_CQE_CNT_VF_CQN);
++
++ /*
++ * these registers are reading and clearing, so clear them after
++ * reading them.
++ */
++ writel(0x1, qm->io_base + QM_DFX_CNT_CLR_CE);
++
++ regs = qm_dfx_regs;
++ for (i = 0; i < CNT_CYC_REGS_NUM; i++) {
++ readl(qm->io_base + regs->offset);
++ regs++;
++ }
++
++ /* clear clear_enable */
++ writel(0x0, qm->io_base + QM_DFX_CNT_CLR_CE);
++}
++EXPORT_SYMBOL_GPL(hisi_qm_debug_regs_clear);
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 0a5056108b94f..35c59818b3e7f 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -16,6 +16,7 @@
+ #include <linux/uaccess.h>
+ #include <uapi/misc/uacce/hisi_qm.h>
+ #include <linux/hisi_acc_qm.h>
++#include "qm_common.h"
+
+ /* eq/aeq irq enable */
+ #define QM_VF_AEQ_INT_SOURCE 0x0
+@@ -119,8 +120,6 @@
+ #define QM_SQC_VFT_NUM_SHIFT_V2 45
+ #define QM_SQC_VFT_NUM_MASK_v2 GENMASK(9, 0)
+
+-#define QM_DFX_CNT_CLR_CE 0x100118
+-
+ #define QM_ABNORMAL_INT_SOURCE 0x100000
+ #define QM_ABNORMAL_INT_MASK 0x100004
+ #define QM_ABNORMAL_INT_MASK_VALUE 0x7fff
+@@ -187,14 +186,6 @@
+ #define QM_VF_RESET_WAIT_TIMEOUT_US \
+ (QM_VF_RESET_WAIT_US * QM_VF_RESET_WAIT_CNT)
+
+-#define QM_DFX_MB_CNT_VF 0x104010
+-#define QM_DFX_DB_CNT_VF 0x104020
+-#define QM_DFX_SQE_CNT_VF_SQN 0x104030
+-#define QM_DFX_CQE_CNT_VF_CQN 0x104040
+-#define QM_DFX_QN_SHIFT 16
+-#define CURRENT_FUN_MASK GENMASK(5, 0)
+-#define CURRENT_Q_MASK GENMASK(31, 16)
+-
+ #define POLL_PERIOD 10
+ #define POLL_TIMEOUT 1000
+ #define WAIT_PERIOD_US_MAX 200
+@@ -211,19 +202,15 @@
+ #define QMC_ALIGN(sz) ALIGN(sz, 32)
+
+ #define QM_DBG_READ_LEN 256
+-#define QM_DBG_WRITE_LEN 1024
+-#define QM_DBG_TMP_BUF_LEN 22
+ #define QM_PCI_COMMAND_INVALID ~0
+ #define QM_RESET_STOP_TX_OFFSET 1
+ #define QM_RESET_STOP_RX_OFFSET 2
+
+ #define WAIT_PERIOD 20
+ #define REMOVE_WAIT_DELAY 10
+-#define QM_SQE_ADDR_MASK GENMASK(7, 0)
+
+ #define QM_DRIVER_REMOVING 0
+ #define QM_RST_SCHED 1
+-#define QM_RESETTING 2
+ #define QM_QOS_PARAM_NUM 2
+ #define QM_QOS_VAL_NUM 1
+ #define QM_QOS_BDF_PARAM_NUM 4
+@@ -250,15 +237,6 @@
+ #define QM_QOS_MIN_CIR_B 100
+ #define QM_QOS_MAX_CIR_U 6
+ #define QM_QOS_MAX_CIR_S 11
+-#define QM_DFX_BASE 0x0100000
+-#define QM_DFX_STATE1 0x0104000
+-#define QM_DFX_STATE2 0x01040C8
+-#define QM_DFX_COMMON 0x0000
+-#define QM_DFX_BASE_LEN 0x5A
+-#define QM_DFX_STATE1_LEN 0x2E
+-#define QM_DFX_STATE2_LEN 0x11
+-#define QM_DFX_COMMON_LEN 0xC3
+-#define QM_DFX_REGS_LEN 4UL
+ #define QM_AUTOSUSPEND_DELAY 3000
+
+ #define QM_MK_CQC_DW3_V1(hop_num, pg_sz, buf_sz, cqe_sz) \
+@@ -368,73 +346,6 @@ static const struct hisi_qm_cap_info qm_basic_info[] = {
+ {QM_VF_IRQ_NUM_CAP, 0x311c, 0, GENMASK(15, 0), 0x1, 0x2, 0x3},
+ };
+
+-struct qm_cqe {
+- __le32 rsvd0;
+- __le16 cmd_id;
+- __le16 rsvd1;
+- __le16 sq_head;
+- __le16 sq_num;
+- __le16 rsvd2;
+- __le16 w7;
+-};
+-
+-struct qm_eqe {
+- __le32 dw0;
+-};
+-
+-struct qm_aeqe {
+- __le32 dw0;
+-};
+-
+-struct qm_sqc {
+- __le16 head;
+- __le16 tail;
+- __le32 base_l;
+- __le32 base_h;
+- __le32 dw3;
+- __le16 w8;
+- __le16 rsvd0;
+- __le16 pasid;
+- __le16 w11;
+- __le16 cq_num;
+- __le16 w13;
+- __le32 rsvd1;
+-};
+-
+-struct qm_cqc {
+- __le16 head;
+- __le16 tail;
+- __le32 base_l;
+- __le32 base_h;
+- __le32 dw3;
+- __le16 w8;
+- __le16 rsvd0;
+- __le16 pasid;
+- __le16 w11;
+- __le32 dw6;
+- __le32 rsvd1;
+-};
+-
+-struct qm_eqc {
+- __le16 head;
+- __le16 tail;
+- __le32 base_l;
+- __le32 base_h;
+- __le32 dw3;
+- __le32 rsvd[2];
+- __le32 dw6;
+-};
+-
+-struct qm_aeqc {
+- __le16 head;
+- __le16 tail;
+- __le32 base_l;
+- __le32 base_h;
+- __le32 dw3;
+- __le32 rsvd[2];
+- __le32 dw6;
+-};
+-
+ struct qm_mailbox {
+ __le16 w0;
+ __le16 queue_num;
+@@ -467,25 +378,6 @@ struct hisi_qm_hw_ops {
+ int (*set_msi)(struct hisi_qm *qm, bool set);
+ };
+
+-struct qm_dfx_item {
+- const char *name;
+- u32 offset;
+-};
+-
+-static struct qm_dfx_item qm_dfx_files[] = {
+- {"err_irq", offsetof(struct qm_dfx, err_irq_cnt)},
+- {"aeq_irq", offsetof(struct qm_dfx, aeq_irq_cnt)},
+- {"abnormal_irq", offsetof(struct qm_dfx, abnormal_irq_cnt)},
+- {"create_qp_err", offsetof(struct qm_dfx, create_qp_err_cnt)},
+- {"mb_err", offsetof(struct qm_dfx, mb_err_cnt)},
+-};
+-
+-static const char * const qm_debug_file_name[] = {
+- [CURRENT_QM] = "current_qm",
+- [CURRENT_Q] = "current_q",
+- [CLEAR_ENABLE] = "clear_enable",
+-};
+-
+ struct hisi_qm_hw_error {
+ u32 int_msk;
+ const char *msg;
+@@ -510,23 +402,6 @@ static const struct hisi_qm_hw_error qm_hw_error[] = {
+ { /* sentinel */ }
+ };
+
+-/* define the QM's dfx regs region and region length */
+-static struct dfx_diff_registers qm_diff_regs[] = {
+- {
+- .reg_offset = QM_DFX_BASE,
+- .reg_len = QM_DFX_BASE_LEN,
+- }, {
+- .reg_offset = QM_DFX_STATE1,
+- .reg_len = QM_DFX_STATE1_LEN,
+- }, {
+- .reg_offset = QM_DFX_STATE2,
+- .reg_len = QM_DFX_STATE2_LEN,
+- }, {
+- .reg_offset = QM_DFX_COMMON,
+- .reg_len = QM_DFX_COMMON_LEN,
+- },
+-};
+-
+ static const char * const qm_db_timeout[] = {
+ "sq", "cq", "eq", "aeq",
+ };
+@@ -535,10 +410,6 @@ static const char * const qm_fifo_overflow[] = {
+ "cq", "eq", "aeq",
+ };
+
+-static const char * const qm_s[] = {
+- "init", "start", "close", "stop",
+-};
+-
+ static const char * const qp_s[] = {
+ "none", "init", "start", "stop", "close",
+ };
+@@ -1332,1046 +1203,150 @@ static void qm_vft_data_cfg(struct hisi_qm *qm, enum vft_type type, u32 base,
+ (QM_SHAPER_CBS_B << QM_SHAPER_FACTOR_CBS_B_SHIFT) |
+ (factor->cbs_s << QM_SHAPER_FACTOR_CBS_S_SHIFT);
+ }
+- break;
+- }
+- }
+-
+- writel(lower_32_bits(tmp), qm->io_base + QM_VFT_CFG_DATA_L);
+- writel(upper_32_bits(tmp), qm->io_base + QM_VFT_CFG_DATA_H);
+-}
+-
+-static int qm_set_vft_common(struct hisi_qm *qm, enum vft_type type,
+- u32 fun_num, u32 base, u32 number)
+-{
+- struct qm_shaper_factor *factor = NULL;
+- unsigned int val;
+- int ret;
+-
+- if (type == SHAPER_VFT && test_bit(QM_SUPPORT_FUNC_QOS, &qm->caps))
+- factor = &qm->factor[fun_num];
+-
+- ret = readl_relaxed_poll_timeout(qm->io_base + QM_VFT_CFG_RDY, val,
+- val & BIT(0), POLL_PERIOD,
+- POLL_TIMEOUT);
+- if (ret)
+- return ret;
+-
+- writel(0x0, qm->io_base + QM_VFT_CFG_OP_WR);
+- writel(type, qm->io_base + QM_VFT_CFG_TYPE);
+- if (type == SHAPER_VFT)
+- fun_num |= base << QM_SHAPER_VFT_OFFSET;
+-
+- writel(fun_num, qm->io_base + QM_VFT_CFG);
+-
+- qm_vft_data_cfg(qm, type, base, number, factor);
+-
+- writel(0x0, qm->io_base + QM_VFT_CFG_RDY);
+- writel(0x1, qm->io_base + QM_VFT_CFG_OP_ENABLE);
+-
+- return readl_relaxed_poll_timeout(qm->io_base + QM_VFT_CFG_RDY, val,
+- val & BIT(0), POLL_PERIOD,
+- POLL_TIMEOUT);
+-}
+-
+-static int qm_shaper_init_vft(struct hisi_qm *qm, u32 fun_num)
+-{
+- u32 qos = qm->factor[fun_num].func_qos;
+- int ret, i;
+-
+- ret = qm_get_shaper_para(qos * QM_QOS_RATE, &qm->factor[fun_num]);
+- if (ret) {
+- dev_err(&qm->pdev->dev, "failed to calculate shaper parameter!\n");
+- return ret;
+- }
+- writel(qm->type_rate, qm->io_base + QM_SHAPER_CFG);
+- for (i = ALG_TYPE_0; i <= ALG_TYPE_1; i++) {
+- /* The base number of queue reuse for different alg type */
+- ret = qm_set_vft_common(qm, SHAPER_VFT, fun_num, i, 1);
+- if (ret)
+- return ret;
+- }
+-
+- return 0;
+-}
+-
+-/* The config should be conducted after qm_dev_mem_reset() */
+-static int qm_set_sqc_cqc_vft(struct hisi_qm *qm, u32 fun_num, u32 base,
+- u32 number)
+-{
+- int ret, i;
+-
+- for (i = SQC_VFT; i <= CQC_VFT; i++) {
+- ret = qm_set_vft_common(qm, i, fun_num, base, number);
+- if (ret)
+- return ret;
+- }
+-
+- /* init default shaper qos val */
+- if (test_bit(QM_SUPPORT_FUNC_QOS, &qm->caps)) {
+- ret = qm_shaper_init_vft(qm, fun_num);
+- if (ret)
+- goto back_sqc_cqc;
+- }
+-
+- return 0;
+-back_sqc_cqc:
+- for (i = SQC_VFT; i <= CQC_VFT; i++)
+- qm_set_vft_common(qm, i, fun_num, 0, 0);
+-
+- return ret;
+-}
+-
+-static int qm_get_vft_v2(struct hisi_qm *qm, u32 *base, u32 *number)
+-{
+- u64 sqc_vft;
+- int ret;
+-
+- ret = hisi_qm_mb(qm, QM_MB_CMD_SQC_VFT_V2, 0, 0, 1);
+- if (ret)
+- return ret;
+-
+- sqc_vft = readl(qm->io_base + QM_MB_CMD_DATA_ADDR_L) |
+- ((u64)readl(qm->io_base + QM_MB_CMD_DATA_ADDR_H) << 32);
+- *base = QM_SQC_VFT_BASE_MASK_V2 & (sqc_vft >> QM_SQC_VFT_BASE_SHIFT_V2);
+- *number = (QM_SQC_VFT_NUM_MASK_v2 &
+- (sqc_vft >> QM_SQC_VFT_NUM_SHIFT_V2)) + 1;
+-
+- return 0;
+-}
+-
+-static int qm_get_vf_qp_num(struct hisi_qm *qm, u32 fun_num)
+-{
+- u32 remain_q_num, vfq_num;
+- u32 num_vfs = qm->vfs_num;
+-
+- vfq_num = (qm->ctrl_qp_num - qm->qp_num) / num_vfs;
+- if (vfq_num >= qm->max_qp_num)
+- return qm->max_qp_num;
+-
+- remain_q_num = (qm->ctrl_qp_num - qm->qp_num) % num_vfs;
+- if (vfq_num + remain_q_num <= qm->max_qp_num)
+- return fun_num == num_vfs ? vfq_num + remain_q_num : vfq_num;
+-
+- /*
+- * if vfq_num + remain_q_num > max_qp_num, the last VFs,
+- * each with one more queue.
+- */
+- return fun_num + remain_q_num > num_vfs ? vfq_num + 1 : vfq_num;
+-}
+-
+-static struct hisi_qm *file_to_qm(struct debugfs_file *file)
+-{
+- struct qm_debug *debug = file->debug;
+-
+- return container_of(debug, struct hisi_qm, debug);
+-}
+-
+-static u32 current_q_read(struct hisi_qm *qm)
+-{
+- return readl(qm->io_base + QM_DFX_SQE_CNT_VF_SQN) >> QM_DFX_QN_SHIFT;
+-}
+-
+-static int current_q_write(struct hisi_qm *qm, u32 val)
+-{
+- u32 tmp;
+-
+- if (val >= qm->debug.curr_qm_qp_num)
+- return -EINVAL;
+-
+- tmp = val << QM_DFX_QN_SHIFT |
+- (readl(qm->io_base + QM_DFX_SQE_CNT_VF_SQN) & CURRENT_FUN_MASK);
+- writel(tmp, qm->io_base + QM_DFX_SQE_CNT_VF_SQN);
+-
+- tmp = val << QM_DFX_QN_SHIFT |
+- (readl(qm->io_base + QM_DFX_CQE_CNT_VF_CQN) & CURRENT_FUN_MASK);
+- writel(tmp, qm->io_base + QM_DFX_CQE_CNT_VF_CQN);
+-
+- return 0;
+-}
+-
+-static u32 clear_enable_read(struct hisi_qm *qm)
+-{
+- return readl(qm->io_base + QM_DFX_CNT_CLR_CE);
+-}
+-
+-/* rd_clr_ctrl 1 enable read clear, otherwise 0 disable it */
+-static int clear_enable_write(struct hisi_qm *qm, u32 rd_clr_ctrl)
+-{
+- if (rd_clr_ctrl > 1)
+- return -EINVAL;
+-
+- writel(rd_clr_ctrl, qm->io_base + QM_DFX_CNT_CLR_CE);
+-
+- return 0;
+-}
+-
+-static u32 current_qm_read(struct hisi_qm *qm)
+-{
+- return readl(qm->io_base + QM_DFX_MB_CNT_VF);
+-}
+-
+-static int current_qm_write(struct hisi_qm *qm, u32 val)
+-{
+- u32 tmp;
+-
+- if (val > qm->vfs_num)
+- return -EINVAL;
+-
+- /* According PF or VF Dev ID to calculation curr_qm_qp_num and store */
+- if (!val)
+- qm->debug.curr_qm_qp_num = qm->qp_num;
+- else
+- qm->debug.curr_qm_qp_num = qm_get_vf_qp_num(qm, val);
+-
+- writel(val, qm->io_base + QM_DFX_MB_CNT_VF);
+- writel(val, qm->io_base + QM_DFX_DB_CNT_VF);
+-
+- tmp = val |
+- (readl(qm->io_base + QM_DFX_SQE_CNT_VF_SQN) & CURRENT_Q_MASK);
+- writel(tmp, qm->io_base + QM_DFX_SQE_CNT_VF_SQN);
+-
+- tmp = val |
+- (readl(qm->io_base + QM_DFX_CQE_CNT_VF_CQN) & CURRENT_Q_MASK);
+- writel(tmp, qm->io_base + QM_DFX_CQE_CNT_VF_CQN);
+-
+- return 0;
+-}
+-
+-static ssize_t qm_debug_read(struct file *filp, char __user *buf,
+- size_t count, loff_t *pos)
+-{
+- struct debugfs_file *file = filp->private_data;
+- enum qm_debug_file index = file->index;
+- struct hisi_qm *qm = file_to_qm(file);
+- char tbuf[QM_DBG_TMP_BUF_LEN];
+- u32 val;
+- int ret;
+-
+- ret = hisi_qm_get_dfx_access(qm);
+- if (ret)
+- return ret;
+-
+- mutex_lock(&file->lock);
+- switch (index) {
+- case CURRENT_QM:
+- val = current_qm_read(qm);
+- break;
+- case CURRENT_Q:
+- val = current_q_read(qm);
+- break;
+- case CLEAR_ENABLE:
+- val = clear_enable_read(qm);
+- break;
+- default:
+- goto err_input;
+- }
+- mutex_unlock(&file->lock);
+-
+- hisi_qm_put_dfx_access(qm);
+- ret = scnprintf(tbuf, QM_DBG_TMP_BUF_LEN, "%u\n", val);
+- return simple_read_from_buffer(buf, count, pos, tbuf, ret);
+-
+-err_input:
+- mutex_unlock(&file->lock);
+- hisi_qm_put_dfx_access(qm);
+- return -EINVAL;
+-}
+-
+-static ssize_t qm_debug_write(struct file *filp, const char __user *buf,
+- size_t count, loff_t *pos)
+-{
+- struct debugfs_file *file = filp->private_data;
+- enum qm_debug_file index = file->index;
+- struct hisi_qm *qm = file_to_qm(file);
+- unsigned long val;
+- char tbuf[QM_DBG_TMP_BUF_LEN];
+- int len, ret;
+-
+- if (*pos != 0)
+- return 0;
+-
+- if (count >= QM_DBG_TMP_BUF_LEN)
+- return -ENOSPC;
+-
+- len = simple_write_to_buffer(tbuf, QM_DBG_TMP_BUF_LEN - 1, pos, buf,
+- count);
+- if (len < 0)
+- return len;
+-
+- tbuf[len] = '\0';
+- if (kstrtoul(tbuf, 0, &val))
+- return -EFAULT;
+-
+- ret = hisi_qm_get_dfx_access(qm);
+- if (ret)
+- return ret;
+-
+- mutex_lock(&file->lock);
+- switch (index) {
+- case CURRENT_QM:
+- ret = current_qm_write(qm, val);
+- break;
+- case CURRENT_Q:
+- ret = current_q_write(qm, val);
+- break;
+- case CLEAR_ENABLE:
+- ret = clear_enable_write(qm, val);
+- break;
+- default:
+- ret = -EINVAL;
+- }
+- mutex_unlock(&file->lock);
+-
+- hisi_qm_put_dfx_access(qm);
+-
+- if (ret)
+- return ret;
+-
+- return count;
+-}
+-
+-static const struct file_operations qm_debug_fops = {
+- .owner = THIS_MODULE,
+- .open = simple_open,
+- .read = qm_debug_read,
+- .write = qm_debug_write,
+-};
+-
+-#define CNT_CYC_REGS_NUM 10
+-static const struct debugfs_reg32 qm_dfx_regs[] = {
+- /* XXX_CNT are reading clear register */
+- {"QM_ECC_1BIT_CNT ", 0x104000ull},
+- {"QM_ECC_MBIT_CNT ", 0x104008ull},
+- {"QM_DFX_MB_CNT ", 0x104018ull},
+- {"QM_DFX_DB_CNT ", 0x104028ull},
+- {"QM_DFX_SQE_CNT ", 0x104038ull},
+- {"QM_DFX_CQE_CNT ", 0x104048ull},
+- {"QM_DFX_SEND_SQE_TO_ACC_CNT ", 0x104050ull},
+- {"QM_DFX_WB_SQE_FROM_ACC_CNT ", 0x104058ull},
+- {"QM_DFX_ACC_FINISH_CNT ", 0x104060ull},
+- {"QM_DFX_CQE_ERR_CNT ", 0x1040b4ull},
+- {"QM_DFX_FUNS_ACTIVE_ST ", 0x200ull},
+- {"QM_ECC_1BIT_INF ", 0x104004ull},
+- {"QM_ECC_MBIT_INF ", 0x10400cull},
+- {"QM_DFX_ACC_RDY_VLD0 ", 0x1040a0ull},
+- {"QM_DFX_ACC_RDY_VLD1 ", 0x1040a4ull},
+- {"QM_DFX_AXI_RDY_VLD ", 0x1040a8ull},
+- {"QM_DFX_FF_ST0 ", 0x1040c8ull},
+- {"QM_DFX_FF_ST1 ", 0x1040ccull},
+- {"QM_DFX_FF_ST2 ", 0x1040d0ull},
+- {"QM_DFX_FF_ST3 ", 0x1040d4ull},
+- {"QM_DFX_FF_ST4 ", 0x1040d8ull},
+- {"QM_DFX_FF_ST5 ", 0x1040dcull},
+- {"QM_DFX_FF_ST6 ", 0x1040e0ull},
+- {"QM_IN_IDLE_ST ", 0x1040e4ull},
+-};
+-
+-static const struct debugfs_reg32 qm_vf_dfx_regs[] = {
+- {"QM_DFX_FUNS_ACTIVE_ST ", 0x200ull},
+-};
+-
+-/**
+- * hisi_qm_regs_dump() - Dump registers's value.
+- * @s: debugfs file handle.
+- * @regset: accelerator registers information.
+- *
+- * Dump accelerator registers.
+- */
+-void hisi_qm_regs_dump(struct seq_file *s, struct debugfs_regset32 *regset)
+-{
+- struct pci_dev *pdev = to_pci_dev(regset->dev);
+- struct hisi_qm *qm = pci_get_drvdata(pdev);
+- const struct debugfs_reg32 *regs = regset->regs;
+- int regs_len = regset->nregs;
+- int i, ret;
+- u32 val;
+-
+- ret = hisi_qm_get_dfx_access(qm);
+- if (ret)
+- return;
+-
+- for (i = 0; i < regs_len; i++) {
+- val = readl(regset->base + regs[i].offset);
+- seq_printf(s, "%s= 0x%08x\n", regs[i].name, val);
+- }
+-
+- hisi_qm_put_dfx_access(qm);
+-}
+-EXPORT_SYMBOL_GPL(hisi_qm_regs_dump);
+-
+-static int qm_regs_show(struct seq_file *s, void *unused)
+-{
+- struct hisi_qm *qm = s->private;
+- struct debugfs_regset32 regset;
+-
+- if (qm->fun_type == QM_HW_PF) {
+- regset.regs = qm_dfx_regs;
+- regset.nregs = ARRAY_SIZE(qm_dfx_regs);
+- } else {
+- regset.regs = qm_vf_dfx_regs;
+- regset.nregs = ARRAY_SIZE(qm_vf_dfx_regs);
+- }
+-
+- regset.base = qm->io_base;
+- regset.dev = &qm->pdev->dev;
+-
+- hisi_qm_regs_dump(s, ®set);
+-
+- return 0;
+-}
+-
+-DEFINE_SHOW_ATTRIBUTE(qm_regs);
+-
+-static void dfx_regs_uninit(struct hisi_qm *qm,
+- struct dfx_diff_registers *dregs, int reg_len)
+-{
+- int i;
+-
+- /* Setting the pointer is NULL to prevent double free */
+- for (i = 0; i < reg_len; i++) {
+- kfree(dregs[i].regs);
+- dregs[i].regs = NULL;
+- }
+- kfree(dregs);
+-}
+-
+-static struct dfx_diff_registers *dfx_regs_init(struct hisi_qm *qm,
+- const struct dfx_diff_registers *cregs, u32 reg_len)
+-{
+- struct dfx_diff_registers *diff_regs;
+- u32 j, base_offset;
+- int i;
+-
+- diff_regs = kcalloc(reg_len, sizeof(*diff_regs), GFP_KERNEL);
+- if (!diff_regs)
+- return ERR_PTR(-ENOMEM);
+-
+- for (i = 0; i < reg_len; i++) {
+- if (!cregs[i].reg_len)
+- continue;
+-
+- diff_regs[i].reg_offset = cregs[i].reg_offset;
+- diff_regs[i].reg_len = cregs[i].reg_len;
+- diff_regs[i].regs = kcalloc(QM_DFX_REGS_LEN, cregs[i].reg_len,
+- GFP_KERNEL);
+- if (!diff_regs[i].regs)
+- goto alloc_error;
+-
+- for (j = 0; j < diff_regs[i].reg_len; j++) {
+- base_offset = diff_regs[i].reg_offset +
+- j * QM_DFX_REGS_LEN;
+- diff_regs[i].regs[j] = readl(qm->io_base + base_offset);
+- }
+- }
+-
+- return diff_regs;
+-
+-alloc_error:
+- while (i > 0) {
+- i--;
+- kfree(diff_regs[i].regs);
+- }
+- kfree(diff_regs);
+- return ERR_PTR(-ENOMEM);
+-}
+-
+-static int qm_diff_regs_init(struct hisi_qm *qm,
+- struct dfx_diff_registers *dregs, u32 reg_len)
+-{
+- qm->debug.qm_diff_regs = dfx_regs_init(qm, qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
+- if (IS_ERR(qm->debug.qm_diff_regs))
+- return PTR_ERR(qm->debug.qm_diff_regs);
+-
+- qm->debug.acc_diff_regs = dfx_regs_init(qm, dregs, reg_len);
+- if (IS_ERR(qm->debug.acc_diff_regs)) {
+- dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
+- return PTR_ERR(qm->debug.acc_diff_regs);
+- }
+-
+- return 0;
+-}
+-
+-static void qm_last_regs_uninit(struct hisi_qm *qm)
+-{
+- struct qm_debug *debug = &qm->debug;
+-
+- if (qm->fun_type == QM_HW_VF || !debug->qm_last_words)
+- return;
+-
+- kfree(debug->qm_last_words);
+- debug->qm_last_words = NULL;
+-}
+-
+-static int qm_last_regs_init(struct hisi_qm *qm)
+-{
+- int dfx_regs_num = ARRAY_SIZE(qm_dfx_regs);
+- struct qm_debug *debug = &qm->debug;
+- int i;
+-
+- if (qm->fun_type == QM_HW_VF)
+- return 0;
+-
+- debug->qm_last_words = kcalloc(dfx_regs_num, sizeof(unsigned int), GFP_KERNEL);
+- if (!debug->qm_last_words)
+- return -ENOMEM;
+-
+- for (i = 0; i < dfx_regs_num; i++) {
+- debug->qm_last_words[i] = readl_relaxed(qm->io_base +
+- qm_dfx_regs[i].offset);
+- }
+-
+- return 0;
+-}
+-
+-static void qm_diff_regs_uninit(struct hisi_qm *qm, u32 reg_len)
+-{
+- dfx_regs_uninit(qm, qm->debug.acc_diff_regs, reg_len);
+- dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
+-}
+-
+-/**
+- * hisi_qm_regs_debugfs_init() - Allocate memory for registers.
+- * @qm: device qm handle.
+- * @dregs: diff registers handle.
+- * @reg_len: diff registers region length.
+- */
+-int hisi_qm_regs_debugfs_init(struct hisi_qm *qm,
+- struct dfx_diff_registers *dregs, u32 reg_len)
+-{
+- int ret;
+-
+- if (!qm || !dregs)
+- return -EINVAL;
+-
+- if (qm->fun_type != QM_HW_PF)
+- return 0;
+-
+- ret = qm_last_regs_init(qm);
+- if (ret) {
+- dev_info(&qm->pdev->dev, "failed to init qm words memory!\n");
+- return ret;
+- }
+-
+- ret = qm_diff_regs_init(qm, dregs, reg_len);
+- if (ret) {
+- qm_last_regs_uninit(qm);
+- return ret;
+- }
+-
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(hisi_qm_regs_debugfs_init);
+-
+-/**
+- * hisi_qm_regs_debugfs_uninit() - Free memory for registers.
+- * @qm: device qm handle.
+- * @reg_len: diff registers region length.
+- */
+-void hisi_qm_regs_debugfs_uninit(struct hisi_qm *qm, u32 reg_len)
+-{
+- if (!qm || qm->fun_type != QM_HW_PF)
+- return;
+-
+- qm_diff_regs_uninit(qm, reg_len);
+- qm_last_regs_uninit(qm);
+-}
+-EXPORT_SYMBOL_GPL(hisi_qm_regs_debugfs_uninit);
+-
+-/**
+- * hisi_qm_acc_diff_regs_dump() - Dump registers's value.
+- * @qm: device qm handle.
+- * @s: Debugfs file handle.
+- * @dregs: diff registers handle.
+- * @regs_len: diff registers region length.
+- */
+-void hisi_qm_acc_diff_regs_dump(struct hisi_qm *qm, struct seq_file *s,
+- struct dfx_diff_registers *dregs, u32 regs_len)
+-{
+- u32 j, val, base_offset;
+- int i, ret;
+-
+- if (!qm || !s || !dregs)
+- return;
+-
+- ret = hisi_qm_get_dfx_access(qm);
+- if (ret)
+- return;
+-
+- down_read(&qm->qps_lock);
+- for (i = 0; i < regs_len; i++) {
+- if (!dregs[i].reg_len)
+- continue;
+-
+- for (j = 0; j < dregs[i].reg_len; j++) {
+- base_offset = dregs[i].reg_offset + j * QM_DFX_REGS_LEN;
+- val = readl(qm->io_base + base_offset);
+- if (val != dregs[i].regs[j])
+- seq_printf(s, "0x%08x = 0x%08x ---> 0x%08x\n",
+- base_offset, dregs[i].regs[j], val);
+- }
+- }
+- up_read(&qm->qps_lock);
+-
+- hisi_qm_put_dfx_access(qm);
+-}
+-EXPORT_SYMBOL_GPL(hisi_qm_acc_diff_regs_dump);
+-
+-static int qm_diff_regs_show(struct seq_file *s, void *unused)
+-{
+- struct hisi_qm *qm = s->private;
+-
+- hisi_qm_acc_diff_regs_dump(qm, s, qm->debug.qm_diff_regs,
+- ARRAY_SIZE(qm_diff_regs));
+-
+- return 0;
+-}
+-DEFINE_SHOW_ATTRIBUTE(qm_diff_regs);
+-
+-static ssize_t qm_cmd_read(struct file *filp, char __user *buffer,
+- size_t count, loff_t *pos)
+-{
+- char buf[QM_DBG_READ_LEN];
+- int len;
+-
+- len = scnprintf(buf, QM_DBG_READ_LEN, "%s\n",
+- "Please echo help to cmd to get help information");
+-
+- return simple_read_from_buffer(buffer, count, pos, buf, len);
+-}
+-
+-static void *qm_ctx_alloc(struct hisi_qm *qm, size_t ctx_size,
+- dma_addr_t *dma_addr)
+-{
+- struct device *dev = &qm->pdev->dev;
+- void *ctx_addr;
+-
+- ctx_addr = kzalloc(ctx_size, GFP_KERNEL);
+- if (!ctx_addr)
+- return ERR_PTR(-ENOMEM);
+-
+- *dma_addr = dma_map_single(dev, ctx_addr, ctx_size, DMA_FROM_DEVICE);
+- if (dma_mapping_error(dev, *dma_addr)) {
+- dev_err(dev, "DMA mapping error!\n");
+- kfree(ctx_addr);
+- return ERR_PTR(-ENOMEM);
+- }
+-
+- return ctx_addr;
+-}
+-
+-static void qm_ctx_free(struct hisi_qm *qm, size_t ctx_size,
+- const void *ctx_addr, dma_addr_t *dma_addr)
+-{
+- struct device *dev = &qm->pdev->dev;
+-
+- dma_unmap_single(dev, *dma_addr, ctx_size, DMA_FROM_DEVICE);
+- kfree(ctx_addr);
+-}
+-
+-static void dump_show(struct hisi_qm *qm, void *info,
+- unsigned int info_size, char *info_name)
+-{
+- struct device *dev = &qm->pdev->dev;
+- u8 *info_curr = info;
+- u32 i;
+-#define BYTE_PER_DW 4
+-
+- dev_info(dev, "%s DUMP\n", info_name);
+- for (i = 0; i < info_size; i += BYTE_PER_DW, info_curr += BYTE_PER_DW) {
+- pr_info("DW%u: %02X%02X %02X%02X\n", i / BYTE_PER_DW,
+- *(info_curr + 3), *(info_curr + 2), *(info_curr + 1), *(info_curr));
+- }
+-}
+-
+-static int qm_dump_sqc_raw(struct hisi_qm *qm, dma_addr_t dma_addr, u16 qp_id)
+-{
+- return hisi_qm_mb(qm, QM_MB_CMD_SQC, dma_addr, qp_id, 1);
+-}
+-
+-static int qm_dump_cqc_raw(struct hisi_qm *qm, dma_addr_t dma_addr, u16 qp_id)
+-{
+- return hisi_qm_mb(qm, QM_MB_CMD_CQC, dma_addr, qp_id, 1);
+-}
+-
+-static int qm_sqc_dump(struct hisi_qm *qm, const char *s)
+-{
+- struct device *dev = &qm->pdev->dev;
+- struct qm_sqc *sqc, *sqc_curr;
+- dma_addr_t sqc_dma;
+- u32 qp_id;
+- int ret;
+-
+- if (!s)
+- return -EINVAL;
+-
+- ret = kstrtou32(s, 0, &qp_id);
+- if (ret || qp_id >= qm->qp_num) {
+- dev_err(dev, "Please input qp num (0-%u)", qm->qp_num - 1);
+- return -EINVAL;
+- }
+-
+- sqc = qm_ctx_alloc(qm, sizeof(*sqc), &sqc_dma);
+- if (IS_ERR(sqc))
+- return PTR_ERR(sqc);
+-
+- ret = qm_dump_sqc_raw(qm, sqc_dma, qp_id);
+- if (ret) {
+- down_read(&qm->qps_lock);
+- if (qm->sqc) {
+- sqc_curr = qm->sqc + qp_id;
+-
+- dump_show(qm, sqc_curr, sizeof(*sqc), "SOFT SQC");
+- }
+- up_read(&qm->qps_lock);
+-
+- goto free_ctx;
+- }
+-
+- dump_show(qm, sqc, sizeof(*sqc), "SQC");
+-
+-free_ctx:
+- qm_ctx_free(qm, sizeof(*sqc), sqc, &sqc_dma);
+- return 0;
+-}
+-
+-static int qm_cqc_dump(struct hisi_qm *qm, const char *s)
+-{
+- struct device *dev = &qm->pdev->dev;
+- struct qm_cqc *cqc, *cqc_curr;
+- dma_addr_t cqc_dma;
+- u32 qp_id;
+- int ret;
+-
+- if (!s)
+- return -EINVAL;
+-
+- ret = kstrtou32(s, 0, &qp_id);
+- if (ret || qp_id >= qm->qp_num) {
+- dev_err(dev, "Please input qp num (0-%u)", qm->qp_num - 1);
+- return -EINVAL;
+- }
+-
+- cqc = qm_ctx_alloc(qm, sizeof(*cqc), &cqc_dma);
+- if (IS_ERR(cqc))
+- return PTR_ERR(cqc);
+-
+- ret = qm_dump_cqc_raw(qm, cqc_dma, qp_id);
+- if (ret) {
+- down_read(&qm->qps_lock);
+- if (qm->cqc) {
+- cqc_curr = qm->cqc + qp_id;
+-
+- dump_show(qm, cqc_curr, sizeof(*cqc), "SOFT CQC");
++ break;
+ }
+- up_read(&qm->qps_lock);
+-
+- goto free_ctx;
+ }
+
+- dump_show(qm, cqc, sizeof(*cqc), "CQC");
+-
+-free_ctx:
+- qm_ctx_free(qm, sizeof(*cqc), cqc, &cqc_dma);
+- return 0;
++ writel(lower_32_bits(tmp), qm->io_base + QM_VFT_CFG_DATA_L);
++ writel(upper_32_bits(tmp), qm->io_base + QM_VFT_CFG_DATA_H);
+ }
+
+-static int qm_eqc_aeqc_dump(struct hisi_qm *qm, char *s, size_t size,
+- int cmd, char *name)
++static int qm_set_vft_common(struct hisi_qm *qm, enum vft_type type,
++ u32 fun_num, u32 base, u32 number)
+ {
+- struct device *dev = &qm->pdev->dev;
+- dma_addr_t xeqc_dma;
+- void *xeqc;
++ struct qm_shaper_factor *factor = NULL;
++ unsigned int val;
+ int ret;
+
+- if (strsep(&s, " ")) {
+- dev_err(dev, "Please do not input extra characters!\n");
+- return -EINVAL;
+- }
+-
+- xeqc = qm_ctx_alloc(qm, size, &xeqc_dma);
+- if (IS_ERR(xeqc))
+- return PTR_ERR(xeqc);
++ if (type == SHAPER_VFT && test_bit(QM_SUPPORT_FUNC_QOS, &qm->caps))
++ factor = &qm->factor[fun_num];
+
+- ret = hisi_qm_mb(qm, cmd, xeqc_dma, 0, 1);
++ ret = readl_relaxed_poll_timeout(qm->io_base + QM_VFT_CFG_RDY, val,
++ val & BIT(0), POLL_PERIOD,
++ POLL_TIMEOUT);
+ if (ret)
+- goto err_free_ctx;
++ return ret;
+
+- dump_show(qm, xeqc, size, name);
++ writel(0x0, qm->io_base + QM_VFT_CFG_OP_WR);
++ writel(type, qm->io_base + QM_VFT_CFG_TYPE);
++ if (type == SHAPER_VFT)
++ fun_num |= base << QM_SHAPER_VFT_OFFSET;
+
+-err_free_ctx:
+- qm_ctx_free(qm, size, xeqc, &xeqc_dma);
+- return ret;
+-}
++ writel(fun_num, qm->io_base + QM_VFT_CFG);
+
+-static int q_dump_param_parse(struct hisi_qm *qm, char *s,
+- u32 *e_id, u32 *q_id, u16 q_depth)
+-{
+- struct device *dev = &qm->pdev->dev;
+- unsigned int qp_num = qm->qp_num;
+- char *presult;
+- int ret;
++ qm_vft_data_cfg(qm, type, base, number, factor);
+
+- presult = strsep(&s, " ");
+- if (!presult) {
+- dev_err(dev, "Please input qp number!\n");
+- return -EINVAL;
+- }
++ writel(0x0, qm->io_base + QM_VFT_CFG_RDY);
++ writel(0x1, qm->io_base + QM_VFT_CFG_OP_ENABLE);
+
+- ret = kstrtou32(presult, 0, q_id);
+- if (ret || *q_id >= qp_num) {
+- dev_err(dev, "Please input qp num (0-%u)", qp_num - 1);
+- return -EINVAL;
+- }
++ return readl_relaxed_poll_timeout(qm->io_base + QM_VFT_CFG_RDY, val,
++ val & BIT(0), POLL_PERIOD,
++ POLL_TIMEOUT);
++}
+
+- presult = strsep(&s, " ");
+- if (!presult) {
+- dev_err(dev, "Please input sqe number!\n");
+- return -EINVAL;
+- }
++static int qm_shaper_init_vft(struct hisi_qm *qm, u32 fun_num)
++{
++ u32 qos = qm->factor[fun_num].func_qos;
++ int ret, i;
+
+- ret = kstrtou32(presult, 0, e_id);
+- if (ret || *e_id >= q_depth) {
+- dev_err(dev, "Please input sqe num (0-%u)", q_depth - 1);
+- return -EINVAL;
++ ret = qm_get_shaper_para(qos * QM_QOS_RATE, &qm->factor[fun_num]);
++ if (ret) {
++ dev_err(&qm->pdev->dev, "failed to calculate shaper parameter!\n");
++ return ret;
+ }
+-
+- if (strsep(&s, " ")) {
+- dev_err(dev, "Please do not input extra characters!\n");
+- return -EINVAL;
++ writel(qm->type_rate, qm->io_base + QM_SHAPER_CFG);
++ for (i = ALG_TYPE_0; i <= ALG_TYPE_1; i++) {
++ /* The base number of queue reuse for different alg type */
++ ret = qm_set_vft_common(qm, SHAPER_VFT, fun_num, i, 1);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+ }
+
+-static int qm_sq_dump(struct hisi_qm *qm, char *s)
++/* The config should be conducted after qm_dev_mem_reset() */
++static int qm_set_sqc_cqc_vft(struct hisi_qm *qm, u32 fun_num, u32 base,
++ u32 number)
+ {
+- u16 sq_depth = qm->qp_array->cq_depth;
+- void *sqe, *sqe_curr;
+- struct hisi_qp *qp;
+- u32 qp_id, sqe_id;
+- int ret;
+-
+- ret = q_dump_param_parse(qm, s, &sqe_id, &qp_id, sq_depth);
+- if (ret)
+- return ret;
+-
+- sqe = kzalloc(qm->sqe_size * sq_depth, GFP_KERNEL);
+- if (!sqe)
+- return -ENOMEM;
+-
+- qp = &qm->qp_array[qp_id];
+- memcpy(sqe, qp->sqe, qm->sqe_size * sq_depth);
+- sqe_curr = sqe + (u32)(sqe_id * qm->sqe_size);
+- memset(sqe_curr + qm->debug.sqe_mask_offset, QM_SQE_ADDR_MASK,
+- qm->debug.sqe_mask_len);
++ int ret, i;
+
+- dump_show(qm, sqe_curr, qm->sqe_size, "SQE");
++ for (i = SQC_VFT; i <= CQC_VFT; i++) {
++ ret = qm_set_vft_common(qm, i, fun_num, base, number);
++ if (ret)
++ return ret;
++ }
+
+- kfree(sqe);
++ /* init default shaper qos val */
++ if (test_bit(QM_SUPPORT_FUNC_QOS, &qm->caps)) {
++ ret = qm_shaper_init_vft(qm, fun_num);
++ if (ret)
++ goto back_sqc_cqc;
++ }
+
+ return 0;
++back_sqc_cqc:
++ for (i = SQC_VFT; i <= CQC_VFT; i++)
++ qm_set_vft_common(qm, i, fun_num, 0, 0);
++
++ return ret;
+ }
+
+-static int qm_cq_dump(struct hisi_qm *qm, char *s)
++static int qm_get_vft_v2(struct hisi_qm *qm, u32 *base, u32 *number)
+ {
+- struct qm_cqe *cqe_curr;
+- struct hisi_qp *qp;
+- u32 qp_id, cqe_id;
++ u64 sqc_vft;
+ int ret;
+
+- ret = q_dump_param_parse(qm, s, &cqe_id, &qp_id, qm->qp_array->cq_depth);
++ ret = hisi_qm_mb(qm, QM_MB_CMD_SQC_VFT_V2, 0, 0, 1);
+ if (ret)
+ return ret;
+
+- qp = &qm->qp_array[qp_id];
+- cqe_curr = qp->cqe + cqe_id;
+- dump_show(qm, cqe_curr, sizeof(struct qm_cqe), "CQE");
++ sqc_vft = readl(qm->io_base + QM_MB_CMD_DATA_ADDR_L) |
++ ((u64)readl(qm->io_base + QM_MB_CMD_DATA_ADDR_H) << 32);
++ *base = QM_SQC_VFT_BASE_MASK_V2 & (sqc_vft >> QM_SQC_VFT_BASE_SHIFT_V2);
++ *number = (QM_SQC_VFT_NUM_MASK_v2 &
++ (sqc_vft >> QM_SQC_VFT_NUM_SHIFT_V2)) + 1;
+
+ return 0;
+ }
+
+-static int qm_eq_aeq_dump(struct hisi_qm *qm, const char *s,
+- size_t size, char *name)
++void *hisi_qm_ctx_alloc(struct hisi_qm *qm, size_t ctx_size,
++ dma_addr_t *dma_addr)
+ {
+ struct device *dev = &qm->pdev->dev;
+- void *xeqe;
+- u32 xeqe_id;
+- int ret;
+-
+- if (!s)
+- return -EINVAL;
+-
+- ret = kstrtou32(s, 0, &xeqe_id);
+- if (ret)
+- return -EINVAL;
+-
+- if (!strcmp(name, "EQE") && xeqe_id >= qm->eq_depth) {
+- dev_err(dev, "Please input eqe num (0-%u)", qm->eq_depth - 1);
+- return -EINVAL;
+- } else if (!strcmp(name, "AEQE") && xeqe_id >= qm->aeq_depth) {
+- dev_err(dev, "Please input aeqe num (0-%u)", qm->eq_depth - 1);
+- return -EINVAL;
+- }
+-
+- down_read(&qm->qps_lock);
+-
+- if (qm->eqe && !strcmp(name, "EQE")) {
+- xeqe = qm->eqe + xeqe_id;
+- } else if (qm->aeqe && !strcmp(name, "AEQE")) {
+- xeqe = qm->aeqe + xeqe_id;
+- } else {
+- ret = -EINVAL;
+- goto err_unlock;
+- }
+-
+- dump_show(qm, xeqe, size, name);
+-
+-err_unlock:
+- up_read(&qm->qps_lock);
+- return ret;
+-}
++ void *ctx_addr;
+
+-static int qm_dbg_help(struct hisi_qm *qm, char *s)
+-{
+- struct device *dev = &qm->pdev->dev;
++ ctx_addr = kzalloc(ctx_size, GFP_KERNEL);
++ if (!ctx_addr)
++ return ERR_PTR(-ENOMEM);
+
+- if (strsep(&s, " ")) {
+- dev_err(dev, "Please do not input extra characters!\n");
+- return -EINVAL;
++ *dma_addr = dma_map_single(dev, ctx_addr, ctx_size, DMA_FROM_DEVICE);
++ if (dma_mapping_error(dev, *dma_addr)) {
++ dev_err(dev, "DMA mapping error!\n");
++ kfree(ctx_addr);
++ return ERR_PTR(-ENOMEM);
+ }
+
+- dev_info(dev, "available commands:\n");
+- dev_info(dev, "sqc <num>\n");
+- dev_info(dev, "cqc <num>\n");
+- dev_info(dev, "eqc\n");
+- dev_info(dev, "aeqc\n");
+- dev_info(dev, "sq <num> <e>\n");
+- dev_info(dev, "cq <num> <e>\n");
+- dev_info(dev, "eq <e>\n");
+- dev_info(dev, "aeq <e>\n");
+-
+- return 0;
++ return ctx_addr;
+ }
+
+-static int qm_cmd_write_dump(struct hisi_qm *qm, const char *cmd_buf)
++void hisi_qm_ctx_free(struct hisi_qm *qm, size_t ctx_size,
++ const void *ctx_addr, dma_addr_t *dma_addr)
+ {
+ struct device *dev = &qm->pdev->dev;
+- char *presult, *s, *s_tmp;
+- int ret;
+-
+- s = kstrdup(cmd_buf, GFP_KERNEL);
+- if (!s)
+- return -ENOMEM;
+-
+- s_tmp = s;
+- presult = strsep(&s, " ");
+- if (!presult) {
+- ret = -EINVAL;
+- goto err_buffer_free;
+- }
+-
+- if (!strcmp(presult, "sqc"))
+- ret = qm_sqc_dump(qm, s);
+- else if (!strcmp(presult, "cqc"))
+- ret = qm_cqc_dump(qm, s);
+- else if (!strcmp(presult, "eqc"))
+- ret = qm_eqc_aeqc_dump(qm, s, sizeof(struct qm_eqc),
+- QM_MB_CMD_EQC, "EQC");
+- else if (!strcmp(presult, "aeqc"))
+- ret = qm_eqc_aeqc_dump(qm, s, sizeof(struct qm_aeqc),
+- QM_MB_CMD_AEQC, "AEQC");
+- else if (!strcmp(presult, "sq"))
+- ret = qm_sq_dump(qm, s);
+- else if (!strcmp(presult, "cq"))
+- ret = qm_cq_dump(qm, s);
+- else if (!strcmp(presult, "eq"))
+- ret = qm_eq_aeq_dump(qm, s, sizeof(struct qm_eqe), "EQE");
+- else if (!strcmp(presult, "aeq"))
+- ret = qm_eq_aeq_dump(qm, s, sizeof(struct qm_aeqe), "AEQE");
+- else if (!strcmp(presult, "help"))
+- ret = qm_dbg_help(qm, s);
+- else
+- ret = -EINVAL;
+-
+- if (ret)
+- dev_info(dev, "Please echo help\n");
+-
+-err_buffer_free:
+- kfree(s_tmp);
+
+- return ret;
++ dma_unmap_single(dev, *dma_addr, ctx_size, DMA_FROM_DEVICE);
++ kfree(ctx_addr);
+ }
+
+-static ssize_t qm_cmd_write(struct file *filp, const char __user *buffer,
+- size_t count, loff_t *pos)
++static int qm_dump_sqc_raw(struct hisi_qm *qm, dma_addr_t dma_addr, u16 qp_id)
+ {
+- struct hisi_qm *qm = filp->private_data;
+- char *cmd_buf, *cmd_buf_tmp;
+- int ret;
+-
+- if (*pos)
+- return 0;
+-
+- ret = hisi_qm_get_dfx_access(qm);
+- if (ret)
+- return ret;
+-
+- /* Judge if the instance is being reset. */
+- if (unlikely(atomic_read(&qm->status.flags) == QM_STOP)) {
+- ret = 0;
+- goto put_dfx_access;
+- }
+-
+- if (count > QM_DBG_WRITE_LEN) {
+- ret = -ENOSPC;
+- goto put_dfx_access;
+- }
+-
+- cmd_buf = memdup_user_nul(buffer, count);
+- if (IS_ERR(cmd_buf)) {
+- ret = PTR_ERR(cmd_buf);
+- goto put_dfx_access;
+- }
+-
+- cmd_buf_tmp = strchr(cmd_buf, '\n');
+- if (cmd_buf_tmp) {
+- *cmd_buf_tmp = '\0';
+- count = cmd_buf_tmp - cmd_buf + 1;
+- }
+-
+- ret = qm_cmd_write_dump(qm, cmd_buf);
+- if (ret) {
+- kfree(cmd_buf);
+- goto put_dfx_access;
+- }
+-
+- kfree(cmd_buf);
+-
+- ret = count;
+-
+-put_dfx_access:
+- hisi_qm_put_dfx_access(qm);
+- return ret;
++ return hisi_qm_mb(qm, QM_MB_CMD_SQC, dma_addr, qp_id, 1);
+ }
+
+-static const struct file_operations qm_cmd_fops = {
+- .owner = THIS_MODULE,
+- .open = simple_open,
+- .read = qm_cmd_read,
+- .write = qm_cmd_write,
+-};
+-
+-static void qm_create_debugfs_file(struct hisi_qm *qm, struct dentry *dir,
+- enum qm_debug_file index)
++static int qm_dump_cqc_raw(struct hisi_qm *qm, dma_addr_t dma_addr, u16 qp_id)
+ {
+- struct debugfs_file *file = qm->debug.files + index;
+-
+- debugfs_create_file(qm_debug_file_name[index], 0600, dir, file,
+- &qm_debug_fops);
+-
+- file->index = index;
+- mutex_init(&file->lock);
+- file->debug = &qm->debug;
++ return hisi_qm_mb(qm, QM_MB_CMD_CQC, dma_addr, qp_id, 1);
+ }
+
+ static void qm_hw_error_init_v1(struct hisi_qm *qm)
+@@ -3155,7 +2130,7 @@ static int qm_drain_qp(struct hisi_qp *qp)
+ return ret;
+ }
+
+- addr = qm_ctx_alloc(qm, size, &dma_addr);
++ addr = hisi_qm_ctx_alloc(qm, size, &dma_addr);
+ if (IS_ERR(addr)) {
+ dev_err(dev, "Failed to alloc ctx for sqc and cqc!\n");
+ return -ENOMEM;
+@@ -3190,7 +2165,7 @@ static int qm_drain_qp(struct hisi_qp *qp)
+ usleep_range(WAIT_PERIOD_US_MIN, WAIT_PERIOD_US_MAX);
+ }
+
+- qm_ctx_free(qm, size, addr, &dma_addr);
++ hisi_qm_ctx_free(qm, size, addr, &dma_addr);
+
+ return ret;
+ }
+@@ -4173,45 +3148,6 @@ int hisi_qm_stop(struct hisi_qm *qm, enum qm_stop_reason r)
+ }
+ EXPORT_SYMBOL_GPL(hisi_qm_stop);
+
+-static ssize_t qm_status_read(struct file *filp, char __user *buffer,
+- size_t count, loff_t *pos)
+-{
+- struct hisi_qm *qm = filp->private_data;
+- char buf[QM_DBG_READ_LEN];
+- int val, len;
+-
+- val = atomic_read(&qm->status.flags);
+- len = scnprintf(buf, QM_DBG_READ_LEN, "%s\n", qm_s[val]);
+-
+- return simple_read_from_buffer(buffer, count, pos, buf, len);
+-}
+-
+-static const struct file_operations qm_status_fops = {
+- .owner = THIS_MODULE,
+- .open = simple_open,
+- .read = qm_status_read,
+-};
+-
+-static int qm_debugfs_atomic64_set(void *data, u64 val)
+-{
+- if (val)
+- return -EINVAL;
+-
+- atomic64_set((atomic64_t *)data, 0);
+-
+- return 0;
+-}
+-
+-static int qm_debugfs_atomic64_get(void *data, u64 *val)
+-{
+- *val = atomic64_read((atomic64_t *)data);
+-
+- return 0;
+-}
+-
+-DEFINE_DEBUGFS_ATTRIBUTE(qm_atomic64_ops, qm_debugfs_atomic64_get,
+- qm_debugfs_atomic64_set, "%llu\n");
+-
+ static void qm_hw_error_init(struct hisi_qm *qm)
+ {
+ if (!qm->ops->hw_error_init) {
+@@ -4750,7 +3686,7 @@ static const struct file_operations qm_algqos_fops = {
+ *
+ * Create function qos debugfs files, VF ping PF to get function qos.
+ */
+-static void hisi_qm_set_algqos_init(struct hisi_qm *qm)
++void hisi_qm_set_algqos_init(struct hisi_qm *qm)
+ {
+ if (qm->fun_type == QM_HW_PF)
+ debugfs_create_file("alg_qos", 0644, qm->debug.debug_root,
+@@ -4760,88 +3696,6 @@ static void hisi_qm_set_algqos_init(struct hisi_qm *qm)
+ qm, &qm_algqos_fops);
+ }
+
+-/**
+- * hisi_qm_debug_init() - Initialize qm related debugfs files.
+- * @qm: The qm for which we want to add debugfs files.
+- *
+- * Create qm related debugfs files.
+- */
+-void hisi_qm_debug_init(struct hisi_qm *qm)
+-{
+- struct dfx_diff_registers *qm_regs = qm->debug.qm_diff_regs;
+- struct qm_dfx *dfx = &qm->debug.dfx;
+- struct dentry *qm_d;
+- void *data;
+- int i;
+-
+- qm_d = debugfs_create_dir("qm", qm->debug.debug_root);
+- qm->debug.qm_d = qm_d;
+-
+- /* only show this in PF */
+- if (qm->fun_type == QM_HW_PF) {
+- qm_create_debugfs_file(qm, qm->debug.debug_root, CURRENT_QM);
+- for (i = CURRENT_Q; i < DEBUG_FILE_NUM; i++)
+- qm_create_debugfs_file(qm, qm->debug.qm_d, i);
+- }
+-
+- if (qm_regs)
+- debugfs_create_file("diff_regs", 0444, qm->debug.qm_d,
+- qm, &qm_diff_regs_fops);
+-
+- debugfs_create_file("regs", 0444, qm->debug.qm_d, qm, &qm_regs_fops);
+-
+- debugfs_create_file("cmd", 0600, qm->debug.qm_d, qm, &qm_cmd_fops);
+-
+- debugfs_create_file("status", 0444, qm->debug.qm_d, qm,
+- &qm_status_fops);
+- for (i = 0; i < ARRAY_SIZE(qm_dfx_files); i++) {
+- data = (atomic64_t *)((uintptr_t)dfx + qm_dfx_files[i].offset);
+- debugfs_create_file(qm_dfx_files[i].name,
+- 0644,
+- qm_d,
+- data,
+- &qm_atomic64_ops);
+- }
+-
+- if (test_bit(QM_SUPPORT_FUNC_QOS, &qm->caps))
+- hisi_qm_set_algqos_init(qm);
+-}
+-EXPORT_SYMBOL_GPL(hisi_qm_debug_init);
+-
+-/**
+- * hisi_qm_debug_regs_clear() - clear qm debug related registers.
+- * @qm: The qm for which we want to clear its debug registers.
+- */
+-void hisi_qm_debug_regs_clear(struct hisi_qm *qm)
+-{
+- const struct debugfs_reg32 *regs;
+- int i;
+-
+- /* clear current_qm */
+- writel(0x0, qm->io_base + QM_DFX_MB_CNT_VF);
+- writel(0x0, qm->io_base + QM_DFX_DB_CNT_VF);
+-
+- /* clear current_q */
+- writel(0x0, qm->io_base + QM_DFX_SQE_CNT_VF_SQN);
+- writel(0x0, qm->io_base + QM_DFX_CQE_CNT_VF_CQN);
+-
+- /*
+- * these registers are reading and clearing, so clear them after
+- * reading them.
+- */
+- writel(0x1, qm->io_base + QM_DFX_CNT_CLR_CE);
+-
+- regs = qm_dfx_regs;
+- for (i = 0; i < CNT_CYC_REGS_NUM; i++) {
+- readl(qm->io_base + regs->offset);
+- regs++;
+- }
+-
+- /* clear clear_enable */
+- writel(0x0, qm->io_base + QM_DFX_CNT_CLR_CE);
+-}
+-EXPORT_SYMBOL_GPL(hisi_qm_debug_regs_clear);
+-
+ static void hisi_qm_init_vf_qos(struct hisi_qm *qm, int total_func)
+ {
+ int i;
+@@ -5480,24 +4334,6 @@ static int qm_controller_reset_done(struct hisi_qm *qm)
+ return 0;
+ }
+
+-static void qm_show_last_dfx_regs(struct hisi_qm *qm)
+-{
+- struct qm_debug *debug = &qm->debug;
+- struct pci_dev *pdev = qm->pdev;
+- u32 val;
+- int i;
+-
+- if (qm->fun_type == QM_HW_VF || !debug->qm_last_words)
+- return;
+-
+- for (i = 0; i < ARRAY_SIZE(qm_dfx_regs); i++) {
+- val = readl_relaxed(qm->io_base + qm_dfx_regs[i].offset);
+- if (debug->qm_last_words[i] != val)
+- pci_info(pdev, "%s \t= 0x%08x => 0x%08x\n",
+- qm_dfx_regs[i].name, debug->qm_last_words[i], val);
+- }
+-}
+-
+ static int qm_controller_reset(struct hisi_qm *qm)
+ {
+ struct pci_dev *pdev = qm->pdev;
+@@ -5513,7 +4349,7 @@ static int qm_controller_reset(struct hisi_qm *qm)
+ return ret;
+ }
+
+- qm_show_last_dfx_regs(qm);
++ hisi_qm_show_last_dfx_regs(qm);
+ if (qm->err_ini->show_last_dfx_regs)
+ qm->err_ini->show_last_dfx_regs(qm);
+
+diff --git a/drivers/crypto/hisilicon/qm_common.h b/drivers/crypto/hisilicon/qm_common.h
+new file mode 100644
+index 0000000000000..1406a422d4551
+--- /dev/null
++++ b/drivers/crypto/hisilicon/qm_common.h
+@@ -0,0 +1,87 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright (c) 2022 HiSilicon Limited. */
++#ifndef QM_COMMON_H
++#define QM_COMMON_H
++
++#define QM_DBG_READ_LEN 256
++#define QM_RESETTING 2
++
++struct qm_cqe {
++ __le32 rsvd0;
++ __le16 cmd_id;
++ __le16 rsvd1;
++ __le16 sq_head;
++ __le16 sq_num;
++ __le16 rsvd2;
++ __le16 w7;
++};
++
++struct qm_eqe {
++ __le32 dw0;
++};
++
++struct qm_aeqe {
++ __le32 dw0;
++};
++
++struct qm_sqc {
++ __le16 head;
++ __le16 tail;
++ __le32 base_l;
++ __le32 base_h;
++ __le32 dw3;
++ __le16 w8;
++ __le16 rsvd0;
++ __le16 pasid;
++ __le16 w11;
++ __le16 cq_num;
++ __le16 w13;
++ __le32 rsvd1;
++};
++
++struct qm_cqc {
++ __le16 head;
++ __le16 tail;
++ __le32 base_l;
++ __le32 base_h;
++ __le32 dw3;
++ __le16 w8;
++ __le16 rsvd0;
++ __le16 pasid;
++ __le16 w11;
++ __le32 dw6;
++ __le32 rsvd1;
++};
++
++struct qm_eqc {
++ __le16 head;
++ __le16 tail;
++ __le32 base_l;
++ __le32 base_h;
++ __le32 dw3;
++ __le32 rsvd[2];
++ __le32 dw6;
++};
++
++struct qm_aeqc {
++ __le16 head;
++ __le16 tail;
++ __le32 base_l;
++ __le32 base_h;
++ __le32 dw3;
++ __le32 rsvd[2];
++ __le32 dw6;
++};
++
++static const char * const qm_s[] = {
++ "init", "start", "close", "stop",
++};
++
++void *hisi_qm_ctx_alloc(struct hisi_qm *qm, size_t ctx_size,
++ dma_addr_t *dma_addr);
++void hisi_qm_ctx_free(struct hisi_qm *qm, size_t ctx_size,
++ const void *ctx_addr, dma_addr_t *dma_addr);
++void hisi_qm_show_last_dfx_regs(struct hisi_qm *qm);
++void hisi_qm_set_algqos_init(struct hisi_qm *qm);
++
++#endif
+--
+2.42.0
+
--- /dev/null
+From 6f43100338535709c65b76882d7161ca836a092e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 12:21:14 +0000
+Subject: crypto: qat - change bufferlist logic interface
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 3ed330d0dba61d2e08a0eed7aa3d5def3f0c749b ]
+
+The functions qat_alg_sgl_to_bufl() and qat_alg_free_bufl() take as
+argument a qat_crypto_instance and a qat_crypto_request structure.
+These two structures are used only to get a reference to the
+adf_accel_dev and qat_crypto_request_buffs.
+
+In order to reuse these functions for the compression service, change
+the signature so that they take adf_accel_dev and
+qat_crypto_request_buffs.
+
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Wojciech Ziemba <wojciech.ziemba@intel.com>
+Reviewed-by: Adam Guerin <adam.guerin@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 9b2f33a1bfcd ("crypto: qat - fix unregistration of crypto algorithms")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/qat_algs.c | 24 +++++----
+ drivers/crypto/qat/qat_common/qat_bl.c | 62 ++++++++++++------------
+ drivers/crypto/qat/qat_common/qat_bl.h | 8 +--
+ 3 files changed, 49 insertions(+), 45 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
+index ae83ba0cf1d93..0e24e30acb040 100644
+--- a/drivers/crypto/qat/qat_common/qat_algs.c
++++ b/drivers/crypto/qat/qat_common/qat_algs.c
+@@ -673,7 +673,7 @@ static void qat_aead_alg_callback(struct icp_qat_fw_la_resp *qat_resp,
+ u8 stat_filed = qat_resp->comn_resp.comn_status;
+ int res = 0, qat_res = ICP_QAT_FW_COMN_RESP_CRYPTO_STAT_GET(stat_filed);
+
+- qat_bl_free_bufl(inst, qat_req);
++ qat_bl_free_bufl(inst->accel_dev, &qat_req->buf);
+ if (unlikely(qat_res != ICP_QAT_FW_COMN_STATUS_FLAG_OK))
+ res = -EBADMSG;
+ areq->base.complete(&areq->base, res);
+@@ -743,7 +743,7 @@ static void qat_skcipher_alg_callback(struct icp_qat_fw_la_resp *qat_resp,
+ u8 stat_filed = qat_resp->comn_resp.comn_status;
+ int res = 0, qat_res = ICP_QAT_FW_COMN_RESP_CRYPTO_STAT_GET(stat_filed);
+
+- qat_bl_free_bufl(inst, qat_req);
++ qat_bl_free_bufl(inst->accel_dev, &qat_req->buf);
+ if (unlikely(qat_res != ICP_QAT_FW_COMN_STATUS_FLAG_OK))
+ res = -EINVAL;
+
+@@ -799,7 +799,8 @@ static int qat_alg_aead_dec(struct aead_request *areq)
+ if (cipher_len % AES_BLOCK_SIZE != 0)
+ return -EINVAL;
+
+- ret = qat_bl_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req, f);
++ ret = qat_bl_sgl_to_bufl(ctx->inst->accel_dev, areq->src, areq->dst,
++ &qat_req->buf, f);
+ if (unlikely(ret))
+ return ret;
+
+@@ -821,7 +822,7 @@ static int qat_alg_aead_dec(struct aead_request *areq)
+
+ ret = qat_alg_send_sym_message(qat_req, ctx->inst, &areq->base);
+ if (ret == -ENOSPC)
+- qat_bl_free_bufl(ctx->inst, qat_req);
++ qat_bl_free_bufl(ctx->inst->accel_dev, &qat_req->buf);
+
+ return ret;
+ }
+@@ -842,7 +843,8 @@ static int qat_alg_aead_enc(struct aead_request *areq)
+ if (areq->cryptlen % AES_BLOCK_SIZE != 0)
+ return -EINVAL;
+
+- ret = qat_bl_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req, f);
++ ret = qat_bl_sgl_to_bufl(ctx->inst->accel_dev, areq->src, areq->dst,
++ &qat_req->buf, f);
+ if (unlikely(ret))
+ return ret;
+
+@@ -866,7 +868,7 @@ static int qat_alg_aead_enc(struct aead_request *areq)
+
+ ret = qat_alg_send_sym_message(qat_req, ctx->inst, &areq->base);
+ if (ret == -ENOSPC)
+- qat_bl_free_bufl(ctx->inst, qat_req);
++ qat_bl_free_bufl(ctx->inst->accel_dev, &qat_req->buf);
+
+ return ret;
+ }
+@@ -1027,7 +1029,8 @@ static int qat_alg_skcipher_encrypt(struct skcipher_request *req)
+ if (req->cryptlen == 0)
+ return 0;
+
+- ret = qat_bl_sgl_to_bufl(ctx->inst, req->src, req->dst, qat_req, f);
++ ret = qat_bl_sgl_to_bufl(ctx->inst->accel_dev, req->src, req->dst,
++ &qat_req->buf, f);
+ if (unlikely(ret))
+ return ret;
+
+@@ -1048,7 +1051,7 @@ static int qat_alg_skcipher_encrypt(struct skcipher_request *req)
+
+ ret = qat_alg_send_sym_message(qat_req, ctx->inst, &req->base);
+ if (ret == -ENOSPC)
+- qat_bl_free_bufl(ctx->inst, qat_req);
++ qat_bl_free_bufl(ctx->inst->accel_dev, &qat_req->buf);
+
+ return ret;
+ }
+@@ -1093,7 +1096,8 @@ static int qat_alg_skcipher_decrypt(struct skcipher_request *req)
+ if (req->cryptlen == 0)
+ return 0;
+
+- ret = qat_bl_sgl_to_bufl(ctx->inst, req->src, req->dst, qat_req, f);
++ ret = qat_bl_sgl_to_bufl(ctx->inst->accel_dev, req->src, req->dst,
++ &qat_req->buf, f);
+ if (unlikely(ret))
+ return ret;
+
+@@ -1115,7 +1119,7 @@ static int qat_alg_skcipher_decrypt(struct skcipher_request *req)
+
+ ret = qat_alg_send_sym_message(qat_req, ctx->inst, &req->base);
+ if (ret == -ENOSPC)
+- qat_bl_free_bufl(ctx->inst, qat_req);
++ qat_bl_free_bufl(ctx->inst->accel_dev, &qat_req->buf);
+
+ return ret;
+ }
+diff --git a/drivers/crypto/qat/qat_common/qat_bl.c b/drivers/crypto/qat/qat_common/qat_bl.c
+index 8f7743f3c89b9..5e319887f8d69 100644
+--- a/drivers/crypto/qat/qat_common/qat_bl.c
++++ b/drivers/crypto/qat/qat_common/qat_bl.c
+@@ -10,16 +10,16 @@
+ #include "qat_bl.h"
+ #include "qat_crypto.h"
+
+-void qat_bl_free_bufl(struct qat_crypto_instance *inst,
+- struct qat_crypto_request *qat_req)
++void qat_bl_free_bufl(struct adf_accel_dev *accel_dev,
++ struct qat_crypto_request_buffs *buf)
+ {
+- struct device *dev = &GET_DEV(inst->accel_dev);
+- struct qat_alg_buf_list *bl = qat_req->buf.bl;
+- struct qat_alg_buf_list *blout = qat_req->buf.blout;
+- dma_addr_t blp = qat_req->buf.blp;
+- dma_addr_t blpout = qat_req->buf.bloutp;
+- size_t sz = qat_req->buf.sz;
+- size_t sz_out = qat_req->buf.sz_out;
++ struct device *dev = &GET_DEV(accel_dev);
++ struct qat_alg_buf_list *bl = buf->bl;
++ struct qat_alg_buf_list *blout = buf->blout;
++ dma_addr_t blp = buf->blp;
++ dma_addr_t blpout = buf->bloutp;
++ size_t sz = buf->sz;
++ size_t sz_out = buf->sz_out;
+ int bl_dma_dir;
+ int i;
+
+@@ -31,7 +31,7 @@ void qat_bl_free_bufl(struct qat_crypto_instance *inst,
+
+ dma_unmap_single(dev, blp, sz, DMA_TO_DEVICE);
+
+- if (!qat_req->buf.sgl_src_valid)
++ if (!buf->sgl_src_valid)
+ kfree(bl);
+
+ if (blp != blpout) {
+@@ -45,18 +45,18 @@ void qat_bl_free_bufl(struct qat_crypto_instance *inst,
+ }
+ dma_unmap_single(dev, blpout, sz_out, DMA_TO_DEVICE);
+
+- if (!qat_req->buf.sgl_dst_valid)
++ if (!buf->sgl_dst_valid)
+ kfree(blout);
+ }
+ }
+
+-int qat_bl_sgl_to_bufl(struct qat_crypto_instance *inst,
++int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+ struct scatterlist *sgl,
+ struct scatterlist *sglout,
+- struct qat_crypto_request *qat_req,
++ struct qat_crypto_request_buffs *buf,
+ gfp_t flags)
+ {
+- struct device *dev = &GET_DEV(inst->accel_dev);
++ struct device *dev = &GET_DEV(accel_dev);
+ int i, sg_nctr = 0;
+ int n = sg_nents(sgl);
+ struct qat_alg_buf_list *bufl;
+@@ -65,23 +65,23 @@ int qat_bl_sgl_to_bufl(struct qat_crypto_instance *inst,
+ dma_addr_t bloutp = DMA_MAPPING_ERROR;
+ struct scatterlist *sg;
+ size_t sz_out, sz = struct_size(bufl, bufers, n);
+- int node = dev_to_node(&GET_DEV(inst->accel_dev));
++ int node = dev_to_node(&GET_DEV(accel_dev));
+ int bufl_dma_dir;
+
+ if (unlikely(!n))
+ return -EINVAL;
+
+- qat_req->buf.sgl_src_valid = false;
+- qat_req->buf.sgl_dst_valid = false;
++ buf->sgl_src_valid = false;
++ buf->sgl_dst_valid = false;
+
+ if (n > QAT_MAX_BUFF_DESC) {
+ bufl = kzalloc_node(sz, flags, node);
+ if (unlikely(!bufl))
+ return -ENOMEM;
+ } else {
+- bufl = &qat_req->buf.sgl_src.sgl_hdr;
++ bufl = &buf->sgl_src.sgl_hdr;
+ memset(bufl, 0, sizeof(struct qat_alg_buf_list));
+- qat_req->buf.sgl_src_valid = true;
++ buf->sgl_src_valid = true;
+ }
+
+ bufl_dma_dir = sgl != sglout ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL;
+@@ -107,9 +107,9 @@ int qat_bl_sgl_to_bufl(struct qat_crypto_instance *inst,
+ blp = dma_map_single(dev, bufl, sz, DMA_TO_DEVICE);
+ if (unlikely(dma_mapping_error(dev, blp)))
+ goto err_in;
+- qat_req->buf.bl = bufl;
+- qat_req->buf.blp = blp;
+- qat_req->buf.sz = sz;
++ buf->bl = bufl;
++ buf->blp = blp;
++ buf->sz = sz;
+ /* Handle out of place operation */
+ if (sgl != sglout) {
+ struct qat_alg_buf *bufers;
+@@ -123,9 +123,9 @@ int qat_bl_sgl_to_bufl(struct qat_crypto_instance *inst,
+ if (unlikely(!buflout))
+ goto err_in;
+ } else {
+- buflout = &qat_req->buf.sgl_dst.sgl_hdr;
++ buflout = &buf->sgl_dst.sgl_hdr;
+ memset(buflout, 0, sizeof(struct qat_alg_buf_list));
+- qat_req->buf.sgl_dst_valid = true;
++ buf->sgl_dst_valid = true;
+ }
+
+ bufers = buflout->bufers;
+@@ -151,13 +151,13 @@ int qat_bl_sgl_to_bufl(struct qat_crypto_instance *inst,
+ bloutp = dma_map_single(dev, buflout, sz_out, DMA_TO_DEVICE);
+ if (unlikely(dma_mapping_error(dev, bloutp)))
+ goto err_out;
+- qat_req->buf.blout = buflout;
+- qat_req->buf.bloutp = bloutp;
+- qat_req->buf.sz_out = sz_out;
++ buf->blout = buflout;
++ buf->bloutp = bloutp;
++ buf->sz_out = sz_out;
+ } else {
+ /* Otherwise set the src and dst to the same address */
+- qat_req->buf.bloutp = qat_req->buf.blp;
+- qat_req->buf.sz_out = 0;
++ buf->bloutp = buf->blp;
++ buf->sz_out = 0;
+ }
+ return 0;
+
+@@ -172,7 +172,7 @@ int qat_bl_sgl_to_bufl(struct qat_crypto_instance *inst,
+ buflout->bufers[i].len,
+ DMA_FROM_DEVICE);
+
+- if (!qat_req->buf.sgl_dst_valid)
++ if (!buf->sgl_dst_valid)
+ kfree(buflout);
+
+ err_in:
+@@ -186,7 +186,7 @@ int qat_bl_sgl_to_bufl(struct qat_crypto_instance *inst,
+ bufl->bufers[i].len,
+ bufl_dma_dir);
+
+- if (!qat_req->buf.sgl_src_valid)
++ if (!buf->sgl_src_valid)
+ kfree(bufl);
+
+ dev_err(dev, "Failed to map buf for dma\n");
+diff --git a/drivers/crypto/qat/qat_common/qat_bl.h b/drivers/crypto/qat/qat_common/qat_bl.h
+index ed4c200ac6197..241299c219dd5 100644
+--- a/drivers/crypto/qat/qat_common/qat_bl.h
++++ b/drivers/crypto/qat/qat_common/qat_bl.h
+@@ -6,12 +6,12 @@
+ #include <linux/types.h>
+ #include "qat_crypto.h"
+
+-void qat_bl_free_bufl(struct qat_crypto_instance *inst,
+- struct qat_crypto_request *qat_req);
+-int qat_bl_sgl_to_bufl(struct qat_crypto_instance *inst,
++void qat_bl_free_bufl(struct adf_accel_dev *accel_dev,
++ struct qat_crypto_request_buffs *buf);
++int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+ struct scatterlist *sgl,
+ struct scatterlist *sglout,
+- struct qat_crypto_request *qat_req,
++ struct qat_crypto_request_buffs *buf,
+ gfp_t flags);
+
+ #endif
+--
+2.42.0
+
--- /dev/null
+From aaf8318d596f8432aca49d345f9fab0509025c11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 12:21:16 +0000
+Subject: crypto: qat - extend buffer list interface
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit cf692906bd61af2eec06a32a83d2a8ec3acf3548 ]
+
+The compression service requires an additional pre-allocated buffer for
+each destination scatter list.
+Extend the function qat_alg_sgl_to_bufl() to take an additional
+structure that contains the dma address and the size of the extra
+buffer which will be appended in the destination FW SGL.
+
+The logic that unmaps buffers in qat_alg_free_bufl() has been changed to
+start unmapping from buffer 0 instead of skipping the initial buffers
+num_buff - num_mapped_bufs as that functionality was not used in the
+code.
+
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Wojciech Ziemba <wojciech.ziemba@intel.com>
+Reviewed-by: Adam Guerin <adam.guerin@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 9b2f33a1bfcd ("crypto: qat - fix unregistration of crypto algorithms")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/qat_algs.c | 8 ++--
+ drivers/crypto/qat/qat_common/qat_bl.c | 58 ++++++++++++++++++------
+ drivers/crypto/qat/qat_common/qat_bl.h | 6 +++
+ 3 files changed, 54 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
+index 0e24e30acb040..b61ada5591586 100644
+--- a/drivers/crypto/qat/qat_common/qat_algs.c
++++ b/drivers/crypto/qat/qat_common/qat_algs.c
+@@ -800,7 +800,7 @@ static int qat_alg_aead_dec(struct aead_request *areq)
+ return -EINVAL;
+
+ ret = qat_bl_sgl_to_bufl(ctx->inst->accel_dev, areq->src, areq->dst,
+- &qat_req->buf, f);
++ &qat_req->buf, NULL, f);
+ if (unlikely(ret))
+ return ret;
+
+@@ -844,7 +844,7 @@ static int qat_alg_aead_enc(struct aead_request *areq)
+ return -EINVAL;
+
+ ret = qat_bl_sgl_to_bufl(ctx->inst->accel_dev, areq->src, areq->dst,
+- &qat_req->buf, f);
++ &qat_req->buf, NULL, f);
+ if (unlikely(ret))
+ return ret;
+
+@@ -1030,7 +1030,7 @@ static int qat_alg_skcipher_encrypt(struct skcipher_request *req)
+ return 0;
+
+ ret = qat_bl_sgl_to_bufl(ctx->inst->accel_dev, req->src, req->dst,
+- &qat_req->buf, f);
++ &qat_req->buf, NULL, f);
+ if (unlikely(ret))
+ return ret;
+
+@@ -1097,7 +1097,7 @@ static int qat_alg_skcipher_decrypt(struct skcipher_request *req)
+ return 0;
+
+ ret = qat_bl_sgl_to_bufl(ctx->inst->accel_dev, req->src, req->dst,
+- &qat_req->buf, f);
++ &qat_req->buf, NULL, f);
+ if (unlikely(ret))
+ return ret;
+
+diff --git a/drivers/crypto/qat/qat_common/qat_bl.c b/drivers/crypto/qat/qat_common/qat_bl.c
+index c32b12d386f0a..221a4eb610a38 100644
+--- a/drivers/crypto/qat/qat_common/qat_bl.c
++++ b/drivers/crypto/qat/qat_common/qat_bl.c
+@@ -35,10 +35,7 @@ void qat_bl_free_bufl(struct adf_accel_dev *accel_dev,
+ kfree(bl);
+
+ if (blp != blpout) {
+- /* If out of place operation dma unmap only data */
+- int bufless = blout->num_bufs - blout->num_mapped_bufs;
+-
+- for (i = bufless; i < blout->num_bufs; i++) {
++ for (i = 0; i < blout->num_mapped_bufs; i++) {
+ dma_unmap_single(dev, blout->bufers[i].addr,
+ blout->bufers[i].len,
+ DMA_FROM_DEVICE);
+@@ -50,11 +47,13 @@ void qat_bl_free_bufl(struct adf_accel_dev *accel_dev,
+ }
+ }
+
+-int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+- struct scatterlist *sgl,
+- struct scatterlist *sglout,
+- struct qat_request_buffs *buf,
+- gfp_t flags)
++static int __qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
++ struct scatterlist *sgl,
++ struct scatterlist *sglout,
++ struct qat_request_buffs *buf,
++ dma_addr_t extra_dst_buff,
++ size_t sz_extra_dst_buff,
++ gfp_t flags)
+ {
+ struct device *dev = &GET_DEV(accel_dev);
+ int i, sg_nctr = 0;
+@@ -86,7 +85,7 @@ int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+
+ bufl_dma_dir = sgl != sglout ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL;
+
+- for_each_sg(sgl, sg, n, i)
++ for (i = 0; i < n; i++)
+ bufl->bufers[i].addr = DMA_MAPPING_ERROR;
+
+ for_each_sg(sgl, sg, n, i) {
+@@ -113,8 +112,10 @@ int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+ /* Handle out of place operation */
+ if (sgl != sglout) {
+ struct qat_alg_buf *bufers;
++ int extra_buff = extra_dst_buff ? 1 : 0;
++ int n_sglout = sg_nents(sglout);
+
+- n = sg_nents(sglout);
++ n = n_sglout + extra_buff;
+ sz_out = struct_size(buflout, bufers, n);
+ sg_nctr = 0;
+
+@@ -129,10 +130,10 @@ int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+ }
+
+ bufers = buflout->bufers;
+- for_each_sg(sglout, sg, n, i)
++ for (i = 0; i < n; i++)
+ bufers[i].addr = DMA_MAPPING_ERROR;
+
+- for_each_sg(sglout, sg, n, i) {
++ for_each_sg(sglout, sg, n_sglout, i) {
+ int y = sg_nctr;
+
+ if (!sg->length)
+@@ -146,7 +147,13 @@ int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+ bufers[y].len = sg->length;
+ sg_nctr++;
+ }
++ if (extra_buff) {
++ bufers[sg_nctr].addr = extra_dst_buff;
++ bufers[sg_nctr].len = sz_extra_dst_buff;
++ }
++
+ buflout->num_bufs = sg_nctr;
++ buflout->num_bufs += extra_buff;
+ buflout->num_mapped_bufs = sg_nctr;
+ bloutp = dma_map_single(dev, buflout, sz_out, DMA_TO_DEVICE);
+ if (unlikely(dma_mapping_error(dev, bloutp)))
+@@ -166,11 +173,14 @@ int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+ dma_unmap_single(dev, bloutp, sz_out, DMA_TO_DEVICE);
+
+ n = sg_nents(sglout);
+- for (i = 0; i < n; i++)
++ for (i = 0; i < n; i++) {
++ if (buflout->bufers[i].addr == extra_dst_buff)
++ break;
+ if (!dma_mapping_error(dev, buflout->bufers[i].addr))
+ dma_unmap_single(dev, buflout->bufers[i].addr,
+ buflout->bufers[i].len,
+ DMA_FROM_DEVICE);
++ }
+
+ if (!buf->sgl_dst_valid)
+ kfree(buflout);
+@@ -192,3 +202,23 @@ int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+ dev_err(dev, "Failed to map buf for dma\n");
+ return -ENOMEM;
+ }
++
++int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
++ struct scatterlist *sgl,
++ struct scatterlist *sglout,
++ struct qat_request_buffs *buf,
++ struct qat_sgl_to_bufl_params *params,
++ gfp_t flags)
++{
++ dma_addr_t extra_dst_buff = 0;
++ size_t sz_extra_dst_buff = 0;
++
++ if (params) {
++ extra_dst_buff = params->extra_dst_buff;
++ sz_extra_dst_buff = params->sz_extra_dst_buff;
++ }
++
++ return __qat_bl_sgl_to_bufl(accel_dev, sgl, sglout, buf,
++ extra_dst_buff, sz_extra_dst_buff,
++ flags);
++}
+diff --git a/drivers/crypto/qat/qat_common/qat_bl.h b/drivers/crypto/qat/qat_common/qat_bl.h
+index 1c534c57a36bc..0c174fee9e645 100644
+--- a/drivers/crypto/qat/qat_common/qat_bl.h
++++ b/drivers/crypto/qat/qat_common/qat_bl.h
+@@ -38,12 +38,18 @@ struct qat_request_buffs {
+ struct qat_alg_fixed_buf_list sgl_dst;
+ };
+
++struct qat_sgl_to_bufl_params {
++ dma_addr_t extra_dst_buff;
++ size_t sz_extra_dst_buff;
++};
++
+ void qat_bl_free_bufl(struct adf_accel_dev *accel_dev,
+ struct qat_request_buffs *buf);
+ int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+ struct scatterlist *sgl,
+ struct scatterlist *sglout,
+ struct qat_request_buffs *buf,
++ struct qat_sgl_to_bufl_params *params,
+ gfp_t flags);
+
+ #endif
+--
+2.42.0
+
--- /dev/null
+From e5aa3e198ca4ed603c1d6af66dc5128c13de5f05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 16:33:21 +0100
+Subject: crypto: qat - fix deadlock in backlog processing
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 203b01001c4d741205b9c329acddc5193ed56fbd ]
+
+If a request has the flag CRYPTO_TFM_REQ_MAY_BACKLOG set, the function
+qat_alg_send_message_maybacklog(), enqueues it in a backlog list if
+either (1) there is already at least one request in the backlog list, or
+(2) the HW ring is nearly full or (3) the enqueue to the HW ring fails.
+If an interrupt occurs right before the lock in qat_alg_backlog_req() is
+taken and the backlog queue is being emptied, then there is no request
+in the HW queues that can trigger a subsequent interrupt that can clear
+the backlog queue. In addition subsequent requests are enqueued to the
+backlog list and not sent to the hardware.
+
+Fix it by holding the lock while taking the decision if the request
+needs to be included in the backlog queue or not. This synchronizes the
+flow with the interrupt handler that drains the backlog queue.
+
+For performance reasons, the logic has been changed to try to enqueue
+first without holding the lock.
+
+Fixes: 386823839732 ("crypto: qat - add backlog mechanism")
+Reported-by: Mikulas Patocka <mpatocka@redhat.com>
+Closes: https://lore.kernel.org/all/af9581e2-58f9-cc19-428f-6f18f1f83d54@redhat.com/T/
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/qat_algs_send.c | 46 ++++++++++---------
+ 1 file changed, 25 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/qat_algs_send.c b/drivers/crypto/qat/qat_common/qat_algs_send.c
+index ff5b4347f7831..607ed88f4b197 100644
+--- a/drivers/crypto/qat/qat_common/qat_algs_send.c
++++ b/drivers/crypto/qat/qat_common/qat_algs_send.c
+@@ -39,40 +39,44 @@ void qat_alg_send_backlog(struct qat_instance_backlog *backlog)
+ spin_unlock_bh(&backlog->lock);
+ }
+
+-static void qat_alg_backlog_req(struct qat_alg_req *req,
+- struct qat_instance_backlog *backlog)
+-{
+- INIT_LIST_HEAD(&req->list);
+-
+- spin_lock_bh(&backlog->lock);
+- list_add_tail(&req->list, &backlog->list);
+- spin_unlock_bh(&backlog->lock);
+-}
+-
+-static int qat_alg_send_message_maybacklog(struct qat_alg_req *req)
++static bool qat_alg_try_enqueue(struct qat_alg_req *req)
+ {
+ struct qat_instance_backlog *backlog = req->backlog;
+ struct adf_etr_ring_data *tx_ring = req->tx_ring;
+ u32 *fw_req = req->fw_req;
+
+- /* If any request is already backlogged, then add to backlog list */
++ /* Check if any request is already backlogged */
+ if (!list_empty(&backlog->list))
+- goto enqueue;
++ return false;
+
+- /* If ring is nearly full, then add to backlog list */
++ /* Check if ring is nearly full */
+ if (adf_ring_nearly_full(tx_ring))
+- goto enqueue;
++ return false;
+
+- /* If adding request to HW ring fails, then add to backlog list */
++ /* Try to enqueue to HW ring */
+ if (adf_send_message(tx_ring, fw_req))
+- goto enqueue;
++ return false;
+
+- return -EINPROGRESS;
++ return true;
++}
+
+-enqueue:
+- qat_alg_backlog_req(req, backlog);
+
+- return -EBUSY;
++static int qat_alg_send_message_maybacklog(struct qat_alg_req *req)
++{
++ struct qat_instance_backlog *backlog = req->backlog;
++ int ret = -EINPROGRESS;
++
++ if (qat_alg_try_enqueue(req))
++ return ret;
++
++ spin_lock_bh(&backlog->lock);
++ if (!qat_alg_try_enqueue(req)) {
++ list_add_tail(&req->list, &backlog->list);
++ ret = -EBUSY;
++ }
++ spin_unlock_bh(&backlog->lock);
++
++ return ret;
+ }
+
+ int qat_alg_send_message(struct qat_alg_req *req)
+--
+2.42.0
+
--- /dev/null
+From 5c25b427951e0ee11806cb8d7865548de524084f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 10:55:48 +0100
+Subject: crypto: qat - fix unregistration of crypto algorithms
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 9b2f33a1bfcda90b857431a764c9c8f9a412bbe5 ]
+
+The function adf_dev_init(), through the subsystem qat_crypto, populates
+the list of list of crypto instances accel_dev->crypto_list.
+If the list of instances is not empty, the function adf_dev_start() will
+then call qat_algs_registers() and qat_asym_algs_register() to register
+the crypto algorithms into the crypto framework.
+
+If any of the functions in adf_dev_start() fail, the caller of such
+function, in the error path calls adf_dev_down() which in turn call
+adf_dev_stop() and adf_dev_shutdown(), see for example the function
+state_store in adf_sriov.c.
+However, if the registration of crypto algorithms is not done,
+adf_dev_stop() will try to unregister the algorithms regardless.
+This might cause the counter active_devs in qat_algs.c and
+qat_asym_algs.c to get to a negative value.
+
+Add a new state, ADF_STATUS_CRYPTO_ALGS_REGISTERED, which tracks if the
+crypto algorithms are registered into the crypto framework. Then use
+this to unregister the algorithms if such flag is set. This ensures that
+the crypto algorithms are only unregistered if previously registered.
+
+Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework")
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Adam Guerin <adam.guerin@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_common_drv.h | 1 +
+ drivers/crypto/qat/qat_common/adf_init.c | 6 +++++-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h
+index bff613eec5c4b..d2bc2361cd069 100644
+--- a/drivers/crypto/qat/qat_common/adf_common_drv.h
++++ b/drivers/crypto/qat/qat_common/adf_common_drv.h
+@@ -25,6 +25,7 @@
+ #define ADF_STATUS_AE_STARTED 6
+ #define ADF_STATUS_PF_RUNNING 7
+ #define ADF_STATUS_IRQ_ALLOCATED 8
++#define ADF_STATUS_CRYPTO_ALGS_REGISTERED 9
+
+ enum adf_dev_reset_mode {
+ ADF_DEV_RESET_ASYNC = 0,
+diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c
+index d6f3314246179..2e3481270c4ba 100644
+--- a/drivers/crypto/qat/qat_common/adf_init.c
++++ b/drivers/crypto/qat/qat_common/adf_init.c
+@@ -209,6 +209,8 @@ int adf_dev_start(struct adf_accel_dev *accel_dev)
+ clear_bit(ADF_STATUS_STARTED, &accel_dev->status);
+ return -EFAULT;
+ }
++ set_bit(ADF_STATUS_CRYPTO_ALGS_REGISTERED, &accel_dev->status);
++
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(adf_dev_start);
+@@ -237,10 +239,12 @@ void adf_dev_stop(struct adf_accel_dev *accel_dev)
+ clear_bit(ADF_STATUS_STARTING, &accel_dev->status);
+ clear_bit(ADF_STATUS_STARTED, &accel_dev->status);
+
+- if (!list_empty(&accel_dev->crypto_list)) {
++ if (!list_empty(&accel_dev->crypto_list) &&
++ test_bit(ADF_STATUS_CRYPTO_ALGS_REGISTERED, &accel_dev->status)) {
+ qat_algs_unregister();
+ qat_asym_algs_unregister();
+ }
++ clear_bit(ADF_STATUS_CRYPTO_ALGS_REGISTERED, &accel_dev->status);
+
+ list_for_each(list_itr, &service_table) {
+ service = list_entry(list_itr, struct service_hndl, list);
+--
+2.42.0
+
--- /dev/null
+From 6dc0f0eafac82f17c86ff40d639ee897b1e28a30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 12:21:15 +0000
+Subject: crypto: qat - generalize crypto request buffers
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 36ebc7472afeb58f1eb1d4c1f0546b9e98acea46 ]
+
+The structure qat_crypto_request_buffs which contains the source and
+destination buffer lists and correspondent sizes and dma addresses is
+also required for the compression service.
+Rename it as qat_request_buffs and move it to qat_bl.h.
+
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Wojciech Ziemba <wojciech.ziemba@intel.com>
+Reviewed-by: Adam Guerin <adam.guerin@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 9b2f33a1bfcd ("crypto: qat - fix unregistration of crypto algorithms")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/qat_bl.c | 4 +--
+ drivers/crypto/qat/qat_common/qat_bl.h | 38 ++++++++++++++++++++--
+ drivers/crypto/qat/qat_common/qat_crypto.h | 36 ++------------------
+ 3 files changed, 39 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/qat_bl.c b/drivers/crypto/qat/qat_common/qat_bl.c
+index 5e319887f8d69..c32b12d386f0a 100644
+--- a/drivers/crypto/qat/qat_common/qat_bl.c
++++ b/drivers/crypto/qat/qat_common/qat_bl.c
+@@ -11,7 +11,7 @@
+ #include "qat_crypto.h"
+
+ void qat_bl_free_bufl(struct adf_accel_dev *accel_dev,
+- struct qat_crypto_request_buffs *buf)
++ struct qat_request_buffs *buf)
+ {
+ struct device *dev = &GET_DEV(accel_dev);
+ struct qat_alg_buf_list *bl = buf->bl;
+@@ -53,7 +53,7 @@ void qat_bl_free_bufl(struct adf_accel_dev *accel_dev,
+ int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+ struct scatterlist *sgl,
+ struct scatterlist *sglout,
+- struct qat_crypto_request_buffs *buf,
++ struct qat_request_buffs *buf,
+ gfp_t flags)
+ {
+ struct device *dev = &GET_DEV(accel_dev);
+diff --git a/drivers/crypto/qat/qat_common/qat_bl.h b/drivers/crypto/qat/qat_common/qat_bl.h
+index 241299c219dd5..1c534c57a36bc 100644
+--- a/drivers/crypto/qat/qat_common/qat_bl.h
++++ b/drivers/crypto/qat/qat_common/qat_bl.h
+@@ -4,14 +4,46 @@
+ #define QAT_BL_H
+ #include <linux/scatterlist.h>
+ #include <linux/types.h>
+-#include "qat_crypto.h"
++
++#define QAT_MAX_BUFF_DESC 4
++
++struct qat_alg_buf {
++ u32 len;
++ u32 resrvd;
++ u64 addr;
++} __packed;
++
++struct qat_alg_buf_list {
++ u64 resrvd;
++ u32 num_bufs;
++ u32 num_mapped_bufs;
++ struct qat_alg_buf bufers[];
++} __packed;
++
++struct qat_alg_fixed_buf_list {
++ struct qat_alg_buf_list sgl_hdr;
++ struct qat_alg_buf descriptors[QAT_MAX_BUFF_DESC];
++} __packed __aligned(64);
++
++struct qat_request_buffs {
++ struct qat_alg_buf_list *bl;
++ dma_addr_t blp;
++ struct qat_alg_buf_list *blout;
++ dma_addr_t bloutp;
++ size_t sz;
++ size_t sz_out;
++ bool sgl_src_valid;
++ bool sgl_dst_valid;
++ struct qat_alg_fixed_buf_list sgl_src;
++ struct qat_alg_fixed_buf_list sgl_dst;
++};
+
+ void qat_bl_free_bufl(struct adf_accel_dev *accel_dev,
+- struct qat_crypto_request_buffs *buf);
++ struct qat_request_buffs *buf);
+ int qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev,
+ struct scatterlist *sgl,
+ struct scatterlist *sglout,
+- struct qat_crypto_request_buffs *buf,
++ struct qat_request_buffs *buf,
+ gfp_t flags);
+
+ #endif
+diff --git a/drivers/crypto/qat/qat_common/qat_crypto.h b/drivers/crypto/qat/qat_common/qat_crypto.h
+index df3c738ce323a..bb116357a5684 100644
+--- a/drivers/crypto/qat/qat_common/qat_crypto.h
++++ b/drivers/crypto/qat/qat_common/qat_crypto.h
+@@ -8,6 +8,7 @@
+ #include <linux/slab.h>
+ #include "adf_accel_devices.h"
+ #include "icp_qat_fw_la.h"
++#include "qat_bl.h"
+
+ struct qat_instance_backlog {
+ struct list_head list;
+@@ -35,39 +36,6 @@ struct qat_crypto_instance {
+ struct qat_instance_backlog backlog;
+ };
+
+-#define QAT_MAX_BUFF_DESC 4
+-
+-struct qat_alg_buf {
+- u32 len;
+- u32 resrvd;
+- u64 addr;
+-} __packed;
+-
+-struct qat_alg_buf_list {
+- u64 resrvd;
+- u32 num_bufs;
+- u32 num_mapped_bufs;
+- struct qat_alg_buf bufers[];
+-} __packed;
+-
+-struct qat_alg_fixed_buf_list {
+- struct qat_alg_buf_list sgl_hdr;
+- struct qat_alg_buf descriptors[QAT_MAX_BUFF_DESC];
+-} __packed __aligned(64);
+-
+-struct qat_crypto_request_buffs {
+- struct qat_alg_buf_list *bl;
+- dma_addr_t blp;
+- struct qat_alg_buf_list *blout;
+- dma_addr_t bloutp;
+- size_t sz;
+- size_t sz_out;
+- bool sgl_src_valid;
+- bool sgl_dst_valid;
+- struct qat_alg_fixed_buf_list sgl_src;
+- struct qat_alg_fixed_buf_list sgl_dst;
+-};
+-
+ struct qat_crypto_request;
+
+ struct qat_crypto_request {
+@@ -80,7 +48,7 @@ struct qat_crypto_request {
+ struct aead_request *aead_req;
+ struct skcipher_request *skcipher_req;
+ };
+- struct qat_crypto_request_buffs buf;
++ struct qat_request_buffs buf;
+ void (*cb)(struct icp_qat_fw_la_resp *resp,
+ struct qat_crypto_request *req);
+ union {
+--
+2.42.0
+
--- /dev/null
+From 054ded220a36cf60a6568008ed11387d5bb17c69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 10:55:47 +0100
+Subject: crypto: qat - ignore subsequent state up commands
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 9c20cb8b1847dedddec3d5163079290542bf00bf ]
+
+If the device is already in the up state, a subsequent write of `up` to
+the sysfs attribute /sys/bus/pci/devices/<BDF>/qat/state brings the
+device down.
+Fix this behaviour by ignoring subsequent `up` commands if the device is
+already in the up state.
+
+Fixes: 1bdc85550a2b ("crypto: qat - fix concurrency issue when device state changes")
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Adam Guerin <adam.guerin@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_sysfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_sysfs.c b/drivers/crypto/qat/qat_common/adf_sysfs.c
+index 3eb6611ab1b11..81b2ecfcc8060 100644
+--- a/drivers/crypto/qat/qat_common/adf_sysfs.c
++++ b/drivers/crypto/qat/qat_common/adf_sysfs.c
+@@ -61,7 +61,9 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr,
+ dev_info(dev, "Starting device qat_dev%d\n", accel_id);
+
+ ret = adf_dev_up(accel_dev, true);
+- if (ret < 0) {
++ if (ret == -EALREADY) {
++ break;
++ } else if (ret) {
+ dev_err(dev, "Failed to start device qat_dev%d\n",
+ accel_id);
+ adf_dev_down(accel_dev, true);
+--
+2.42.0
+
--- /dev/null
+From 256f192ee7ad64e7212d2610debaba9340195b0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 10:03:47 +0100
+Subject: crypto: qat - increase size of buffers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 4e4e2ed22d505c5bacf65c6a39bfb6d120d24785 ]
+
+Increase the size of the buffers used for composing the names used for
+the transport debugfs entries and the vector name to avoid a potential
+truncation.
+
+This resolves the following errors when compiling the driver with W=1
+and KCFLAGS=-Werror on GCC 12.3.1:
+
+ drivers/crypto/intel/qat/qat_common/adf_transport_debug.c: In function ‘adf_ring_debugfs_add’:
+ drivers/crypto/intel/qat/qat_common/adf_transport_debug.c:100:60: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
+ drivers/crypto/intel/qat/qat_common/adf_isr.c: In function ‘adf_isr_resource_alloc’:
+ drivers/crypto/intel/qat/qat_common/adf_isr.c:197:47: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size between 0 and 5 [-Werror=format-truncation=]
+
+Fixes: a672a9dc872e ("crypto: qat - Intel(R) QAT transport code")
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Damian Muszynski <damian.muszynski@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_accel_devices.h | 2 +-
+ drivers/crypto/qat/qat_common/adf_transport_debug.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+index 20f50d0e65f89..ad01d99e6e2ba 100644
+--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
++++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+@@ -27,7 +27,7 @@
+ #define ADF_PCI_MAX_BARS 3
+ #define ADF_DEVICE_NAME_LENGTH 32
+ #define ADF_ETR_MAX_RINGS_PER_BANK 16
+-#define ADF_MAX_MSIX_VECTOR_NAME 16
++#define ADF_MAX_MSIX_VECTOR_NAME 48
+ #define ADF_DEVICE_NAME_PREFIX "qat_"
+
+ enum adf_accel_capabilities {
+diff --git a/drivers/crypto/qat/qat_common/adf_transport_debug.c b/drivers/crypto/qat/qat_common/adf_transport_debug.c
+index 08bca1c506c0e..e2dd568b87b51 100644
+--- a/drivers/crypto/qat/qat_common/adf_transport_debug.c
++++ b/drivers/crypto/qat/qat_common/adf_transport_debug.c
+@@ -90,7 +90,7 @@ DEFINE_SEQ_ATTRIBUTE(adf_ring_debug);
+ int adf_ring_debugfs_add(struct adf_etr_ring_data *ring, const char *name)
+ {
+ struct adf_etr_ring_debug_entry *ring_debug;
+- char entry_name[8];
++ char entry_name[16];
+
+ ring_debug = kzalloc(sizeof(*ring_debug), GFP_KERNEL);
+ if (!ring_debug)
+@@ -192,7 +192,7 @@ int adf_bank_debugfs_add(struct adf_etr_bank_data *bank)
+ {
+ struct adf_accel_dev *accel_dev = bank->accel_dev;
+ struct dentry *parent = accel_dev->transport->debug;
+- char name[8];
++ char name[16];
+
+ snprintf(name, sizeof(name), "bank_%02d", bank->bank_number);
+ bank->bank_debug_dir = debugfs_create_dir(name, parent);
+--
+2.42.0
+
--- /dev/null
+From 73d3ac672e3f864e0d0bbd1289f0e1d8c6bf14fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 12:21:12 +0000
+Subject: crypto: qat - relocate bufferlist logic
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit e9612987e437b7ada686f472c7596686fabecb2b ]
+
+Move the logic that maps, unmaps and converts scatterlists into QAT
+bufferlists from qat_algs.c to a new module, qat_bl.
+This is to allow reuse of the logic by the data compression service.
+
+This commit does not implement any functional change.
+
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Wojciech Ziemba <wojciech.ziemba@intel.com>
+Reviewed-by: Adam Guerin <adam.guerin@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 9b2f33a1bfcd ("crypto: qat - fix unregistration of crypto algorithms")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/Makefile | 3 +-
+ drivers/crypto/qat/qat_common/qat_algs.c | 184 +--------------------
+ drivers/crypto/qat/qat_common/qat_bl.c | 194 +++++++++++++++++++++++
+ drivers/crypto/qat/qat_common/qat_bl.h | 17 ++
+ 4 files changed, 214 insertions(+), 184 deletions(-)
+ create mode 100644 drivers/crypto/qat/qat_common/qat_bl.c
+ create mode 100644 drivers/crypto/qat/qat_common/qat_bl.h
+
+diff --git a/drivers/crypto/qat/qat_common/Makefile b/drivers/crypto/qat/qat_common/Makefile
+index 80919cfcc29da..b0587d03eac29 100644
+--- a/drivers/crypto/qat/qat_common/Makefile
++++ b/drivers/crypto/qat/qat_common/Makefile
+@@ -19,7 +19,8 @@ intel_qat-objs := adf_cfg.o \
+ qat_asym_algs.o \
+ qat_algs_send.o \
+ qat_uclo.o \
+- qat_hal.o
++ qat_hal.o \
++ qat_bl.o
+
+ intel_qat-$(CONFIG_DEBUG_FS) += adf_transport_debug.o
+ intel_qat-$(CONFIG_PCI_IOV) += adf_sriov.o adf_vf_isr.o adf_pfvf_utils.o \
+diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
+index f56ee4cc5ae8b..d4e4bdb25c16e 100644
+--- a/drivers/crypto/qat/qat_common/qat_algs.c
++++ b/drivers/crypto/qat/qat_common/qat_algs.c
+@@ -23,6 +23,7 @@
+ #include "icp_qat_hw.h"
+ #include "icp_qat_fw.h"
+ #include "icp_qat_fw_la.h"
++#include "qat_bl.h"
+
+ #define QAT_AES_HW_CONFIG_ENC(alg, mode) \
+ ICP_QAT_HW_CIPHER_CONFIG_BUILD(mode, alg, \
+@@ -663,189 +664,6 @@ static int qat_alg_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ return qat_alg_aead_newkey(tfm, key, keylen);
+ }
+
+-static void qat_alg_free_bufl(struct qat_crypto_instance *inst,
+- struct qat_crypto_request *qat_req)
+-{
+- struct device *dev = &GET_DEV(inst->accel_dev);
+- struct qat_alg_buf_list *bl = qat_req->buf.bl;
+- struct qat_alg_buf_list *blout = qat_req->buf.blout;
+- dma_addr_t blp = qat_req->buf.blp;
+- dma_addr_t blpout = qat_req->buf.bloutp;
+- size_t sz = qat_req->buf.sz;
+- size_t sz_out = qat_req->buf.sz_out;
+- int bl_dma_dir;
+- int i;
+-
+- bl_dma_dir = blp != blpout ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL;
+-
+- for (i = 0; i < bl->num_bufs; i++)
+- dma_unmap_single(dev, bl->bufers[i].addr,
+- bl->bufers[i].len, bl_dma_dir);
+-
+- dma_unmap_single(dev, blp, sz, DMA_TO_DEVICE);
+-
+- if (!qat_req->buf.sgl_src_valid)
+- kfree(bl);
+-
+- if (blp != blpout) {
+- /* If out of place operation dma unmap only data */
+- int bufless = blout->num_bufs - blout->num_mapped_bufs;
+-
+- for (i = bufless; i < blout->num_bufs; i++) {
+- dma_unmap_single(dev, blout->bufers[i].addr,
+- blout->bufers[i].len,
+- DMA_FROM_DEVICE);
+- }
+- dma_unmap_single(dev, blpout, sz_out, DMA_TO_DEVICE);
+-
+- if (!qat_req->buf.sgl_dst_valid)
+- kfree(blout);
+- }
+-}
+-
+-static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
+- struct scatterlist *sgl,
+- struct scatterlist *sglout,
+- struct qat_crypto_request *qat_req,
+- gfp_t flags)
+-{
+- struct device *dev = &GET_DEV(inst->accel_dev);
+- int i, sg_nctr = 0;
+- int n = sg_nents(sgl);
+- struct qat_alg_buf_list *bufl;
+- struct qat_alg_buf_list *buflout = NULL;
+- dma_addr_t blp = DMA_MAPPING_ERROR;
+- dma_addr_t bloutp = DMA_MAPPING_ERROR;
+- struct scatterlist *sg;
+- size_t sz_out, sz = struct_size(bufl, bufers, n);
+- int node = dev_to_node(&GET_DEV(inst->accel_dev));
+- int bufl_dma_dir;
+-
+- if (unlikely(!n))
+- return -EINVAL;
+-
+- qat_req->buf.sgl_src_valid = false;
+- qat_req->buf.sgl_dst_valid = false;
+-
+- if (n > QAT_MAX_BUFF_DESC) {
+- bufl = kzalloc_node(sz, flags, node);
+- if (unlikely(!bufl))
+- return -ENOMEM;
+- } else {
+- bufl = &qat_req->buf.sgl_src.sgl_hdr;
+- memset(bufl, 0, sizeof(struct qat_alg_buf_list));
+- qat_req->buf.sgl_src_valid = true;
+- }
+-
+- bufl_dma_dir = sgl != sglout ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL;
+-
+- for_each_sg(sgl, sg, n, i)
+- bufl->bufers[i].addr = DMA_MAPPING_ERROR;
+-
+- for_each_sg(sgl, sg, n, i) {
+- int y = sg_nctr;
+-
+- if (!sg->length)
+- continue;
+-
+- bufl->bufers[y].addr = dma_map_single(dev, sg_virt(sg),
+- sg->length,
+- bufl_dma_dir);
+- bufl->bufers[y].len = sg->length;
+- if (unlikely(dma_mapping_error(dev, bufl->bufers[y].addr)))
+- goto err_in;
+- sg_nctr++;
+- }
+- bufl->num_bufs = sg_nctr;
+- blp = dma_map_single(dev, bufl, sz, DMA_TO_DEVICE);
+- if (unlikely(dma_mapping_error(dev, blp)))
+- goto err_in;
+- qat_req->buf.bl = bufl;
+- qat_req->buf.blp = blp;
+- qat_req->buf.sz = sz;
+- /* Handle out of place operation */
+- if (sgl != sglout) {
+- struct qat_alg_buf *bufers;
+-
+- n = sg_nents(sglout);
+- sz_out = struct_size(buflout, bufers, n);
+- sg_nctr = 0;
+-
+- if (n > QAT_MAX_BUFF_DESC) {
+- buflout = kzalloc_node(sz_out, flags, node);
+- if (unlikely(!buflout))
+- goto err_in;
+- } else {
+- buflout = &qat_req->buf.sgl_dst.sgl_hdr;
+- memset(buflout, 0, sizeof(struct qat_alg_buf_list));
+- qat_req->buf.sgl_dst_valid = true;
+- }
+-
+- bufers = buflout->bufers;
+- for_each_sg(sglout, sg, n, i)
+- bufers[i].addr = DMA_MAPPING_ERROR;
+-
+- for_each_sg(sglout, sg, n, i) {
+- int y = sg_nctr;
+-
+- if (!sg->length)
+- continue;
+-
+- bufers[y].addr = dma_map_single(dev, sg_virt(sg),
+- sg->length,
+- DMA_FROM_DEVICE);
+- if (unlikely(dma_mapping_error(dev, bufers[y].addr)))
+- goto err_out;
+- bufers[y].len = sg->length;
+- sg_nctr++;
+- }
+- buflout->num_bufs = sg_nctr;
+- buflout->num_mapped_bufs = sg_nctr;
+- bloutp = dma_map_single(dev, buflout, sz_out, DMA_TO_DEVICE);
+- if (unlikely(dma_mapping_error(dev, bloutp)))
+- goto err_out;
+- qat_req->buf.blout = buflout;
+- qat_req->buf.bloutp = bloutp;
+- qat_req->buf.sz_out = sz_out;
+- } else {
+- /* Otherwise set the src and dst to the same address */
+- qat_req->buf.bloutp = qat_req->buf.blp;
+- qat_req->buf.sz_out = 0;
+- }
+- return 0;
+-
+-err_out:
+- if (!dma_mapping_error(dev, bloutp))
+- dma_unmap_single(dev, bloutp, sz_out, DMA_TO_DEVICE);
+-
+- n = sg_nents(sglout);
+- for (i = 0; i < n; i++)
+- if (!dma_mapping_error(dev, buflout->bufers[i].addr))
+- dma_unmap_single(dev, buflout->bufers[i].addr,
+- buflout->bufers[i].len,
+- DMA_FROM_DEVICE);
+-
+- if (!qat_req->buf.sgl_dst_valid)
+- kfree(buflout);
+-
+-err_in:
+- if (!dma_mapping_error(dev, blp))
+- dma_unmap_single(dev, blp, sz, DMA_TO_DEVICE);
+-
+- n = sg_nents(sgl);
+- for (i = 0; i < n; i++)
+- if (!dma_mapping_error(dev, bufl->bufers[i].addr))
+- dma_unmap_single(dev, bufl->bufers[i].addr,
+- bufl->bufers[i].len,
+- bufl_dma_dir);
+-
+- if (!qat_req->buf.sgl_src_valid)
+- kfree(bufl);
+-
+- dev_err(dev, "Failed to map buf for dma\n");
+- return -ENOMEM;
+-}
+-
+ static void qat_aead_alg_callback(struct icp_qat_fw_la_resp *qat_resp,
+ struct qat_crypto_request *qat_req)
+ {
+diff --git a/drivers/crypto/qat/qat_common/qat_bl.c b/drivers/crypto/qat/qat_common/qat_bl.c
+new file mode 100644
+index 0000000000000..6d0a39f8ce109
+--- /dev/null
++++ b/drivers/crypto/qat/qat_common/qat_bl.c
+@@ -0,0 +1,194 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/* Copyright(c) 2014 - 2022 Intel Corporation */
++#include <linux/device.h>
++#include <linux/dma-mapping.h>
++#include <linux/pci.h>
++#include <linux/scatterlist.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++#include "adf_accel_devices.h"
++#include "qat_bl.h"
++#include "qat_crypto.h"
++
++void qat_alg_free_bufl(struct qat_crypto_instance *inst,
++ struct qat_crypto_request *qat_req)
++{
++ struct device *dev = &GET_DEV(inst->accel_dev);
++ struct qat_alg_buf_list *bl = qat_req->buf.bl;
++ struct qat_alg_buf_list *blout = qat_req->buf.blout;
++ dma_addr_t blp = qat_req->buf.blp;
++ dma_addr_t blpout = qat_req->buf.bloutp;
++ size_t sz = qat_req->buf.sz;
++ size_t sz_out = qat_req->buf.sz_out;
++ int bl_dma_dir;
++ int i;
++
++ bl_dma_dir = blp != blpout ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL;
++
++ for (i = 0; i < bl->num_bufs; i++)
++ dma_unmap_single(dev, bl->bufers[i].addr,
++ bl->bufers[i].len, bl_dma_dir);
++
++ dma_unmap_single(dev, blp, sz, DMA_TO_DEVICE);
++
++ if (!qat_req->buf.sgl_src_valid)
++ kfree(bl);
++
++ if (blp != blpout) {
++ /* If out of place operation dma unmap only data */
++ int bufless = blout->num_bufs - blout->num_mapped_bufs;
++
++ for (i = bufless; i < blout->num_bufs; i++) {
++ dma_unmap_single(dev, blout->bufers[i].addr,
++ blout->bufers[i].len,
++ DMA_FROM_DEVICE);
++ }
++ dma_unmap_single(dev, blpout, sz_out, DMA_TO_DEVICE);
++
++ if (!qat_req->buf.sgl_dst_valid)
++ kfree(blout);
++ }
++}
++
++int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
++ struct scatterlist *sgl,
++ struct scatterlist *sglout,
++ struct qat_crypto_request *qat_req,
++ gfp_t flags)
++{
++ struct device *dev = &GET_DEV(inst->accel_dev);
++ int i, sg_nctr = 0;
++ int n = sg_nents(sgl);
++ struct qat_alg_buf_list *bufl;
++ struct qat_alg_buf_list *buflout = NULL;
++ dma_addr_t blp = DMA_MAPPING_ERROR;
++ dma_addr_t bloutp = DMA_MAPPING_ERROR;
++ struct scatterlist *sg;
++ size_t sz_out, sz = struct_size(bufl, bufers, n);
++ int node = dev_to_node(&GET_DEV(inst->accel_dev));
++ int bufl_dma_dir;
++
++ if (unlikely(!n))
++ return -EINVAL;
++
++ qat_req->buf.sgl_src_valid = false;
++ qat_req->buf.sgl_dst_valid = false;
++
++ if (n > QAT_MAX_BUFF_DESC) {
++ bufl = kzalloc_node(sz, flags, node);
++ if (unlikely(!bufl))
++ return -ENOMEM;
++ } else {
++ bufl = &qat_req->buf.sgl_src.sgl_hdr;
++ memset(bufl, 0, sizeof(struct qat_alg_buf_list));
++ qat_req->buf.sgl_src_valid = true;
++ }
++
++ bufl_dma_dir = sgl != sglout ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL;
++
++ for_each_sg(sgl, sg, n, i)
++ bufl->bufers[i].addr = DMA_MAPPING_ERROR;
++
++ for_each_sg(sgl, sg, n, i) {
++ int y = sg_nctr;
++
++ if (!sg->length)
++ continue;
++
++ bufl->bufers[y].addr = dma_map_single(dev, sg_virt(sg),
++ sg->length,
++ bufl_dma_dir);
++ bufl->bufers[y].len = sg->length;
++ if (unlikely(dma_mapping_error(dev, bufl->bufers[y].addr)))
++ goto err_in;
++ sg_nctr++;
++ }
++ bufl->num_bufs = sg_nctr;
++ blp = dma_map_single(dev, bufl, sz, DMA_TO_DEVICE);
++ if (unlikely(dma_mapping_error(dev, blp)))
++ goto err_in;
++ qat_req->buf.bl = bufl;
++ qat_req->buf.blp = blp;
++ qat_req->buf.sz = sz;
++ /* Handle out of place operation */
++ if (sgl != sglout) {
++ struct qat_alg_buf *bufers;
++
++ n = sg_nents(sglout);
++ sz_out = struct_size(buflout, bufers, n);
++ sg_nctr = 0;
++
++ if (n > QAT_MAX_BUFF_DESC) {
++ buflout = kzalloc_node(sz_out, flags, node);
++ if (unlikely(!buflout))
++ goto err_in;
++ } else {
++ buflout = &qat_req->buf.sgl_dst.sgl_hdr;
++ memset(buflout, 0, sizeof(struct qat_alg_buf_list));
++ qat_req->buf.sgl_dst_valid = true;
++ }
++
++ bufers = buflout->bufers;
++ for_each_sg(sglout, sg, n, i)
++ bufers[i].addr = DMA_MAPPING_ERROR;
++
++ for_each_sg(sglout, sg, n, i) {
++ int y = sg_nctr;
++
++ if (!sg->length)
++ continue;
++
++ bufers[y].addr = dma_map_single(dev, sg_virt(sg),
++ sg->length,
++ DMA_FROM_DEVICE);
++ if (unlikely(dma_mapping_error(dev, bufers[y].addr)))
++ goto err_out;
++ bufers[y].len = sg->length;
++ sg_nctr++;
++ }
++ buflout->num_bufs = sg_nctr;
++ buflout->num_mapped_bufs = sg_nctr;
++ bloutp = dma_map_single(dev, buflout, sz_out, DMA_TO_DEVICE);
++ if (unlikely(dma_mapping_error(dev, bloutp)))
++ goto err_out;
++ qat_req->buf.blout = buflout;
++ qat_req->buf.bloutp = bloutp;
++ qat_req->buf.sz_out = sz_out;
++ } else {
++ /* Otherwise set the src and dst to the same address */
++ qat_req->buf.bloutp = qat_req->buf.blp;
++ qat_req->buf.sz_out = 0;
++ }
++ return 0;
++
++err_out:
++ if (!dma_mapping_error(dev, bloutp))
++ dma_unmap_single(dev, bloutp, sz_out, DMA_TO_DEVICE);
++
++ n = sg_nents(sglout);
++ for (i = 0; i < n; i++)
++ if (!dma_mapping_error(dev, buflout->bufers[i].addr))
++ dma_unmap_single(dev, buflout->bufers[i].addr,
++ buflout->bufers[i].len,
++ DMA_FROM_DEVICE);
++
++ if (!qat_req->buf.sgl_dst_valid)
++ kfree(buflout);
++
++err_in:
++ if (!dma_mapping_error(dev, blp))
++ dma_unmap_single(dev, blp, sz, DMA_TO_DEVICE);
++
++ n = sg_nents(sgl);
++ for (i = 0; i < n; i++)
++ if (!dma_mapping_error(dev, bufl->bufers[i].addr))
++ dma_unmap_single(dev, bufl->bufers[i].addr,
++ bufl->bufers[i].len,
++ bufl_dma_dir);
++
++ if (!qat_req->buf.sgl_src_valid)
++ kfree(bufl);
++
++ dev_err(dev, "Failed to map buf for dma\n");
++ return -ENOMEM;
++}
+diff --git a/drivers/crypto/qat/qat_common/qat_bl.h b/drivers/crypto/qat/qat_common/qat_bl.h
+new file mode 100644
+index 0000000000000..7a916f1ec645f
+--- /dev/null
++++ b/drivers/crypto/qat/qat_common/qat_bl.h
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++/* Copyright(c) 2014 - 2022 Intel Corporation */
++#ifndef QAT_BL_H
++#define QAT_BL_H
++#include <linux/scatterlist.h>
++#include <linux/types.h>
++#include "qat_crypto.h"
++
++void qat_alg_free_bufl(struct qat_crypto_instance *inst,
++ struct qat_crypto_request *qat_req);
++int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
++ struct scatterlist *sgl,
++ struct scatterlist *sglout,
++ struct qat_crypto_request *qat_req,
++ gfp_t flags);
++
++#endif
+--
+2.42.0
+
--- /dev/null
+From 3d3e639737f99c53760757b0107828122f3f417f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 12:21:13 +0000
+Subject: crypto: qat - rename bufferlist functions
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit b0cd997f35598c4fc01bf22061e1eb88fc10afad ]
+
+Rename the functions qat_alg_sgl_to_bufl() and qat_alg_free_bufl() as
+qat_bl_sgl_to_bufl() and qat_bl_free_bufl() after their relocation into
+the qat_bl module.
+
+This commit does not implement any functional change.
+
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 9b2f33a1bfcd ("crypto: qat - fix unregistration of crypto algorithms")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/qat_algs.c | 20 ++++++++++----------
+ drivers/crypto/qat/qat_common/qat_bl.c | 14 +++++++-------
+ drivers/crypto/qat/qat_common/qat_bl.h | 14 +++++++-------
+ 3 files changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
+index d4e4bdb25c16e..ae83ba0cf1d93 100644
+--- a/drivers/crypto/qat/qat_common/qat_algs.c
++++ b/drivers/crypto/qat/qat_common/qat_algs.c
+@@ -673,7 +673,7 @@ static void qat_aead_alg_callback(struct icp_qat_fw_la_resp *qat_resp,
+ u8 stat_filed = qat_resp->comn_resp.comn_status;
+ int res = 0, qat_res = ICP_QAT_FW_COMN_RESP_CRYPTO_STAT_GET(stat_filed);
+
+- qat_alg_free_bufl(inst, qat_req);
++ qat_bl_free_bufl(inst, qat_req);
+ if (unlikely(qat_res != ICP_QAT_FW_COMN_STATUS_FLAG_OK))
+ res = -EBADMSG;
+ areq->base.complete(&areq->base, res);
+@@ -743,7 +743,7 @@ static void qat_skcipher_alg_callback(struct icp_qat_fw_la_resp *qat_resp,
+ u8 stat_filed = qat_resp->comn_resp.comn_status;
+ int res = 0, qat_res = ICP_QAT_FW_COMN_RESP_CRYPTO_STAT_GET(stat_filed);
+
+- qat_alg_free_bufl(inst, qat_req);
++ qat_bl_free_bufl(inst, qat_req);
+ if (unlikely(qat_res != ICP_QAT_FW_COMN_STATUS_FLAG_OK))
+ res = -EINVAL;
+
+@@ -799,7 +799,7 @@ static int qat_alg_aead_dec(struct aead_request *areq)
+ if (cipher_len % AES_BLOCK_SIZE != 0)
+ return -EINVAL;
+
+- ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req, f);
++ ret = qat_bl_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req, f);
+ if (unlikely(ret))
+ return ret;
+
+@@ -821,7 +821,7 @@ static int qat_alg_aead_dec(struct aead_request *areq)
+
+ ret = qat_alg_send_sym_message(qat_req, ctx->inst, &areq->base);
+ if (ret == -ENOSPC)
+- qat_alg_free_bufl(ctx->inst, qat_req);
++ qat_bl_free_bufl(ctx->inst, qat_req);
+
+ return ret;
+ }
+@@ -842,7 +842,7 @@ static int qat_alg_aead_enc(struct aead_request *areq)
+ if (areq->cryptlen % AES_BLOCK_SIZE != 0)
+ return -EINVAL;
+
+- ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req, f);
++ ret = qat_bl_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req, f);
+ if (unlikely(ret))
+ return ret;
+
+@@ -866,7 +866,7 @@ static int qat_alg_aead_enc(struct aead_request *areq)
+
+ ret = qat_alg_send_sym_message(qat_req, ctx->inst, &areq->base);
+ if (ret == -ENOSPC)
+- qat_alg_free_bufl(ctx->inst, qat_req);
++ qat_bl_free_bufl(ctx->inst, qat_req);
+
+ return ret;
+ }
+@@ -1027,7 +1027,7 @@ static int qat_alg_skcipher_encrypt(struct skcipher_request *req)
+ if (req->cryptlen == 0)
+ return 0;
+
+- ret = qat_alg_sgl_to_bufl(ctx->inst, req->src, req->dst, qat_req, f);
++ ret = qat_bl_sgl_to_bufl(ctx->inst, req->src, req->dst, qat_req, f);
+ if (unlikely(ret))
+ return ret;
+
+@@ -1048,7 +1048,7 @@ static int qat_alg_skcipher_encrypt(struct skcipher_request *req)
+
+ ret = qat_alg_send_sym_message(qat_req, ctx->inst, &req->base);
+ if (ret == -ENOSPC)
+- qat_alg_free_bufl(ctx->inst, qat_req);
++ qat_bl_free_bufl(ctx->inst, qat_req);
+
+ return ret;
+ }
+@@ -1093,7 +1093,7 @@ static int qat_alg_skcipher_decrypt(struct skcipher_request *req)
+ if (req->cryptlen == 0)
+ return 0;
+
+- ret = qat_alg_sgl_to_bufl(ctx->inst, req->src, req->dst, qat_req, f);
++ ret = qat_bl_sgl_to_bufl(ctx->inst, req->src, req->dst, qat_req, f);
+ if (unlikely(ret))
+ return ret;
+
+@@ -1115,7 +1115,7 @@ static int qat_alg_skcipher_decrypt(struct skcipher_request *req)
+
+ ret = qat_alg_send_sym_message(qat_req, ctx->inst, &req->base);
+ if (ret == -ENOSPC)
+- qat_alg_free_bufl(ctx->inst, qat_req);
++ qat_bl_free_bufl(ctx->inst, qat_req);
+
+ return ret;
+ }
+diff --git a/drivers/crypto/qat/qat_common/qat_bl.c b/drivers/crypto/qat/qat_common/qat_bl.c
+index 6d0a39f8ce109..8f7743f3c89b9 100644
+--- a/drivers/crypto/qat/qat_common/qat_bl.c
++++ b/drivers/crypto/qat/qat_common/qat_bl.c
+@@ -10,8 +10,8 @@
+ #include "qat_bl.h"
+ #include "qat_crypto.h"
+
+-void qat_alg_free_bufl(struct qat_crypto_instance *inst,
+- struct qat_crypto_request *qat_req)
++void qat_bl_free_bufl(struct qat_crypto_instance *inst,
++ struct qat_crypto_request *qat_req)
+ {
+ struct device *dev = &GET_DEV(inst->accel_dev);
+ struct qat_alg_buf_list *bl = qat_req->buf.bl;
+@@ -50,11 +50,11 @@ void qat_alg_free_bufl(struct qat_crypto_instance *inst,
+ }
+ }
+
+-int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
+- struct scatterlist *sgl,
+- struct scatterlist *sglout,
+- struct qat_crypto_request *qat_req,
+- gfp_t flags)
++int qat_bl_sgl_to_bufl(struct qat_crypto_instance *inst,
++ struct scatterlist *sgl,
++ struct scatterlist *sglout,
++ struct qat_crypto_request *qat_req,
++ gfp_t flags)
+ {
+ struct device *dev = &GET_DEV(inst->accel_dev);
+ int i, sg_nctr = 0;
+diff --git a/drivers/crypto/qat/qat_common/qat_bl.h b/drivers/crypto/qat/qat_common/qat_bl.h
+index 7a916f1ec645f..ed4c200ac6197 100644
+--- a/drivers/crypto/qat/qat_common/qat_bl.h
++++ b/drivers/crypto/qat/qat_common/qat_bl.h
+@@ -6,12 +6,12 @@
+ #include <linux/types.h>
+ #include "qat_crypto.h"
+
+-void qat_alg_free_bufl(struct qat_crypto_instance *inst,
+- struct qat_crypto_request *qat_req);
+-int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
+- struct scatterlist *sgl,
+- struct scatterlist *sglout,
+- struct qat_crypto_request *qat_req,
+- gfp_t flags);
++void qat_bl_free_bufl(struct qat_crypto_instance *inst,
++ struct qat_crypto_request *qat_req);
++int qat_bl_sgl_to_bufl(struct qat_crypto_instance *inst,
++ struct scatterlist *sgl,
++ struct scatterlist *sglout,
++ struct qat_crypto_request *qat_req,
++ gfp_t flags);
+
+ #endif
+--
+2.42.0
+
--- /dev/null
+From 7c2992a8f343006faa1b2ebb15a4118a45cea10a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 18:02:07 -0700
+Subject: cxl/mem: Fix shutdown order
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+[ Upstream commit 88d3917f82ed4215a2154432c26de1480a61b209 ]
+
+Ira reports that removing cxl_mock_mem causes a crash with the following
+trace:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000044
+ [..]
+ RIP: 0010:cxl_region_decode_reset+0x7f/0x180 [cxl_core]
+ [..]
+ Call Trace:
+ <TASK>
+ cxl_region_detach+0xe8/0x210 [cxl_core]
+ cxl_decoder_kill_region+0x27/0x40 [cxl_core]
+ cxld_unregister+0x29/0x40 [cxl_core]
+ devres_release_all+0xb8/0x110
+ device_unbind_cleanup+0xe/0x70
+ device_release_driver_internal+0x1d2/0x210
+ bus_remove_device+0xd7/0x150
+ device_del+0x155/0x3e0
+ device_unregister+0x13/0x60
+ devm_release_action+0x4d/0x90
+ ? __pfx_unregister_port+0x10/0x10 [cxl_core]
+ delete_endpoint+0x121/0x130 [cxl_core]
+ devres_release_all+0xb8/0x110
+ device_unbind_cleanup+0xe/0x70
+ device_release_driver_internal+0x1d2/0x210
+ bus_remove_device+0xd7/0x150
+ device_del+0x155/0x3e0
+ ? lock_release+0x142/0x290
+ cdev_device_del+0x15/0x50
+ cxl_memdev_unregister+0x54/0x70 [cxl_core]
+
+This crash is due to the clearing out the cxl_memdev's driver context
+(@cxlds) before the subsystem is done with it. This is ultimately due to
+the region(s), that this memdev is a member, being torn down and expecting
+to be able to de-reference @cxlds, like here:
+
+static int cxl_region_decode_reset(struct cxl_region *cxlr, int count)
+...
+ if (cxlds->rcd)
+ goto endpoint_reset;
+...
+
+Fix it by keeping the driver context valid until memdev-device
+unregistration, and subsequently the entire stack of related
+dependencies, unwinds.
+
+Fixes: 9cc238c7a526 ("cxl/pci: Introduce cdevm_file_operations")
+Reported-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Tested-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/core/memdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
+index 20ce488a77540..03cf99cce7047 100644
+--- a/drivers/cxl/core/memdev.c
++++ b/drivers/cxl/core/memdev.c
+@@ -214,8 +214,8 @@ static void cxl_memdev_unregister(void *_cxlmd)
+ struct cxl_memdev *cxlmd = _cxlmd;
+ struct device *dev = &cxlmd->dev;
+
+- cxl_memdev_shutdown(dev);
+ cdev_device_del(&cxlmd->cdev, dev);
++ cxl_memdev_shutdown(dev);
+ put_device(dev);
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 85aa6ede5c2c75bb1a6b0cba6e2c888b651016dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Sep 2023 09:22:32 -0700
+Subject: dmaengine: idxd: Register dsa_bus_type before registering idxd
+ sub-drivers
+
+From: Fenghua Yu <fenghua.yu@intel.com>
+
+[ Upstream commit 88928addeec577386e8c83b48b5bc24d28ba97fd ]
+
+idxd sub-drivers belong to bus dsa_bus_type. Thus, dsa_bus_type must be
+registered in dsa bus init before idxd drivers can be registered.
+
+But the order is wrong when both idxd and idxd_bus are builtin drivers.
+In this case, idxd driver is compiled and linked before idxd_bus driver.
+Since the initcall order is determined by the link order, idxd sub-drivers
+are registered in idxd initcall before dsa_bus_type is registered
+in idxd_bus initcall. idxd initcall fails:
+
+[ 21.562803] calling idxd_init_module+0x0/0x110 @ 1
+[ 21.570761] Driver 'idxd' was unable to register with bus_type 'dsa' because the bus was not initialized.
+[ 21.586475] initcall idxd_init_module+0x0/0x110 returned -22 after 15717 usecs
+[ 21.597178] calling dsa_bus_init+0x0/0x20 @ 1
+
+To fix the issue, compile and link idxd_bus driver before idxd driver
+to ensure the right registration order.
+
+Fixes: d9e5481fca74 ("dmaengine: dsa: move dsa_bus_type out of idxd driver to standalone")
+Reported-by: Michael Prinke <michael.prinke@intel.com>
+Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Lijun Pan <lijun.pan@intel.com>
+Tested-by: Lijun Pan <lijun.pan@intel.com>
+Link: https://lore.kernel.org/r/20230924162232.1409454-1-fenghua.yu@intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/Makefile | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/dma/idxd/Makefile b/drivers/dma/idxd/Makefile
+index a1e9f2b3a37cc..817ffa95a9b11 100644
+--- a/drivers/dma/idxd/Makefile
++++ b/drivers/dma/idxd/Makefile
+@@ -1,12 +1,12 @@
+ ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE=IDXD
+
++obj-$(CONFIG_INTEL_IDXD_BUS) += idxd_bus.o
++idxd_bus-y := bus.o
++
+ obj-$(CONFIG_INTEL_IDXD) += idxd.o
+ idxd-y := init.o irq.o device.o sysfs.o submit.o dma.o cdev.o
+
+ idxd-$(CONFIG_INTEL_IDXD_PERFMON) += perfmon.o
+
+-obj-$(CONFIG_INTEL_IDXD_BUS) += idxd_bus.o
+-idxd_bus-y := bus.o
+-
+ obj-$(CONFIG_INTEL_IDXD_COMPAT) += idxd_compat.o
+ idxd_compat-y := compat.o
+--
+2.42.0
+
--- /dev/null
+From e83cda7fad01f3b92cf55db81a2d94be8a0d7b7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Oct 2023 13:13:09 +0200
+Subject: dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 83c761f568733277ce1f7eb9dc9e890649c29a8c ]
+
+If pxad_alloc_desc() fails on the first dma_pool_alloc() call, then
+sw_desc->nb_desc is zero.
+In such a case pxad_free_desc() is called and it will BUG_ON().
+
+Remove this erroneous BUG_ON().
+
+It is also useless, because if "sw_desc->nb_desc == 0", then, on the first
+iteration of the for loop, i is -1 and the loop will not be executed.
+(both i and sw_desc->nb_desc are 'int')
+
+Fixes: a57e16cf0333 ("dmaengine: pxa: add pxa dmaengine driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/c8fc5563c9593c914fde41f0f7d1489a21b45a9a.1696676782.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/pxa_dma.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c
+index 22a392fe6d32b..04c1f2ee874a5 100644
+--- a/drivers/dma/pxa_dma.c
++++ b/drivers/dma/pxa_dma.c
+@@ -722,7 +722,6 @@ static void pxad_free_desc(struct virt_dma_desc *vd)
+ dma_addr_t dma;
+ struct pxad_desc_sw *sw_desc = to_pxad_sw_desc(vd);
+
+- BUG_ON(sw_desc->nb_desc == 0);
+ for (i = sw_desc->nb_desc - 1; i >= 0; i--) {
+ if (i > 0)
+ dma = sw_desc->hw_desc[i - 1]->ddadr;
+--
+2.42.0
+
--- /dev/null
+From 49921fb912b6ca1e9a6bd9d94c2e64f77aa12561 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 15:59:59 +0300
+Subject: dmaengine: ti: edma: handle irq_of_parse_and_map() errors
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 14f6d317913f634920a640e9047aa2e66f5bdcb7 ]
+
+Zero is not a valid IRQ for in-kernel code and the irq_of_parse_and_map()
+function returns zero on error. So this check for valid IRQs should only
+accept values > 0.
+
+Fixes: 2b6b3b742019 ("ARM/dmaengine: edma: Merge the two drivers under drivers/dma/")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/r/f15cb6a7-8449-4f79-98b6-34072f04edbc@moroto.mountain
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/edma.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
+index fa06d7e6d8e38..7ec6e5d728b03 100644
+--- a/drivers/dma/ti/edma.c
++++ b/drivers/dma/ti/edma.c
+@@ -2410,7 +2410,7 @@ static int edma_probe(struct platform_device *pdev)
+ if (irq < 0 && node)
+ irq = irq_of_parse_and_map(node, 0);
+
+- if (irq >= 0) {
++ if (irq > 0) {
+ irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccint",
+ dev_name(dev));
+ ret = devm_request_irq(dev, irq, dma_irq_handler, 0, irq_name,
+@@ -2426,7 +2426,7 @@ static int edma_probe(struct platform_device *pdev)
+ if (irq < 0 && node)
+ irq = irq_of_parse_and_map(node, 2);
+
+- if (irq >= 0) {
++ if (irq > 0) {
+ irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccerrint",
+ dev_name(dev));
+ ret = devm_request_irq(dev, irq, dma_ccerr_handler, 0, irq_name,
+--
+2.42.0
+
--- /dev/null
+From adfde6043114fe699d83ef8d45085066c4da03bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 08:50:20 +0300
+Subject: drivers/clocksource/timer-ti-dm: Don't call clk_get_rate() in stop
+ function
+
+From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
+
+[ Upstream commit 12590d4d0e331d3cb9e6b3494515cd61c8a6624e ]
+
+clk_get_rate() might sleep, and that prevents dm-timer based PWM from being
+used from atomic context.
+
+Fix that by getting fclk rate in probe() and using a notifier in case rate
+changes.
+
+Fixes: af04aa856e93 ("ARM: OMAP: Move dmtimer driver out of plat-omap to drivers under clocksource")
+Signed-off-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/1696312220-11550-1-git-send-email-ivo.g.dimitrov.75@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-ti-dm.c | 36 ++++++++++++++++++++++++-------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c
+index 00af1a8e34fbd..ec86aecb748f1 100644
+--- a/drivers/clocksource/timer-ti-dm.c
++++ b/drivers/clocksource/timer-ti-dm.c
+@@ -141,6 +141,8 @@ struct dmtimer {
+ struct platform_device *pdev;
+ struct list_head node;
+ struct notifier_block nb;
++ struct notifier_block fclk_nb;
++ unsigned long fclk_rate;
+ };
+
+ static u32 omap_reserved_systimers;
+@@ -254,8 +256,7 @@ static inline void __omap_dm_timer_enable_posted(struct dmtimer *timer)
+ timer->posted = OMAP_TIMER_POSTED;
+ }
+
+-static inline void __omap_dm_timer_stop(struct dmtimer *timer,
+- unsigned long rate)
++static inline void __omap_dm_timer_stop(struct dmtimer *timer)
+ {
+ u32 l;
+
+@@ -270,7 +271,7 @@ static inline void __omap_dm_timer_stop(struct dmtimer *timer,
+ * Wait for functional clock period x 3.5 to make sure that
+ * timer is stopped
+ */
+- udelay(3500000 / rate + 1);
++ udelay(3500000 / timer->fclk_rate + 1);
+ #endif
+ }
+
+@@ -349,6 +350,21 @@ static int omap_timer_context_notifier(struct notifier_block *nb,
+ return NOTIFY_OK;
+ }
+
++static int omap_timer_fclk_notifier(struct notifier_block *nb,
++ unsigned long event, void *data)
++{
++ struct clk_notifier_data *clk_data = data;
++ struct dmtimer *timer = container_of(nb, struct dmtimer, fclk_nb);
++
++ switch (event) {
++ case POST_RATE_CHANGE:
++ timer->fclk_rate = clk_data->new_rate;
++ return NOTIFY_OK;
++ default:
++ return NOTIFY_DONE;
++ }
++}
++
+ static int omap_dm_timer_reset(struct dmtimer *timer)
+ {
+ u32 l, timeout = 100000;
+@@ -742,7 +758,6 @@ static int omap_dm_timer_stop(struct omap_dm_timer *cookie)
+ {
+ struct dmtimer *timer;
+ struct device *dev;
+- unsigned long rate = 0;
+
+ timer = to_dmtimer(cookie);
+ if (unlikely(!timer))
+@@ -750,10 +765,7 @@ static int omap_dm_timer_stop(struct omap_dm_timer *cookie)
+
+ dev = &timer->pdev->dev;
+
+- if (!timer->omap1)
+- rate = clk_get_rate(timer->fclk);
+-
+- __omap_dm_timer_stop(timer, rate);
++ __omap_dm_timer_stop(timer);
+
+ pm_runtime_put_sync(dev);
+
+@@ -1112,6 +1124,14 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
+ timer->fclk = devm_clk_get(dev, "fck");
+ if (IS_ERR(timer->fclk))
+ return PTR_ERR(timer->fclk);
++
++ timer->fclk_nb.notifier_call = omap_timer_fclk_notifier;
++ ret = devm_clk_notifier_register(dev, timer->fclk,
++ &timer->fclk_nb);
++ if (ret)
++ return ret;
++
++ timer->fclk_rate = clk_get_rate(timer->fclk);
+ } else {
+ timer->fclk = ERR_PTR(-ENODEV);
+ }
+--
+2.42.0
+
--- /dev/null
+From abfd4e8d3a6152a153aa3abc1f730714edd994c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 17:13:52 +0800
+Subject: drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for
+ hisi_hns3_pmu uninit process
+
+From: Hao Chen <chenhao418@huawei.com>
+
+[ Upstream commit 50b560783f7f71790bcf70e9e9855155fb0af8c1 ]
+
+When tearing down a 'hisi_hns3' PMU, we mistakenly run the CPU hotplug
+callbacks after the device has been unregistered, leading to fireworks
+when we try to execute empty function callbacks within the driver:
+
+ | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+ | CPU: 0 PID: 15 Comm: cpuhp/0 Tainted: G W O 5.12.0-rc4+ #1
+ | Hardware name: , BIOS KpxxxFPGA 1P B600 V143 04/22/2021
+ | pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
+ | pc : perf_pmu_migrate_context+0x98/0x38c
+ | lr : perf_pmu_migrate_context+0x94/0x38c
+ |
+ | Call trace:
+ | perf_pmu_migrate_context+0x98/0x38c
+ | hisi_hns3_pmu_offline_cpu+0x104/0x12c [hisi_hns3_pmu]
+
+Use cpuhp_state_remove_instance_nocalls() instead of
+cpuhp_state_remove_instance() so that the notifiers don't execute after
+the PMU device has been unregistered.
+
+Fixes: 66637ab137b4 ("drivers/perf: hisi: add driver for HNS3 PMU")
+Signed-off-by: Hao Chen <chenhao418@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Reviewed-by: Yicong Yang <yangyicong@hisilicon.com>
+Link: https://lore.kernel.org/r/20231019091352.998964-1-shaojijie@huawei.com
+[will: Rewrote commit message]
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/hisilicon/hns3_pmu.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/perf/hisilicon/hns3_pmu.c b/drivers/perf/hisilicon/hns3_pmu.c
+index e0457d84af6b3..16869bf5bf4cc 100644
+--- a/drivers/perf/hisilicon/hns3_pmu.c
++++ b/drivers/perf/hisilicon/hns3_pmu.c
+@@ -1556,8 +1556,8 @@ static int hns3_pmu_init_pmu(struct pci_dev *pdev, struct hns3_pmu *hns3_pmu)
+ ret = perf_pmu_register(&hns3_pmu->pmu, hns3_pmu->pmu.name, -1);
+ if (ret) {
+ pci_err(pdev, "failed to register perf PMU, ret = %d.\n", ret);
+- cpuhp_state_remove_instance(CPUHP_AP_PERF_ARM_HNS3_PMU_ONLINE,
+- &hns3_pmu->node);
++ cpuhp_state_remove_instance_nocalls(CPUHP_AP_PERF_ARM_HNS3_PMU_ONLINE,
++ &hns3_pmu->node);
+ }
+
+ return ret;
+@@ -1568,8 +1568,8 @@ static void hns3_pmu_uninit_pmu(struct pci_dev *pdev)
+ struct hns3_pmu *hns3_pmu = pci_get_drvdata(pdev);
+
+ perf_pmu_unregister(&hns3_pmu->pmu);
+- cpuhp_state_remove_instance(CPUHP_AP_PERF_ARM_HNS3_PMU_ONLINE,
+- &hns3_pmu->node);
++ cpuhp_state_remove_instance_nocalls(CPUHP_AP_PERF_ARM_HNS3_PMU_ONLINE,
++ &hns3_pmu->node);
+ }
+
+ static int hns3_pmu_init_dev(struct pci_dev *pdev)
+--
+2.42.0
+
--- /dev/null
+From 4651add3693bb29a7daf4e8e57fc7298469955c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 17:29:53 +0800
+Subject: drivers/perf: hisi_pcie: Check the type first in pmu::event_init()
+
+From: Yicong Yang <yangyicong@hisilicon.com>
+
+[ Upstream commit 6d7d51e88e21c0af1ca96a3617afef334bfeffcf ]
+
+Check whether the event type matches the PMU type firstly in
+pmu::event_init() before touching the event. Otherwise we'll
+change the events of others and lead to incorrect results.
+Since in perf_init_event() we may call every pmu's event_init()
+in a certain case, we should not modify the event if it's not
+ours.
+
+Fixes: 8404b0fbc7fb ("drivers/perf: hisi: Add driver for HiSilicon PCIe PMU")
+Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
+Link: https://lore.kernel.org/r/20231024092954.42297-2-yangyicong@huawei.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/hisilicon/hisi_pcie_pmu.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c
+index b61f1f9aba214..c4c1cd269c577 100644
+--- a/drivers/perf/hisilicon/hisi_pcie_pmu.c
++++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c
+@@ -342,6 +342,10 @@ static int hisi_pcie_pmu_event_init(struct perf_event *event)
+ struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu);
+ struct hw_perf_event *hwc = &event->hw;
+
++ /* Check the type first before going on, otherwise it's not our event */
++ if (event->attr.type != event->pmu->type)
++ return -ENOENT;
++
+ event->cpu = pcie_pmu->on_cpu;
+
+ if (EXT_COUNTER_IS_USED(hisi_pcie_get_event(event)))
+@@ -349,9 +353,6 @@ static int hisi_pcie_pmu_event_init(struct perf_event *event)
+ else
+ hwc->event_base = HISI_PCIE_CNT;
+
+- if (event->attr.type != event->pmu->type)
+- return -ENOENT;
+-
+ /* Sampling is not supported. */
+ if (is_sampling_event(event) || event->attach_state & PERF_ATTACH_TASK)
+ return -EOPNOTSUPP;
+--
+2.42.0
+
--- /dev/null
+From 346daece5a34b54bd2b661886a3bad7d15bb46e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Oct 2023 16:16:49 +0200
+Subject: drm/amd/display: Bail from dm_check_crtc_cursor if no relevant change
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <mdaenzer@redhat.com>
+
+[ Upstream commit bc0b79ce2050aa523c38c96b6d26340a96bfbdca ]
+
+If no plane was newly enabled or changed scaling, there can be no new
+scaling mismatch with the cursor plane.
+
+By not pulling non-cursor plane states into all atomic commits while
+the cursor plane is enabled, this avoids synchronizing all cursor plane
+changes to vertical blank, which caused the following IGT tests to fail:
+
+kms_cursor_legacy@cursor-vs-flip.*
+kms_cursor_legacy@flip-vs-cursor.*
+
+Fixes: 003048ddf44b ("drm/amd/display: Check all enabled planes in dm_check_crtc_cursor")
+Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 33 ++++++++++++++++++-
+ 1 file changed, 32 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 73db46b9e3e1a..42e266e074d1d 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -9641,10 +9641,12 @@ static int dm_check_crtc_cursor(struct drm_atomic_state *state,
+ struct drm_crtc *crtc,
+ struct drm_crtc_state *new_crtc_state)
+ {
+- struct drm_plane *cursor = crtc->cursor, *underlying;
++ struct drm_plane *cursor = crtc->cursor, *plane, *underlying;
++ struct drm_plane_state *old_plane_state, *new_plane_state;
+ struct drm_plane_state *new_cursor_state, *new_underlying_state;
+ int i;
+ int cursor_scale_w, cursor_scale_h, underlying_scale_w, underlying_scale_h;
++ bool any_relevant_change = false;
+
+ /* On DCE and DCN there is no dedicated hardware cursor plane. We get a
+ * cursor per pipe but it's going to inherit the scaling and
+@@ -9652,6 +9654,35 @@ static int dm_check_crtc_cursor(struct drm_atomic_state *state,
+ * blending properties match the underlying planes'.
+ */
+
++ /* If no plane was enabled or changed scaling, no need to check again */
++ for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) {
++ int new_scale_w, new_scale_h, old_scale_w, old_scale_h;
++
++ if (!new_plane_state || !new_plane_state->fb || new_plane_state->crtc != crtc)
++ continue;
++
++ if (!old_plane_state || !old_plane_state->fb || old_plane_state->crtc != crtc) {
++ any_relevant_change = true;
++ break;
++ }
++
++ if (new_plane_state->fb == old_plane_state->fb &&
++ new_plane_state->crtc_w == old_plane_state->crtc_w &&
++ new_plane_state->crtc_h == old_plane_state->crtc_h)
++ continue;
++
++ dm_get_plane_scale(new_plane_state, &new_scale_w, &new_scale_h);
++ dm_get_plane_scale(old_plane_state, &old_scale_w, &old_scale_h);
++
++ if (new_scale_w != old_scale_w || new_scale_h != old_scale_h) {
++ any_relevant_change = true;
++ break;
++ }
++ }
++
++ if (!any_relevant_change)
++ return 0;
++
+ new_cursor_state = drm_atomic_get_plane_state(state, cursor);
+ if (IS_ERR(new_cursor_state))
+ return PTR_ERR(new_cursor_state);
+--
+2.42.0
+
--- /dev/null
+From f77f268b58c36e1e27324e60afb24f681913bc76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 12:22:24 +0200
+Subject: drm/amd/display: Check all enabled planes in dm_check_crtc_cursor
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <mdaenzer@redhat.com>
+
+[ Upstream commit 003048ddf44b1a6cfa57afa5a0cf40673e13f1ba ]
+
+It was only checking planes which had any state changes in the same
+commit. However, it also needs to check other enabled planes.
+
+Not doing this meant that a commit might spuriously "succeed", resulting
+in the cursor plane displaying with incorrect scaling. See
+https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/3177#note_1824263
+for an example.
+
+Fixes: d1bfbe8a3202 ("amd/display: check cursor plane matches underlying plane")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 339f1f5a08339..ebd07e3f12571 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -9643,14 +9643,24 @@ static int dm_check_crtc_cursor(struct drm_atomic_state *state,
+ * blending properties match the underlying planes'.
+ */
+
+- new_cursor_state = drm_atomic_get_new_plane_state(state, cursor);
+- if (!new_cursor_state || !new_cursor_state->fb)
++ new_cursor_state = drm_atomic_get_plane_state(state, cursor);
++ if (IS_ERR(new_cursor_state))
++ return PTR_ERR(new_cursor_state);
++
++ if (!new_cursor_state->fb)
+ return 0;
+
+ dm_get_oriented_plane_size(new_cursor_state, &cursor_src_w, &cursor_src_h);
+ cursor_scale_w = new_cursor_state->crtc_w * 1000 / cursor_src_w;
+ cursor_scale_h = new_cursor_state->crtc_h * 1000 / cursor_src_h;
+
++ /* Need to check all enabled planes, even if this commit doesn't change
++ * their state
++ */
++ i = drm_atomic_add_affected_planes(state, crtc);
++ if (i)
++ return i;
++
+ for_each_new_plane_in_state_reverse(state, underlying, new_underlying_state, i) {
+ /* Narrow down to non-cursor planes on the same CRTC as the cursor */
+ if (new_underlying_state->crtc != crtc || underlying == crtc->cursor)
+--
+2.42.0
+
--- /dev/null
+From 395866e1390741b4f92d4f08e6f58f3305efdedb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Oct 2023 16:16:48 +0200
+Subject: drm/amd/display: Refactor dm_get_plane_scale helper
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <mdaenzer@redhat.com>
+
+[ Upstream commit ec4d770bbb155674c2497f255f4199bdc42287a9 ]
+
+Cleanup, no functional change intended.
+
+Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: bc0b79ce2050 ("drm/amd/display: Bail from dm_check_crtc_cursor if no relevant change")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 23 +++++++++++--------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index ebd07e3f12571..73db46b9e3e1a 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -9626,6 +9626,17 @@ static void dm_get_oriented_plane_size(struct drm_plane_state *plane_state,
+ }
+ }
+
++static void
++dm_get_plane_scale(struct drm_plane_state *plane_state,
++ int *out_plane_scale_w, int *out_plane_scale_h)
++{
++ int plane_src_w, plane_src_h;
++
++ dm_get_oriented_plane_size(plane_state, &plane_src_w, &plane_src_h);
++ *out_plane_scale_w = plane_state->crtc_w * 1000 / plane_src_w;
++ *out_plane_scale_h = plane_state->crtc_h * 1000 / plane_src_h;
++}
++
+ static int dm_check_crtc_cursor(struct drm_atomic_state *state,
+ struct drm_crtc *crtc,
+ struct drm_crtc_state *new_crtc_state)
+@@ -9634,8 +9645,6 @@ static int dm_check_crtc_cursor(struct drm_atomic_state *state,
+ struct drm_plane_state *new_cursor_state, *new_underlying_state;
+ int i;
+ int cursor_scale_w, cursor_scale_h, underlying_scale_w, underlying_scale_h;
+- int cursor_src_w, cursor_src_h;
+- int underlying_src_w, underlying_src_h;
+
+ /* On DCE and DCN there is no dedicated hardware cursor plane. We get a
+ * cursor per pipe but it's going to inherit the scaling and
+@@ -9650,9 +9659,7 @@ static int dm_check_crtc_cursor(struct drm_atomic_state *state,
+ if (!new_cursor_state->fb)
+ return 0;
+
+- dm_get_oriented_plane_size(new_cursor_state, &cursor_src_w, &cursor_src_h);
+- cursor_scale_w = new_cursor_state->crtc_w * 1000 / cursor_src_w;
+- cursor_scale_h = new_cursor_state->crtc_h * 1000 / cursor_src_h;
++ dm_get_plane_scale(new_cursor_state, &cursor_scale_w, &cursor_scale_h);
+
+ /* Need to check all enabled planes, even if this commit doesn't change
+ * their state
+@@ -9670,10 +9677,8 @@ static int dm_check_crtc_cursor(struct drm_atomic_state *state,
+ if (!new_underlying_state->fb)
+ continue;
+
+- dm_get_oriented_plane_size(new_underlying_state,
+- &underlying_src_w, &underlying_src_h);
+- underlying_scale_w = new_underlying_state->crtc_w * 1000 / underlying_src_w;
+- underlying_scale_h = new_underlying_state->crtc_h * 1000 / underlying_src_h;
++ dm_get_plane_scale(new_underlying_state,
++ &underlying_scale_w, &underlying_scale_h);
+
+ if (cursor_scale_w != underlying_scale_w ||
+ cursor_scale_h != underlying_scale_h) {
+--
+2.42.0
+
--- /dev/null
+From d90cdd0a8afcdc205398674ec70b9ea8967ffe68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Sep 2023 11:02:51 -0500
+Subject: drm/amdkfd: fix some race conditions in vram buffer alloc/free of svm
+ code
+
+From: Xiaogang Chen <xiaogang.chen@amd.com>
+
+[ Upstream commit 7bfaa160caed8192f8262c4638f552cad94bcf5a ]
+
+This patch fixes:
+1: ref number of prange's svm_bo got decreased by an async call from hmm. When
+wait svm_bo of prange got released we shoul also wait prang->svm_bo become NULL,
+otherwise prange->svm_bo may be set to null after allocate new vram buffer.
+
+2: During waiting svm_bo of prange got released in a while loop should reschedule
+current task to give other tasks oppotunity to run, specially the the workque
+task that handles svm_bo ref release, otherwise we may enter to softlock.
+
+Signed-off-by: Xiaogang.Chen <xiaogang.chen@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 63feea08904cb..d7e758c86a0b8 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -487,11 +487,11 @@ svm_range_validate_svm_bo(struct amdgpu_device *adev, struct svm_range *prange)
+
+ /* We need a new svm_bo. Spin-loop to wait for concurrent
+ * svm_range_bo_release to finish removing this range from
+- * its range list. After this, it is safe to reuse the
+- * svm_bo pointer and svm_bo_list head.
++ * its range list and set prange->svm_bo to null. After this,
++ * it is safe to reuse the svm_bo pointer and svm_bo_list head.
+ */
+- while (!list_empty_careful(&prange->svm_bo_list))
+- ;
++ while (!list_empty_careful(&prange->svm_bo_list) || prange->svm_bo)
++ cond_resched();
+
+ return false;
+ }
+--
+2.42.0
+
--- /dev/null
+From 272c3ec18f1bc4356f90899a11c67e24f278c187 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Sep 2023 15:01:23 +0530
+Subject: drm: bridge: it66121: Fix invalid connector dereference
+
+From: Jai Luthra <j-luthra@ti.com>
+
+[ Upstream commit d0375f6858c4ff7244b62b02eb5e93428e1916cd ]
+
+Fix the NULL pointer dereference when no monitor is connected, and the
+sound card is opened from userspace.
+
+Instead return an empty buffer (of zeroes) as the EDID information to
+the sound framework if there is no connector attached.
+
+Fixes: e0fd83dbe924 ("drm: bridge: it66121: Add audio support")
+Reported-by: Nishanth Menon <nm@ti.com>
+Closes: https://lore.kernel.org/all/20230825105849.crhon42qndxqif4i@gondola/
+Reviewed-by: Helen Koike <helen.koike@collabora.com>
+Signed-off-by: Jai Luthra <j-luthra@ti.com>
+Tested-by: Nishanth Menon <nm@ti.com>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230901-it66121_edid-v2-1-aa59605336b9@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ite-it66121.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/ite-it66121.c b/drivers/gpu/drm/bridge/ite-it66121.c
+index 4f6f1deba28c6..9d7f3c99748b4 100644
+--- a/drivers/gpu/drm/bridge/ite-it66121.c
++++ b/drivers/gpu/drm/bridge/ite-it66121.c
+@@ -1464,10 +1464,14 @@ static int it66121_audio_get_eld(struct device *dev, void *data,
+ struct it66121_ctx *ctx = dev_get_drvdata(dev);
+
+ mutex_lock(&ctx->lock);
+-
+- memcpy(buf, ctx->connector->eld,
+- min(sizeof(ctx->connector->eld), len));
+-
++ if (!ctx->connector) {
++ /* Pass en empty ELD if connector not available */
++ dev_dbg(dev, "No connector present, passing empty EDID data");
++ memset(buf, 0, len);
++ } else {
++ memcpy(buf, ctx->connector->eld,
++ min(sizeof(ctx->connector->eld), len));
++ }
+ mutex_unlock(&ctx->lock);
+
+ return 0;
+--
+2.42.0
+
--- /dev/null
+From fb0efddadfd2fa7c46afbdb52c64e5ab18d22821 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 12:23:20 +0100
+Subject: drm/bridge: lt8912b: Add hot plug detection
+
+From: Stefan Eichenberger <stefan.eichenberger@toradex.com>
+
+[ Upstream commit 3b0a01a6a5224ed9b3f69f44edaa889b2e2b9779 ]
+
+Enable hot plug detection when it is available on the HDMI port.
+Without this connecting to a different monitor with incompatible timing
+before the 10 seconds poll period will lead to a broken display output.
+
+Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
+Signed-off-by: Stefan Eichenberger <stefan.eichenberger@toradex.com>
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Adrien Grassein <adrien.grassein@gmail.com>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221128112320.25708-1-francesco@dolcini.it
+Stable-dep-of: 941882a0e96d ("drm/bridge: lt8912b: Fix bridge_detach")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt8912b.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+index 5e419934d2a39..8d2785a305b39 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+@@ -516,14 +516,27 @@ static int lt8912_attach_dsi(struct lt8912 *lt)
+ return 0;
+ }
+
++static void lt8912_bridge_hpd_cb(void *data, enum drm_connector_status status)
++{
++ struct lt8912 *lt = data;
++
++ if (lt->bridge.dev)
++ drm_helper_hpd_irq_event(lt->bridge.dev);
++}
++
+ static int lt8912_bridge_connector_init(struct drm_bridge *bridge)
+ {
+ int ret;
+ struct lt8912 *lt = bridge_to_lt8912(bridge);
+ struct drm_connector *connector = <->connector;
+
+- connector->polled = DRM_CONNECTOR_POLL_CONNECT |
+- DRM_CONNECTOR_POLL_DISCONNECT;
++ if (lt->hdmi_port->ops & DRM_BRIDGE_OP_HPD) {
++ drm_bridge_hpd_enable(lt->hdmi_port, lt8912_bridge_hpd_cb, lt);
++ connector->polled = DRM_CONNECTOR_POLL_HPD;
++ } else {
++ connector->polled = DRM_CONNECTOR_POLL_CONNECT |
++ DRM_CONNECTOR_POLL_DISCONNECT;
++ }
+
+ ret = drm_connector_init(bridge->dev, connector,
+ <8912_connector_funcs,
+@@ -577,6 +590,10 @@ static void lt8912_bridge_detach(struct drm_bridge *bridge)
+
+ if (lt->is_attached) {
+ lt8912_hard_power_off(lt);
++
++ if (lt->hdmi_port->ops & DRM_BRIDGE_OP_HPD)
++ drm_bridge_hpd_disable(lt->hdmi_port);
++
+ drm_connector_unregister(<->connector);
+ drm_connector_cleanup(<->connector);
+ }
+--
+2.42.0
+
--- /dev/null
+From a9ce527821d3cb0dae050a15141a6af1cf8d8cd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Aug 2023 13:48:13 +0300
+Subject: drm/bridge: lt8912b: Add missing drm_bridge_attach call
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit f45acf7acf75921c0409d452f0165f51a19a74fd ]
+
+The driver does not call drm_bridge_attach(), which causes the next
+bridge to not be added to the bridge chain. This causes the pipeline
+init to fail when DRM_BRIDGE_ATTACH_NO_CONNECTOR is used.
+
+Add the call to drm_bridge_attach().
+
+Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230804-lt8912b-v1-4-c542692c6a2f@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt8912b.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+index 1977d3c0a81d1..ac76c23635892 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+@@ -558,6 +558,13 @@ static int lt8912_bridge_attach(struct drm_bridge *bridge,
+ struct lt8912 *lt = bridge_to_lt8912(bridge);
+ int ret;
+
++ ret = drm_bridge_attach(bridge->encoder, lt->hdmi_port, bridge,
++ DRM_BRIDGE_ATTACH_NO_CONNECTOR);
++ if (ret < 0) {
++ dev_err(lt->dev, "Failed to attach next bridge (%d)\n", ret);
++ return ret;
++ }
++
+ if (!(flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR)) {
+ ret = lt8912_bridge_connector_init(bridge);
+ if (ret) {
+--
+2.42.0
+
--- /dev/null
+From 24adf06377b9b275be83eb1f320192e6f8668b7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Aug 2023 13:48:10 +0300
+Subject: drm/bridge: lt8912b: Fix bridge_detach
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 941882a0e96d245f38116e940912b404b6a93c6f ]
+
+The driver calls lt8912_bridge_detach() from its lt8912_remove()
+function. As the DRM core detaches bridges automatically, this leads to
+calling lt8912_bridge_detach() twice. The code probably has tried to
+manage the double-call with the 'is_attached' variable, but the driver
+never sets the variable to false, so its of no help.
+
+Fix the issue by dropping the call to lt8912_bridge_detach() from
+lt8912_remove(), as the DRM core will handle the detach call for us,
+and also drop the useless is_attached field.
+
+Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230804-lt8912b-v1-1-c542692c6a2f@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt8912b.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+index 8d2785a305b39..dc16b0d01bcb9 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+@@ -45,7 +45,6 @@ struct lt8912 {
+
+ u8 data_lanes;
+ bool is_power_on;
+- bool is_attached;
+ };
+
+ static int lt8912_write_init_config(struct lt8912 *lt)
+@@ -575,8 +574,6 @@ static int lt8912_bridge_attach(struct drm_bridge *bridge,
+ if (ret)
+ goto error;
+
+- lt->is_attached = true;
+-
+ return 0;
+
+ error:
+@@ -588,15 +585,13 @@ static void lt8912_bridge_detach(struct drm_bridge *bridge)
+ {
+ struct lt8912 *lt = bridge_to_lt8912(bridge);
+
+- if (lt->is_attached) {
+- lt8912_hard_power_off(lt);
++ lt8912_hard_power_off(lt);
+
+- if (lt->hdmi_port->ops & DRM_BRIDGE_OP_HPD)
+- drm_bridge_hpd_disable(lt->hdmi_port);
++ if (lt->hdmi_port->ops & DRM_BRIDGE_OP_HPD)
++ drm_bridge_hpd_disable(lt->hdmi_port);
+
+- drm_connector_unregister(<->connector);
+- drm_connector_cleanup(<->connector);
+- }
++ drm_connector_unregister(<->connector);
++ drm_connector_cleanup(<->connector);
+ }
+
+ static enum drm_connector_status
+@@ -751,7 +746,6 @@ static void lt8912_remove(struct i2c_client *client)
+ {
+ struct lt8912 *lt = i2c_get_clientdata(client);
+
+- lt8912_bridge_detach(<->bridge);
+ drm_bridge_remove(<->bridge);
+ lt8912_free_i2c(lt);
+ lt8912_put_dt(lt);
+--
+2.42.0
+
--- /dev/null
+From b8684785e1868ed33807f322e782f70f076d9821 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Aug 2023 13:48:11 +0300
+Subject: drm/bridge: lt8912b: Fix crash on bridge detach
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 44283993144a03af9df31934d6c32bbd42d1a347 ]
+
+The lt8912b driver, in its bridge detach function, calls
+drm_connector_unregister() and drm_connector_cleanup().
+
+drm_connector_unregister() should be called only for connectors
+explicitly registered with drm_connector_register(), which is not the
+case in lt8912b.
+
+The driver's drm_connector_funcs.destroy hook is set to
+drm_connector_cleanup().
+
+Thus the driver should not call either drm_connector_unregister() nor
+drm_connector_cleanup() in its lt8912_bridge_detach(), as they cause a
+crash on bridge detach:
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+Mem abort info:
+ ESR = 0x0000000096000006
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x06: level 2 translation fault
+Data abort info:
+ ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+user pgtable: 4k pages, 48-bit VAs, pgdp=00000000858f3000
+[0000000000000000] pgd=0800000085918003, p4d=0800000085918003, pud=0800000085431003, pmd=0000000000000000
+Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
+Modules linked in: tidss(-) display_connector lontium_lt8912b tc358768 panel_lvds panel_simple drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks
+CPU: 3 PID: 462 Comm: rmmod Tainted: G W 6.5.0-rc2+ #2
+Hardware name: Toradex Verdin AM62 on Verdin Development Board (DT)
+pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : drm_connector_cleanup+0x78/0x2d4 [drm]
+lr : lt8912_bridge_detach+0x54/0x6c [lontium_lt8912b]
+sp : ffff800082ed3a90
+x29: ffff800082ed3a90 x28: ffff0000040c1940 x27: 0000000000000000
+x26: 0000000000000000 x25: dead000000000122 x24: dead000000000122
+x23: dead000000000100 x22: ffff000003fb6388 x21: 0000000000000000
+x20: 0000000000000000 x19: ffff000003fb6260 x18: fffffffffffe56e8
+x17: 0000000000000000 x16: 0010000000000000 x15: 0000000000000038
+x14: 0000000000000000 x13: ffff800081914b48 x12: 000000000000040e
+x11: 000000000000015a x10: ffff80008196ebb8 x9 : ffff800081914b48
+x8 : 00000000ffffefff x7 : ffff0000040c1940 x6 : ffff80007aa649d0
+x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80008159e008
+x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
+Call trace:
+ drm_connector_cleanup+0x78/0x2d4 [drm]
+ lt8912_bridge_detach+0x54/0x6c [lontium_lt8912b]
+ drm_bridge_detach+0x44/0x84 [drm]
+ drm_encoder_cleanup+0x40/0xb8 [drm]
+ drmm_encoder_alloc_release+0x1c/0x30 [drm]
+ drm_managed_release+0xac/0x148 [drm]
+ drm_dev_put.part.0+0x88/0xb8 [drm]
+ devm_drm_dev_init_release+0x14/0x24 [drm]
+ devm_action_release+0x14/0x20
+ release_nodes+0x5c/0x90
+ devres_release_all+0x8c/0xe0
+ device_unbind_cleanup+0x18/0x68
+ device_release_driver_internal+0x208/0x23c
+ driver_detach+0x4c/0x94
+ bus_remove_driver+0x70/0xf4
+ driver_unregister+0x30/0x60
+ platform_driver_unregister+0x14/0x20
+ tidss_platform_driver_exit+0x18/0xb2c [tidss]
+ __arm64_sys_delete_module+0x1a0/0x2b4
+ invoke_syscall+0x48/0x110
+ el0_svc_common.constprop.0+0x60/0x10c
+ do_el0_svc_compat+0x1c/0x40
+ el0_svc_compat+0x40/0xac
+ el0t_32_sync_handler+0xb0/0x138
+ el0t_32_sync+0x194/0x198
+Code: 9104a276 f2fbd5b7 aa0203e1 91008af8 (f85c0420)
+
+Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230804-lt8912b-v1-2-c542692c6a2f@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt8912b.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+index dc16b0d01bcb9..ce0aa2118a808 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+@@ -589,9 +589,6 @@ static void lt8912_bridge_detach(struct drm_bridge *bridge)
+
+ if (lt->hdmi_port->ops & DRM_BRIDGE_OP_HPD)
+ drm_bridge_hpd_disable(lt->hdmi_port);
+-
+- drm_connector_unregister(<->connector);
+- drm_connector_cleanup(<->connector);
+ }
+
+ static enum drm_connector_status
+--
+2.42.0
+
--- /dev/null
+From 139ea93d8ffc50bb5cc761b6a8d5b3359b574086 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Aug 2023 13:48:12 +0300
+Subject: drm/bridge: lt8912b: Manually disable HPD only if it was enabled
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 6985c5efc4057bc79137807295d84ada3123d051 ]
+
+lt8912b only calls drm_bridge_hpd_enable() if it creates a connector and
+the next bridge has DRM_BRIDGE_OP_HPD set. However, when calling
+drm_bridge_hpd_disable() it misses checking if a connector was created,
+calling drm_bridge_hpd_disable() even if HPD was never enabled. I don't
+see any issues caused by this wrong call, though.
+
+Add the check to avoid wrongly calling drm_bridge_hpd_disable().
+
+Fixes: 3b0a01a6a522 ("drm/bridge: lt8912b: Add hot plug detection")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230804-lt8912b-v1-3-c542692c6a2f@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt8912b.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+index ce0aa2118a808..1977d3c0a81d1 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+@@ -587,7 +587,7 @@ static void lt8912_bridge_detach(struct drm_bridge *bridge)
+
+ lt8912_hard_power_off(lt);
+
+- if (lt->hdmi_port->ops & DRM_BRIDGE_OP_HPD)
++ if (lt->connector.dev && lt->hdmi_port->ops & DRM_BRIDGE_OP_HPD)
+ drm_bridge_hpd_disable(lt->hdmi_port);
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 472afcc9f408968cf8a0f2dd164a89b2417832e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 01:00:02 +0300
+Subject: drm/bridge: lt9611uxc: fix the race in the error path
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 15fe53be46eaf4f6339cd433972ecc90513e3076 ]
+
+If DSI host attachment fails, the LT9611UXC driver will remove the
+bridge without ensuring that there is no outstanding HPD work being
+done. In rare cases this can result in the warnings regarding the mutex
+being incorrect. Fix this by forcebly freing IRQ and flushing the work.
+
+DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+WARNING: CPU: 0 PID: 10 at kernel/locking/mutex.c:582 __mutex_lock+0x468/0x77c
+Modules linked in:
+CPU: 0 PID: 10 Comm: kworker/0:1 Tainted: G U 6.6.0-rc5-next-20231011-gd81f81c2b682-dirty #1206
+Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
+Workqueue: events lt9611uxc_hpd_work
+pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : __mutex_lock+0x468/0x77c
+lr : __mutex_lock+0x468/0x77c
+sp : ffff8000800a3c70
+x29: ffff8000800a3c70 x28: 0000000000000000 x27: ffffd595fe333000
+x26: ffff7c2f0002c005 x25: ffffd595ff1b3000 x24: ffffd595fccda5a0
+x23: 0000000000000000 x22: 0000000000000002 x21: ffff7c2f056d91c8
+x20: 0000000000000000 x19: ffff7c2f056d91c8 x18: fffffffffffe8db0
+x17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000
+x14: 000000000006efb8 x13: 0000000000000000 x12: 0000000000000037
+x11: 0000000000000001 x10: 0000000000001470 x9 : ffff8000800a3ae0
+x8 : ffff7c2f0027f8d0 x7 : ffff7c2f0027e400 x6 : ffffd595fc702b54
+x5 : 0000000000000000 x4 : ffff8000800a0000 x3 : 0000000000000000
+x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff7c2f0027e400
+Call trace:
+ __mutex_lock+0x468/0x77c
+ mutex_lock_nested+0x24/0x30
+ drm_bridge_hpd_notify+0x2c/0x5c
+ lt9611uxc_hpd_work+0x6c/0x80
+ process_one_work+0x1ec/0x51c
+ worker_thread+0x1ec/0x3e4
+ kthread+0x120/0x124
+ ret_from_fork+0x10/0x20
+irq event stamp: 15799
+hardirqs last enabled at (15799): [<ffffd595fc702ba4>] finish_task_switch.isra.0+0xa8/0x278
+hardirqs last disabled at (15798): [<ffffd595fd5a1580>] __schedule+0x7b8/0xbd8
+softirqs last enabled at (15794): [<ffffd595fc690698>] __do_softirq+0x498/0x4e0
+softirqs last disabled at (15771): [<ffffd595fc69615c>] ____do_softirq+0x10/0x1c
+
+Fixes: bc6fa8676ebb ("drm/bridge/lontium-lt9611uxc: move HPD notification out of IRQ handler")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231011220002.382422-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt9611uxc.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt9611uxc.c b/drivers/gpu/drm/bridge/lontium-lt9611uxc.c
+index fa1ee6264d921..818848b2c04dd 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt9611uxc.c
++++ b/drivers/gpu/drm/bridge/lontium-lt9611uxc.c
+@@ -928,9 +928,9 @@ static int lt9611uxc_probe(struct i2c_client *client,
+ init_waitqueue_head(<9611uxc->wq);
+ INIT_WORK(<9611uxc->work, lt9611uxc_hpd_work);
+
+- ret = devm_request_threaded_irq(dev, client->irq, NULL,
+- lt9611uxc_irq_thread_handler,
+- IRQF_ONESHOT, "lt9611uxc", lt9611uxc);
++ ret = request_threaded_irq(client->irq, NULL,
++ lt9611uxc_irq_thread_handler,
++ IRQF_ONESHOT, "lt9611uxc", lt9611uxc);
+ if (ret) {
+ dev_err(dev, "failed to request irq\n");
+ goto err_disable_regulators;
+@@ -966,6 +966,8 @@ static int lt9611uxc_probe(struct i2c_client *client,
+ return lt9611uxc_audio_init(dev, lt9611uxc);
+
+ err_remove_bridge:
++ free_irq(client->irq, lt9611uxc);
++ cancel_work_sync(<9611uxc->work);
+ drm_bridge_remove(<9611uxc->bridge);
+
+ err_disable_regulators:
+@@ -982,7 +984,7 @@ static void lt9611uxc_remove(struct i2c_client *client)
+ {
+ struct lt9611uxc *lt9611uxc = i2c_get_clientdata(client);
+
+- disable_irq(client->irq);
++ free_irq(client->irq, lt9611uxc);
+ cancel_work_sync(<9611uxc->work);
+ lt9611uxc_audio_exit(lt9611uxc);
+ drm_bridge_remove(<9611uxc->bridge);
+--
+2.42.0
+
--- /dev/null
+From 51851ffab0cbeb190511f3df412a9822267d5707 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 09:50:57 +0300
+Subject: drm/bridge: tc358768: Clean up clock period code
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit b3aa7b34924a9ed64cf96899cac4d8ea08cd829e ]
+
+The driver defines TC358768_PRECISION as 1000, and uses "nsk" to refer
+to clock periods. The original author does not remember where all this
+came from. Effectively the driver is using picoseconds as the unit for
+clock periods, yet referring to them by "nsk".
+
+Clean this up by just saying the periods are in picoseconds.
+
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> # Asus TF700T
+Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230906-tc358768-v4-10-31725f008a50@ideasonboard.com
+Stable-dep-of: f1dabbe64506 ("drm/bridge: tc358768: Fix tc358768_ns_to_cnt()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 60 +++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 27d57c02f3f6a..5fd89596c9a20 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -15,6 +15,7 @@
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/slab.h>
++#include <linux/units.h>
+
+ #include <drm/drm_atomic_helper.h>
+ #include <drm/drm_crtc_helper.h>
+@@ -628,15 +629,14 @@ static int tc358768_setup_pll(struct tc358768_priv *priv,
+ return tc358768_clear_error(priv);
+ }
+
+-#define TC358768_PRECISION 1000
+-static u32 tc358768_ns_to_cnt(u32 ns, u32 period_nsk)
++static u32 tc358768_ns_to_cnt(u32 ns, u32 period_ps)
+ {
+- return (ns * TC358768_PRECISION + period_nsk) / period_nsk;
++ return (ns * 1000 + period_ps) / period_ps;
+ }
+
+-static u32 tc358768_to_ns(u32 nsk)
++static u32 tc358768_ps_to_ns(u32 ps)
+ {
+- return (nsk / TC358768_PRECISION);
++ return ps / 1000;
+ }
+
+ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+@@ -647,7 +647,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ u32 val, val2, lptxcnt, hact, data_type;
+ s32 raw_val;
+ const struct drm_display_mode *mode;
+- u32 hsbyteclk_nsk, dsiclk_nsk, ui_nsk;
++ u32 hsbyteclk_ps, dsiclk_ps, ui_ps;
+ u32 dsiclk, hsbyteclk, video_start;
+ const u32 internal_delay = 40;
+ int ret, i;
+@@ -731,67 +731,65 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ tc358768_write(priv, TC358768_D0W_CNTRL + i * 4, 0x0000);
+
+ /* DSI Timings */
+- hsbyteclk_nsk = (u32)div_u64((u64)1000000000 * TC358768_PRECISION,
+- hsbyteclk);
+- dsiclk_nsk = (u32)div_u64((u64)1000000000 * TC358768_PRECISION, dsiclk);
+- ui_nsk = dsiclk_nsk / 2;
+- dev_dbg(dev, "dsiclk_nsk: %u\n", dsiclk_nsk);
+- dev_dbg(dev, "ui_nsk: %u\n", ui_nsk);
+- dev_dbg(dev, "hsbyteclk_nsk: %u\n", hsbyteclk_nsk);
++ hsbyteclk_ps = (u32)div_u64(PICO, hsbyteclk);
++ dsiclk_ps = (u32)div_u64(PICO, dsiclk);
++ ui_ps = dsiclk_ps / 2;
++ dev_dbg(dev, "dsiclk: %u ps, ui %u ps, hsbyteclk %u ps\n", dsiclk_ps,
++ ui_ps, hsbyteclk_ps);
+
+ /* LP11 > 100us for D-PHY Rx Init */
+- val = tc358768_ns_to_cnt(100 * 1000, hsbyteclk_nsk) - 1;
++ val = tc358768_ns_to_cnt(100 * 1000, hsbyteclk_ps) - 1;
+ dev_dbg(dev, "LINEINITCNT: %u\n", val);
+ tc358768_write(priv, TC358768_LINEINITCNT, val);
+
+ /* LPTimeCnt > 50ns */
+- val = tc358768_ns_to_cnt(50, hsbyteclk_nsk) - 1;
++ val = tc358768_ns_to_cnt(50, hsbyteclk_ps) - 1;
+ lptxcnt = val;
+ dev_dbg(dev, "LPTXTIMECNT: %u\n", val);
+ tc358768_write(priv, TC358768_LPTXTIMECNT, val);
+
+ /* 38ns < TCLK_PREPARE < 95ns */
+- val = tc358768_ns_to_cnt(65, hsbyteclk_nsk) - 1;
++ val = tc358768_ns_to_cnt(65, hsbyteclk_ps) - 1;
+ dev_dbg(dev, "TCLK_PREPARECNT %u\n", val);
+ /* TCLK_PREPARE + TCLK_ZERO > 300ns */
+- val2 = tc358768_ns_to_cnt(300 - tc358768_to_ns(2 * ui_nsk),
+- hsbyteclk_nsk) - 2;
++ val2 = tc358768_ns_to_cnt(300 - tc358768_ps_to_ns(2 * ui_ps),
++ hsbyteclk_ps) - 2;
+ dev_dbg(dev, "TCLK_ZEROCNT %u\n", val2);
+ val |= val2 << 8;
+ tc358768_write(priv, TC358768_TCLK_HEADERCNT, val);
+
+ /* TCLK_TRAIL > 60ns AND TEOT <= 105 ns + 12*UI */
+- raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(2 * ui_nsk), hsbyteclk_nsk) - 5;
++ raw_val = tc358768_ns_to_cnt(60 + tc358768_ps_to_ns(2 * ui_ps), hsbyteclk_ps) - 5;
+ val = clamp(raw_val, 0, 127);
+ dev_dbg(dev, "TCLK_TRAILCNT: %u\n", val);
+ tc358768_write(priv, TC358768_TCLK_TRAILCNT, val);
+
+ /* 40ns + 4*UI < THS_PREPARE < 85ns + 6*UI */
+- val = 50 + tc358768_to_ns(4 * ui_nsk);
+- val = tc358768_ns_to_cnt(val, hsbyteclk_nsk) - 1;
++ val = 50 + tc358768_ps_to_ns(4 * ui_ps);
++ val = tc358768_ns_to_cnt(val, hsbyteclk_ps) - 1;
+ dev_dbg(dev, "THS_PREPARECNT %u\n", val);
+ /* THS_PREPARE + THS_ZERO > 145ns + 10*UI */
+- raw_val = tc358768_ns_to_cnt(145 - tc358768_to_ns(3 * ui_nsk), hsbyteclk_nsk) - 10;
++ raw_val = tc358768_ns_to_cnt(145 - tc358768_ps_to_ns(3 * ui_ps), hsbyteclk_ps) - 10;
+ val2 = clamp(raw_val, 0, 127);
+ dev_dbg(dev, "THS_ZEROCNT %u\n", val2);
+ val |= val2 << 8;
+ tc358768_write(priv, TC358768_THS_HEADERCNT, val);
+
+ /* TWAKEUP > 1ms in lptxcnt steps */
+- val = tc358768_ns_to_cnt(1020000, hsbyteclk_nsk);
++ val = tc358768_ns_to_cnt(1020000, hsbyteclk_ps);
+ val = val / (lptxcnt + 1) - 1;
+ dev_dbg(dev, "TWAKEUP: %u\n", val);
+ tc358768_write(priv, TC358768_TWAKEUP, val);
+
+ /* TCLK_POSTCNT > 60ns + 52*UI */
+- val = tc358768_ns_to_cnt(60 + tc358768_to_ns(52 * ui_nsk),
+- hsbyteclk_nsk) - 3;
++ val = tc358768_ns_to_cnt(60 + tc358768_ps_to_ns(52 * ui_ps),
++ hsbyteclk_ps) - 3;
+ dev_dbg(dev, "TCLK_POSTCNT: %u\n", val);
+ tc358768_write(priv, TC358768_TCLK_POSTCNT, val);
+
+ /* max(60ns + 4*UI, 8*UI) < THS_TRAILCNT < 105ns + 12*UI */
+- raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(18 * ui_nsk),
+- hsbyteclk_nsk) - 4;
++ raw_val = tc358768_ns_to_cnt(60 + tc358768_ps_to_ns(18 * ui_ps),
++ hsbyteclk_ps) - 4;
+ val = clamp(raw_val, 0, 15);
+ dev_dbg(dev, "THS_TRAILCNT: %u\n", val);
+ tc358768_write(priv, TC358768_THS_TRAILCNT, val);
+@@ -805,11 +803,11 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ (mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS) ? 0 : BIT(0));
+
+ /* TXTAGOCNT[26:16] RXTASURECNT[10:0] */
+- val = tc358768_to_ns((lptxcnt + 1) * hsbyteclk_nsk * 4);
+- val = tc358768_ns_to_cnt(val, hsbyteclk_nsk) / 4 - 1;
++ val = tc358768_ps_to_ns((lptxcnt + 1) * hsbyteclk_ps * 4);
++ val = tc358768_ns_to_cnt(val, hsbyteclk_ps) / 4 - 1;
+ dev_dbg(dev, "TXTAGOCNT: %u\n", val);
+- val2 = tc358768_ns_to_cnt(tc358768_to_ns((lptxcnt + 1) * hsbyteclk_nsk),
+- hsbyteclk_nsk) - 2;
++ val2 = tc358768_ns_to_cnt(tc358768_ps_to_ns((lptxcnt + 1) * hsbyteclk_ps),
++ hsbyteclk_ps) - 2;
+ dev_dbg(dev, "RXTASURECNT: %u\n", val2);
+ val = val << 16 | val2;
+ tc358768_write(priv, TC358768_BTACNTRL1, val);
+--
+2.42.0
+
--- /dev/null
+From 0da4d7b3b2e460d73fc9f559d15b748fbe790bc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 09:50:51 +0300
+Subject: drm/bridge: tc358768: Fix bit updates
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 66962d5c3c51377b9b90cae35b7e038950438e02 ]
+
+The driver has a few places where it does:
+
+if (thing_is_enabled_in_config)
+ update_thing_bit_in_hw()
+
+This means that if the thing is _not_ enabled, the bit never gets
+cleared. This affects the h/vsyncs and continuous DSI clock bits.
+
+Fix the driver to always update the bit.
+
+Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> # Asus TF700T
+Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230906-tc358768-v4-4-31725f008a50@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 16aa849e992bd..bdeda705b67ca 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -797,8 +797,8 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ val |= BIT(i + 1);
+ tc358768_write(priv, TC358768_HSTXVREGEN, val);
+
+- if (!(mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS))
+- tc358768_write(priv, TC358768_TXOPTIONCNTRL, 0x1);
++ tc358768_write(priv, TC358768_TXOPTIONCNTRL,
++ (mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS) ? 0 : BIT(0));
+
+ /* TXTAGOCNT[26:16] RXTASURECNT[10:0] */
+ val = tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk * 4);
+@@ -864,11 +864,12 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ tc358768_write(priv, TC358768_DSI_HACT, hact);
+
+ /* VSYNC polarity */
+- if (!(mode->flags & DRM_MODE_FLAG_NVSYNC))
+- tc358768_update_bits(priv, TC358768_CONFCTL, BIT(5), BIT(5));
++ tc358768_update_bits(priv, TC358768_CONFCTL, BIT(5),
++ (mode->flags & DRM_MODE_FLAG_PVSYNC) ? BIT(5) : 0);
++
+ /* HSYNC polarity */
+- if (mode->flags & DRM_MODE_FLAG_PHSYNC)
+- tc358768_update_bits(priv, TC358768_PP_MISC, BIT(0), BIT(0));
++ tc358768_update_bits(priv, TC358768_PP_MISC, BIT(0),
++ (mode->flags & DRM_MODE_FLAG_PHSYNC) ? BIT(0) : 0);
+
+ /* Start DSI Tx */
+ tc358768_write(priv, TC358768_DSI_START, 0x1);
+--
+2.42.0
+
--- /dev/null
+From 032dad457424e171d584a220dd2e0328b1af8afd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 09:50:58 +0300
+Subject: drm/bridge: tc358768: Fix tc358768_ns_to_cnt()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit f1dabbe645065d20ca863c8d446c74c59ca1ca9d ]
+
+The tc358768_ns_to_cnt() is, most likely, supposed to do a div-round-up
+operation, but it misses subtracting one from the dividend.
+
+Fix this by just using DIV_ROUND_UP().
+
+Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> # Asus TF700T
+Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230906-tc358768-v4-11-31725f008a50@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 5fd89596c9a20..8429b6518b502 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -631,7 +631,7 @@ static int tc358768_setup_pll(struct tc358768_priv *priv,
+
+ static u32 tc358768_ns_to_cnt(u32 ns, u32 period_ps)
+ {
+- return (ns * 1000 + period_ps) / period_ps;
++ return DIV_ROUND_UP(ns * 1000, period_ps);
+ }
+
+ static u32 tc358768_ps_to_ns(u32 ps)
+--
+2.42.0
+
--- /dev/null
+From 813b2819b6f1b0970df30266fbbe9981523a2460 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 09:50:49 +0300
+Subject: drm/bridge: tc358768: Fix use of uninitialized variable
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit a2d9036615f0adfa5b0a46bb2ce42ef1d9a04fbe ]
+
+smatch reports:
+
+drivers/gpu/drm/bridge/tc358768.c:223 tc358768_update_bits() error: uninitialized symbol 'orig'.
+
+Fix this by bailing out from tc358768_update_bits() if the
+tc358768_read() produces an error.
+
+Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> # Asus TF700T
+Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230906-tc358768-v4-2-31725f008a50@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 2d0ac9987b58e..16aa849e992bd 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -217,6 +217,10 @@ static void tc358768_update_bits(struct tc358768_priv *priv, u32 reg, u32 mask,
+ u32 tmp, orig;
+
+ tc358768_read(priv, reg, &orig);
++
++ if (priv->error)
++ return;
++
+ tmp = orig & ~mask;
+ tmp |= val & mask;
+ if (tmp != orig)
+--
+2.42.0
+
--- /dev/null
+From eb4e022eee88a66f20f77902bfa53033055921b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 09:50:54 +0300
+Subject: drm/bridge: tc358768: Print logical values, not raw register values
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 013ea98cdfccef3b7c38b087c1f629488d2ef683 ]
+
+The driver debug prints DSI related timings as raw register values in
+hex. It is much more useful to see the "logical" value of the timing,
+not the register value.
+
+Change the prints to print the values separately, in case a single
+register contains multiple values, and use %u to have it in a more human
+consumable form.
+
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> # Asus TF700T
+Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230906-tc358768-v4-7-31725f008a50@ideasonboard.com
+Stable-dep-of: f1dabbe64506 ("drm/bridge: tc358768: Fix tc358768_ns_to_cnt()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 8a44e75ae24cb..770f37a0a5218 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -740,57 +740,59 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+
+ /* LP11 > 100us for D-PHY Rx Init */
+ val = tc358768_ns_to_cnt(100 * 1000, dsibclk_nsk) - 1;
+- dev_dbg(priv->dev, "LINEINITCNT: 0x%x\n", val);
++ dev_dbg(priv->dev, "LINEINITCNT: %u\n", val);
+ tc358768_write(priv, TC358768_LINEINITCNT, val);
+
+ /* LPTimeCnt > 50ns */
+ val = tc358768_ns_to_cnt(50, dsibclk_nsk) - 1;
+ lptxcnt = val;
+- dev_dbg(priv->dev, "LPTXTIMECNT: 0x%x\n", val);
++ dev_dbg(priv->dev, "LPTXTIMECNT: %u\n", val);
+ tc358768_write(priv, TC358768_LPTXTIMECNT, val);
+
+ /* 38ns < TCLK_PREPARE < 95ns */
+ val = tc358768_ns_to_cnt(65, dsibclk_nsk) - 1;
++ dev_dbg(priv->dev, "TCLK_PREPARECNT %u\n", val);
+ /* TCLK_PREPARE + TCLK_ZERO > 300ns */
+ val2 = tc358768_ns_to_cnt(300 - tc358768_to_ns(2 * ui_nsk),
+ dsibclk_nsk) - 2;
++ dev_dbg(priv->dev, "TCLK_ZEROCNT %u\n", val2);
+ val |= val2 << 8;
+- dev_dbg(priv->dev, "TCLK_HEADERCNT: 0x%x\n", val);
+ tc358768_write(priv, TC358768_TCLK_HEADERCNT, val);
+
+ /* TCLK_TRAIL > 60ns AND TEOT <= 105 ns + 12*UI */
+ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(2 * ui_nsk), dsibclk_nsk) - 5;
+ val = clamp(raw_val, 0, 127);
+- dev_dbg(priv->dev, "TCLK_TRAILCNT: 0x%x\n", val);
++ dev_dbg(priv->dev, "TCLK_TRAILCNT: %u\n", val);
+ tc358768_write(priv, TC358768_TCLK_TRAILCNT, val);
+
+ /* 40ns + 4*UI < THS_PREPARE < 85ns + 6*UI */
+ val = 50 + tc358768_to_ns(4 * ui_nsk);
+ val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 1;
++ dev_dbg(priv->dev, "THS_PREPARECNT %u\n", val);
+ /* THS_PREPARE + THS_ZERO > 145ns + 10*UI */
+ raw_val = tc358768_ns_to_cnt(145 - tc358768_to_ns(3 * ui_nsk), dsibclk_nsk) - 10;
+ val2 = clamp(raw_val, 0, 127);
++ dev_dbg(priv->dev, "THS_ZEROCNT %u\n", val2);
+ val |= val2 << 8;
+- dev_dbg(priv->dev, "THS_HEADERCNT: 0x%x\n", val);
+ tc358768_write(priv, TC358768_THS_HEADERCNT, val);
+
+ /* TWAKEUP > 1ms in lptxcnt steps */
+ val = tc358768_ns_to_cnt(1020000, dsibclk_nsk);
+ val = val / (lptxcnt + 1) - 1;
+- dev_dbg(priv->dev, "TWAKEUP: 0x%x\n", val);
++ dev_dbg(priv->dev, "TWAKEUP: %u\n", val);
+ tc358768_write(priv, TC358768_TWAKEUP, val);
+
+ /* TCLK_POSTCNT > 60ns + 52*UI */
+ val = tc358768_ns_to_cnt(60 + tc358768_to_ns(52 * ui_nsk),
+ dsibclk_nsk) - 3;
+- dev_dbg(priv->dev, "TCLK_POSTCNT: 0x%x\n", val);
++ dev_dbg(priv->dev, "TCLK_POSTCNT: %u\n", val);
+ tc358768_write(priv, TC358768_TCLK_POSTCNT, val);
+
+ /* max(60ns + 4*UI, 8*UI) < THS_TRAILCNT < 105ns + 12*UI */
+ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(18 * ui_nsk),
+ dsibclk_nsk) - 4;
+ val = clamp(raw_val, 0, 15);
+- dev_dbg(priv->dev, "THS_TRAILCNT: 0x%x\n", val);
++ dev_dbg(priv->dev, "THS_TRAILCNT: %u\n", val);
+ tc358768_write(priv, TC358768_THS_TRAILCNT, val);
+
+ val = BIT(0);
+@@ -804,10 +806,11 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ /* TXTAGOCNT[26:16] RXTASURECNT[10:0] */
+ val = tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk * 4);
+ val = tc358768_ns_to_cnt(val, dsibclk_nsk) / 4 - 1;
++ dev_dbg(priv->dev, "TXTAGOCNT: %u\n", val);
+ val2 = tc358768_ns_to_cnt(tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk),
+ dsibclk_nsk) - 2;
++ dev_dbg(priv->dev, "RXTASURECNT: %u\n", val2);
+ val = val << 16 | val2;
+- dev_dbg(priv->dev, "BTACNTRL1: 0x%x\n", val);
+ tc358768_write(priv, TC358768_BTACNTRL1, val);
+
+ /* START[0] */
+--
+2.42.0
+
--- /dev/null
+From 03b03dc3c23bde4c87d21b61a8ef4527ab241793 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 16:29:34 +0200
+Subject: drm/bridge: tc358768: remove unused variable
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit e4a5e4442a8065c6959e045c061de801d545226d ]
+
+Remove the unused phy_delay_nsk variable, before it was wrongly used
+to compute some register value, the fixed computation is no longer using
+it and therefore can be removed.
+
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-10-francesco@dolcini.it
+Stable-dep-of: f1dabbe64506 ("drm/bridge: tc358768: Fix tc358768_ns_to_cnt()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index bdeda705b67ca..70fd560ed394e 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -647,7 +647,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ u32 val, val2, lptxcnt, hact, data_type;
+ s32 raw_val;
+ const struct drm_display_mode *mode;
+- u32 dsibclk_nsk, dsiclk_nsk, ui_nsk, phy_delay_nsk;
++ u32 dsibclk_nsk, dsiclk_nsk, ui_nsk;
+ u32 dsiclk, dsibclk, video_start;
+ const u32 internal_delay = 40;
+ int ret, i;
+@@ -731,11 +731,9 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ dsibclk);
+ dsiclk_nsk = (u32)div_u64((u64)1000000000 * TC358768_PRECISION, dsiclk);
+ ui_nsk = dsiclk_nsk / 2;
+- phy_delay_nsk = dsibclk_nsk + 2 * dsiclk_nsk;
+ dev_dbg(priv->dev, "dsiclk_nsk: %u\n", dsiclk_nsk);
+ dev_dbg(priv->dev, "ui_nsk: %u\n", ui_nsk);
+ dev_dbg(priv->dev, "dsibclk_nsk: %u\n", dsibclk_nsk);
+- dev_dbg(priv->dev, "phy_delay_nsk: %u\n", phy_delay_nsk);
+
+ /* LP11 > 100us for D-PHY Rx Init */
+ val = tc358768_ns_to_cnt(100 * 1000, dsibclk_nsk) - 1;
+--
+2.42.0
+
--- /dev/null
+From ffc161dae4843af359370701a1471828d96b9ddc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 09:50:56 +0300
+Subject: drm/bridge: tc358768: Rename dsibclk to hsbyteclk
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 699cf62a7d4550759f4a50e614b1952f93de4783 ]
+
+The Toshiba documentation talks about HSByteClk when referring to the
+DSI HS byte clock, whereas the driver uses 'dsibclk' name. Also, in a
+few places the driver calculates the byte clock from the DSI clock, even
+if the byte clock is already available in a variable.
+
+To align the driver with the documentation, change the 'dsibclk'
+variable to 'hsbyteclk'. This also make it easier to visually separate
+'dsibclk' and 'dsiclk' variables.
+
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> # Asus TF700T
+Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230906-tc358768-v4-9-31725f008a50@ideasonboard.com
+Stable-dep-of: f1dabbe64506 ("drm/bridge: tc358768: Fix tc358768_ns_to_cnt()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 48 +++++++++++++++----------------
+ 1 file changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 130b807926017..27d57c02f3f6a 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -605,7 +605,7 @@ static int tc358768_setup_pll(struct tc358768_priv *priv,
+
+ dev_dbg(priv->dev, "PLL: refclk %lu, fbd %u, prd %u, frs %u\n",
+ clk_get_rate(priv->refclk), fbd, prd, frs);
+- dev_dbg(priv->dev, "PLL: pll_clk: %u, DSIClk %u, DSIByteClk %u\n",
++ dev_dbg(priv->dev, "PLL: pll_clk: %u, DSIClk %u, HSByteClk %u\n",
+ priv->dsiclk * 2, priv->dsiclk, priv->dsiclk / 4);
+ dev_dbg(priv->dev, "PLL: pclk %u (panel: %u)\n",
+ tc358768_pll_to_pclk(priv, priv->dsiclk * 2),
+@@ -647,8 +647,8 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ u32 val, val2, lptxcnt, hact, data_type;
+ s32 raw_val;
+ const struct drm_display_mode *mode;
+- u32 dsibclk_nsk, dsiclk_nsk, ui_nsk;
+- u32 dsiclk, dsibclk, video_start;
++ u32 hsbyteclk_nsk, dsiclk_nsk, ui_nsk;
++ u32 dsiclk, hsbyteclk, video_start;
+ const u32 internal_delay = 40;
+ int ret, i;
+ struct videomode vm;
+@@ -679,7 +679,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ drm_display_mode_to_videomode(mode, &vm);
+
+ dsiclk = priv->dsiclk;
+- dsibclk = dsiclk / 4;
++ hsbyteclk = dsiclk / 4;
+
+ /* Data Format Control Register */
+ val = BIT(2) | BIT(1) | BIT(0); /* rdswap_en | dsitx_en | txdt_en */
+@@ -731,67 +731,67 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ tc358768_write(priv, TC358768_D0W_CNTRL + i * 4, 0x0000);
+
+ /* DSI Timings */
+- dsibclk_nsk = (u32)div_u64((u64)1000000000 * TC358768_PRECISION,
+- dsibclk);
++ hsbyteclk_nsk = (u32)div_u64((u64)1000000000 * TC358768_PRECISION,
++ hsbyteclk);
+ dsiclk_nsk = (u32)div_u64((u64)1000000000 * TC358768_PRECISION, dsiclk);
+ ui_nsk = dsiclk_nsk / 2;
+ dev_dbg(dev, "dsiclk_nsk: %u\n", dsiclk_nsk);
+ dev_dbg(dev, "ui_nsk: %u\n", ui_nsk);
+- dev_dbg(dev, "dsibclk_nsk: %u\n", dsibclk_nsk);
++ dev_dbg(dev, "hsbyteclk_nsk: %u\n", hsbyteclk_nsk);
+
+ /* LP11 > 100us for D-PHY Rx Init */
+- val = tc358768_ns_to_cnt(100 * 1000, dsibclk_nsk) - 1;
++ val = tc358768_ns_to_cnt(100 * 1000, hsbyteclk_nsk) - 1;
+ dev_dbg(dev, "LINEINITCNT: %u\n", val);
+ tc358768_write(priv, TC358768_LINEINITCNT, val);
+
+ /* LPTimeCnt > 50ns */
+- val = tc358768_ns_to_cnt(50, dsibclk_nsk) - 1;
++ val = tc358768_ns_to_cnt(50, hsbyteclk_nsk) - 1;
+ lptxcnt = val;
+ dev_dbg(dev, "LPTXTIMECNT: %u\n", val);
+ tc358768_write(priv, TC358768_LPTXTIMECNT, val);
+
+ /* 38ns < TCLK_PREPARE < 95ns */
+- val = tc358768_ns_to_cnt(65, dsibclk_nsk) - 1;
++ val = tc358768_ns_to_cnt(65, hsbyteclk_nsk) - 1;
+ dev_dbg(dev, "TCLK_PREPARECNT %u\n", val);
+ /* TCLK_PREPARE + TCLK_ZERO > 300ns */
+ val2 = tc358768_ns_to_cnt(300 - tc358768_to_ns(2 * ui_nsk),
+- dsibclk_nsk) - 2;
++ hsbyteclk_nsk) - 2;
+ dev_dbg(dev, "TCLK_ZEROCNT %u\n", val2);
+ val |= val2 << 8;
+ tc358768_write(priv, TC358768_TCLK_HEADERCNT, val);
+
+ /* TCLK_TRAIL > 60ns AND TEOT <= 105 ns + 12*UI */
+- raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(2 * ui_nsk), dsibclk_nsk) - 5;
++ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(2 * ui_nsk), hsbyteclk_nsk) - 5;
+ val = clamp(raw_val, 0, 127);
+ dev_dbg(dev, "TCLK_TRAILCNT: %u\n", val);
+ tc358768_write(priv, TC358768_TCLK_TRAILCNT, val);
+
+ /* 40ns + 4*UI < THS_PREPARE < 85ns + 6*UI */
+ val = 50 + tc358768_to_ns(4 * ui_nsk);
+- val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 1;
++ val = tc358768_ns_to_cnt(val, hsbyteclk_nsk) - 1;
+ dev_dbg(dev, "THS_PREPARECNT %u\n", val);
+ /* THS_PREPARE + THS_ZERO > 145ns + 10*UI */
+- raw_val = tc358768_ns_to_cnt(145 - tc358768_to_ns(3 * ui_nsk), dsibclk_nsk) - 10;
++ raw_val = tc358768_ns_to_cnt(145 - tc358768_to_ns(3 * ui_nsk), hsbyteclk_nsk) - 10;
+ val2 = clamp(raw_val, 0, 127);
+ dev_dbg(dev, "THS_ZEROCNT %u\n", val2);
+ val |= val2 << 8;
+ tc358768_write(priv, TC358768_THS_HEADERCNT, val);
+
+ /* TWAKEUP > 1ms in lptxcnt steps */
+- val = tc358768_ns_to_cnt(1020000, dsibclk_nsk);
++ val = tc358768_ns_to_cnt(1020000, hsbyteclk_nsk);
+ val = val / (lptxcnt + 1) - 1;
+ dev_dbg(dev, "TWAKEUP: %u\n", val);
+ tc358768_write(priv, TC358768_TWAKEUP, val);
+
+ /* TCLK_POSTCNT > 60ns + 52*UI */
+ val = tc358768_ns_to_cnt(60 + tc358768_to_ns(52 * ui_nsk),
+- dsibclk_nsk) - 3;
++ hsbyteclk_nsk) - 3;
+ dev_dbg(dev, "TCLK_POSTCNT: %u\n", val);
+ tc358768_write(priv, TC358768_TCLK_POSTCNT, val);
+
+ /* max(60ns + 4*UI, 8*UI) < THS_TRAILCNT < 105ns + 12*UI */
+ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(18 * ui_nsk),
+- dsibclk_nsk) - 4;
++ hsbyteclk_nsk) - 4;
+ val = clamp(raw_val, 0, 15);
+ dev_dbg(dev, "THS_TRAILCNT: %u\n", val);
+ tc358768_write(priv, TC358768_THS_TRAILCNT, val);
+@@ -805,11 +805,11 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ (mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS) ? 0 : BIT(0));
+
+ /* TXTAGOCNT[26:16] RXTASURECNT[10:0] */
+- val = tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk * 4);
+- val = tc358768_ns_to_cnt(val, dsibclk_nsk) / 4 - 1;
++ val = tc358768_to_ns((lptxcnt + 1) * hsbyteclk_nsk * 4);
++ val = tc358768_ns_to_cnt(val, hsbyteclk_nsk) / 4 - 1;
+ dev_dbg(dev, "TXTAGOCNT: %u\n", val);
+- val2 = tc358768_ns_to_cnt(tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk),
+- dsibclk_nsk) - 2;
++ val2 = tc358768_ns_to_cnt(tc358768_to_ns((lptxcnt + 1) * hsbyteclk_nsk),
++ hsbyteclk_nsk) - 2;
+ dev_dbg(dev, "RXTASURECNT: %u\n", val2);
+ val = val << 16 | val2;
+ tc358768_write(priv, TC358768_BTACNTRL1, val);
+@@ -832,13 +832,13 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+
+ /* hsw * byteclk * ndl / pclk */
+ val = (u32)div_u64(vm.hsync_len *
+- ((u64)priv->dsiclk / 4) * priv->dsi_lanes,
++ (u64)hsbyteclk * priv->dsi_lanes,
+ vm.pixelclock);
+ tc358768_write(priv, TC358768_DSI_HSW, val);
+
+ /* hbp * byteclk * ndl / pclk */
+ val = (u32)div_u64(vm.hback_porch *
+- ((u64)priv->dsiclk / 4) * priv->dsi_lanes,
++ (u64)hsbyteclk * priv->dsi_lanes,
+ vm.pixelclock);
+ tc358768_write(priv, TC358768_DSI_HBPR, val);
+ } else {
+@@ -857,7 +857,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+
+ /* (hsw + hbp) * byteclk * ndl / pclk */
+ val = (u32)div_u64((vm.hsync_len + vm.hback_porch) *
+- ((u64)priv->dsiclk / 4) * priv->dsi_lanes,
++ (u64)hsbyteclk * priv->dsi_lanes,
+ vm.pixelclock);
+ tc358768_write(priv, TC358768_DSI_HSW, val);
+
+--
+2.42.0
+
--- /dev/null
+From eeea5a1efb44e2cde02ffce667f8ed43a18cf61b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 09:50:55 +0300
+Subject: drm/bridge: tc358768: Use dev for dbg prints, not priv->dev
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 89cfd50e13f1bead4350998a3a77422bef1ee0a5 ]
+
+Simplify the code by capturing the priv->dev value to dev variable, and
+use it.
+
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> # Asus TF700T
+Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230906-tc358768-v4-8-31725f008a50@ideasonboard.com
+Stable-dep-of: f1dabbe64506 ("drm/bridge: tc358768: Fix tc358768_ns_to_cnt()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 41 ++++++++++++++++---------------
+ 1 file changed, 21 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 770f37a0a5218..130b807926017 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -652,9 +652,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ const u32 internal_delay = 40;
+ int ret, i;
+ struct videomode vm;
++ struct device *dev = priv->dev;
+
+ if (mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS) {
+- dev_warn_once(priv->dev, "Non-continuous mode unimplemented, falling back to continuous\n");
++ dev_warn_once(dev, "Non-continuous mode unimplemented, falling back to continuous\n");
+ mode_flags &= ~MIPI_DSI_CLOCK_NON_CONTINUOUS;
+ }
+
+@@ -662,7 +663,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+
+ ret = tc358768_sw_reset(priv);
+ if (ret) {
+- dev_err(priv->dev, "Software reset failed: %d\n", ret);
++ dev_err(dev, "Software reset failed: %d\n", ret);
+ tc358768_hw_disable(priv);
+ return;
+ }
+@@ -670,7 +671,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ mode = &bridge->encoder->crtc->state->adjusted_mode;
+ ret = tc358768_setup_pll(priv, mode);
+ if (ret) {
+- dev_err(priv->dev, "PLL setup failed: %d\n", ret);
++ dev_err(dev, "PLL setup failed: %d\n", ret);
+ tc358768_hw_disable(priv);
+ return;
+ }
+@@ -710,7 +711,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ data_type = MIPI_DSI_PACKED_PIXEL_STREAM_16;
+ break;
+ default:
+- dev_err(priv->dev, "Invalid data format (%u)\n",
++ dev_err(dev, "Invalid data format (%u)\n",
+ dsi_dev->format);
+ tc358768_hw_disable(priv);
+ return;
+@@ -734,65 +735,65 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ dsibclk);
+ dsiclk_nsk = (u32)div_u64((u64)1000000000 * TC358768_PRECISION, dsiclk);
+ ui_nsk = dsiclk_nsk / 2;
+- dev_dbg(priv->dev, "dsiclk_nsk: %u\n", dsiclk_nsk);
+- dev_dbg(priv->dev, "ui_nsk: %u\n", ui_nsk);
+- dev_dbg(priv->dev, "dsibclk_nsk: %u\n", dsibclk_nsk);
++ dev_dbg(dev, "dsiclk_nsk: %u\n", dsiclk_nsk);
++ dev_dbg(dev, "ui_nsk: %u\n", ui_nsk);
++ dev_dbg(dev, "dsibclk_nsk: %u\n", dsibclk_nsk);
+
+ /* LP11 > 100us for D-PHY Rx Init */
+ val = tc358768_ns_to_cnt(100 * 1000, dsibclk_nsk) - 1;
+- dev_dbg(priv->dev, "LINEINITCNT: %u\n", val);
++ dev_dbg(dev, "LINEINITCNT: %u\n", val);
+ tc358768_write(priv, TC358768_LINEINITCNT, val);
+
+ /* LPTimeCnt > 50ns */
+ val = tc358768_ns_to_cnt(50, dsibclk_nsk) - 1;
+ lptxcnt = val;
+- dev_dbg(priv->dev, "LPTXTIMECNT: %u\n", val);
++ dev_dbg(dev, "LPTXTIMECNT: %u\n", val);
+ tc358768_write(priv, TC358768_LPTXTIMECNT, val);
+
+ /* 38ns < TCLK_PREPARE < 95ns */
+ val = tc358768_ns_to_cnt(65, dsibclk_nsk) - 1;
+- dev_dbg(priv->dev, "TCLK_PREPARECNT %u\n", val);
++ dev_dbg(dev, "TCLK_PREPARECNT %u\n", val);
+ /* TCLK_PREPARE + TCLK_ZERO > 300ns */
+ val2 = tc358768_ns_to_cnt(300 - tc358768_to_ns(2 * ui_nsk),
+ dsibclk_nsk) - 2;
+- dev_dbg(priv->dev, "TCLK_ZEROCNT %u\n", val2);
++ dev_dbg(dev, "TCLK_ZEROCNT %u\n", val2);
+ val |= val2 << 8;
+ tc358768_write(priv, TC358768_TCLK_HEADERCNT, val);
+
+ /* TCLK_TRAIL > 60ns AND TEOT <= 105 ns + 12*UI */
+ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(2 * ui_nsk), dsibclk_nsk) - 5;
+ val = clamp(raw_val, 0, 127);
+- dev_dbg(priv->dev, "TCLK_TRAILCNT: %u\n", val);
++ dev_dbg(dev, "TCLK_TRAILCNT: %u\n", val);
+ tc358768_write(priv, TC358768_TCLK_TRAILCNT, val);
+
+ /* 40ns + 4*UI < THS_PREPARE < 85ns + 6*UI */
+ val = 50 + tc358768_to_ns(4 * ui_nsk);
+ val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 1;
+- dev_dbg(priv->dev, "THS_PREPARECNT %u\n", val);
++ dev_dbg(dev, "THS_PREPARECNT %u\n", val);
+ /* THS_PREPARE + THS_ZERO > 145ns + 10*UI */
+ raw_val = tc358768_ns_to_cnt(145 - tc358768_to_ns(3 * ui_nsk), dsibclk_nsk) - 10;
+ val2 = clamp(raw_val, 0, 127);
+- dev_dbg(priv->dev, "THS_ZEROCNT %u\n", val2);
++ dev_dbg(dev, "THS_ZEROCNT %u\n", val2);
+ val |= val2 << 8;
+ tc358768_write(priv, TC358768_THS_HEADERCNT, val);
+
+ /* TWAKEUP > 1ms in lptxcnt steps */
+ val = tc358768_ns_to_cnt(1020000, dsibclk_nsk);
+ val = val / (lptxcnt + 1) - 1;
+- dev_dbg(priv->dev, "TWAKEUP: %u\n", val);
++ dev_dbg(dev, "TWAKEUP: %u\n", val);
+ tc358768_write(priv, TC358768_TWAKEUP, val);
+
+ /* TCLK_POSTCNT > 60ns + 52*UI */
+ val = tc358768_ns_to_cnt(60 + tc358768_to_ns(52 * ui_nsk),
+ dsibclk_nsk) - 3;
+- dev_dbg(priv->dev, "TCLK_POSTCNT: %u\n", val);
++ dev_dbg(dev, "TCLK_POSTCNT: %u\n", val);
+ tc358768_write(priv, TC358768_TCLK_POSTCNT, val);
+
+ /* max(60ns + 4*UI, 8*UI) < THS_TRAILCNT < 105ns + 12*UI */
+ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(18 * ui_nsk),
+ dsibclk_nsk) - 4;
+ val = clamp(raw_val, 0, 15);
+- dev_dbg(priv->dev, "THS_TRAILCNT: %u\n", val);
++ dev_dbg(dev, "THS_TRAILCNT: %u\n", val);
+ tc358768_write(priv, TC358768_THS_TRAILCNT, val);
+
+ val = BIT(0);
+@@ -806,10 +807,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ /* TXTAGOCNT[26:16] RXTASURECNT[10:0] */
+ val = tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk * 4);
+ val = tc358768_ns_to_cnt(val, dsibclk_nsk) / 4 - 1;
+- dev_dbg(priv->dev, "TXTAGOCNT: %u\n", val);
++ dev_dbg(dev, "TXTAGOCNT: %u\n", val);
+ val2 = tc358768_ns_to_cnt(tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk),
+ dsibclk_nsk) - 2;
+- dev_dbg(priv->dev, "RXTASURECNT: %u\n", val2);
++ dev_dbg(dev, "RXTASURECNT: %u\n", val2);
+ val = val << 16 | val2;
+ tc358768_write(priv, TC358768_BTACNTRL1, val);
+
+@@ -903,7 +904,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+
+ ret = tc358768_clear_error(priv);
+ if (ret) {
+- dev_err(priv->dev, "Bridge pre_enable failed: %d\n", ret);
++ dev_err(dev, "Bridge pre_enable failed: %d\n", ret);
+ tc358768_bridge_disable(bridge);
+ tc358768_bridge_post_disable(bridge);
+ }
+--
+2.42.0
+
--- /dev/null
+From 42194d0a14bcc04f8ccf6aae20c7a202c8a8cf2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 09:50:53 +0300
+Subject: drm/bridge: tc358768: Use struct videomode
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit e5fb21678136a9d009d5c43821881eb4c34fae97 ]
+
+The TC358768 documentation uses HFP, HBP, etc. values to deal with the
+video mode, while the driver currently uses the DRM display mode
+(htotal, hsync_start, etc).
+
+Change the driver to convert the DRM display mode to struct videomode,
+which then allows us to use the same units the documentation uses. This
+makes it much easier to work on the code when using the TC358768
+documentation as a reference.
+
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> # Asus TF700T
+Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230906-tc358768-v4-6-31725f008a50@ideasonboard.com
+Stable-dep-of: f1dabbe64506 ("drm/bridge: tc358768: Fix tc358768_ns_to_cnt()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 45 ++++++++++++++++---------------
+ 1 file changed, 24 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 70fd560ed394e..8a44e75ae24cb 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -651,6 +651,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ u32 dsiclk, dsibclk, video_start;
+ const u32 internal_delay = 40;
+ int ret, i;
++ struct videomode vm;
+
+ if (mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS) {
+ dev_warn_once(priv->dev, "Non-continuous mode unimplemented, falling back to continuous\n");
+@@ -674,6 +675,8 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ return;
+ }
+
++ drm_display_mode_to_videomode(mode, &vm);
++
+ dsiclk = priv->dsiclk;
+ dsibclk = dsiclk / 4;
+
+@@ -682,28 +685,28 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ switch (dsi_dev->format) {
+ case MIPI_DSI_FMT_RGB888:
+ val |= (0x3 << 4);
+- hact = mode->hdisplay * 3;
+- video_start = (mode->htotal - mode->hsync_start) * 3;
++ hact = vm.hactive * 3;
++ video_start = (vm.hsync_len + vm.hback_porch) * 3;
+ data_type = MIPI_DSI_PACKED_PIXEL_STREAM_24;
+ break;
+ case MIPI_DSI_FMT_RGB666:
+ val |= (0x4 << 4);
+- hact = mode->hdisplay * 3;
+- video_start = (mode->htotal - mode->hsync_start) * 3;
++ hact = vm.hactive * 3;
++ video_start = (vm.hsync_len + vm.hback_porch) * 3;
+ data_type = MIPI_DSI_PACKED_PIXEL_STREAM_18;
+ break;
+
+ case MIPI_DSI_FMT_RGB666_PACKED:
+ val |= (0x4 << 4) | BIT(3);
+- hact = mode->hdisplay * 18 / 8;
+- video_start = (mode->htotal - mode->hsync_start) * 18 / 8;
++ hact = vm.hactive * 18 / 8;
++ video_start = (vm.hsync_len + vm.hback_porch) * 18 / 8;
+ data_type = MIPI_DSI_PIXEL_STREAM_3BYTE_18;
+ break;
+
+ case MIPI_DSI_FMT_RGB565:
+ val |= (0x5 << 4);
+- hact = mode->hdisplay * 2;
+- video_start = (mode->htotal - mode->hsync_start) * 2;
++ hact = vm.hactive * 2;
++ video_start = (vm.hsync_len + vm.hback_porch) * 2;
+ data_type = MIPI_DSI_PACKED_PIXEL_STREAM_16;
+ break;
+ default:
+@@ -815,43 +818,43 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ tc358768_write(priv, TC358768_DSI_EVENT, 0);
+
+ /* vact */
+- tc358768_write(priv, TC358768_DSI_VACT, mode->vdisplay);
++ tc358768_write(priv, TC358768_DSI_VACT, vm.vactive);
+
+ /* vsw */
+- tc358768_write(priv, TC358768_DSI_VSW,
+- mode->vsync_end - mode->vsync_start);
++ tc358768_write(priv, TC358768_DSI_VSW, vm.vsync_len);
++
+ /* vbp */
+- tc358768_write(priv, TC358768_DSI_VBPR,
+- mode->vtotal - mode->vsync_end);
++ tc358768_write(priv, TC358768_DSI_VBPR, vm.vback_porch);
+
+ /* hsw * byteclk * ndl / pclk */
+- val = (u32)div_u64((mode->hsync_end - mode->hsync_start) *
++ val = (u32)div_u64(vm.hsync_len *
+ ((u64)priv->dsiclk / 4) * priv->dsi_lanes,
+- mode->clock * 1000);
++ vm.pixelclock);
+ tc358768_write(priv, TC358768_DSI_HSW, val);
+
+ /* hbp * byteclk * ndl / pclk */
+- val = (u32)div_u64((mode->htotal - mode->hsync_end) *
++ val = (u32)div_u64(vm.hback_porch *
+ ((u64)priv->dsiclk / 4) * priv->dsi_lanes,
+- mode->clock * 1000);
++ vm.pixelclock);
+ tc358768_write(priv, TC358768_DSI_HBPR, val);
+ } else {
+ /* Set event mode */
+ tc358768_write(priv, TC358768_DSI_EVENT, 1);
+
+ /* vact */
+- tc358768_write(priv, TC358768_DSI_VACT, mode->vdisplay);
++ tc358768_write(priv, TC358768_DSI_VACT, vm.vactive);
+
+ /* vsw (+ vbp) */
+ tc358768_write(priv, TC358768_DSI_VSW,
+- mode->vtotal - mode->vsync_start);
++ vm.vsync_len + vm.vback_porch);
++
+ /* vbp (not used in event mode) */
+ tc358768_write(priv, TC358768_DSI_VBPR, 0);
+
+ /* (hsw + hbp) * byteclk * ndl / pclk */
+- val = (u32)div_u64((mode->htotal - mode->hsync_start) *
++ val = (u32)div_u64((vm.hsync_len + vm.hback_porch) *
+ ((u64)priv->dsiclk / 4) * priv->dsi_lanes,
+- mode->clock * 1000);
++ vm.pixelclock);
+ tc358768_write(priv, TC358768_DSI_HSW, val);
+
+ /* hbp (not used in event mode) */
+--
+2.42.0
+
--- /dev/null
+From 6e100a97a4fb945ff9e31254a845d6195b5f9247 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Aug 2023 20:57:21 +0800
+Subject: drm/mediatek: Fix iommu fault by swapping FBs after updating plane
+ state
+
+From: Jason-JH.Lin <jason-jh.lin@mediatek.com>
+
+[ Upstream commit 3ec71e05ae6e7f46512e568ed81c92be589003dd ]
+
+According to the comment in drm_atomic_helper_async_commit(),
+we should make sure FBs have been swapped, so that cleanups in the
+new_state performs a cleanup in the old FB.
+
+So we should move swapping FBs after calling mtk_plane_update_new_state(),
+to avoid using the old FB which could be freed.
+
+Fixes: 1a64a7aff8da ("drm/mediatek: Fix cursor plane no update")
+Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230809125722.24112-2-jason-jh.lin@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_plane.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_plane.c b/drivers/gpu/drm/mediatek/mtk_drm_plane.c
+index 2f5e007dd3800..c4a0203d17e38 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_plane.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_plane.c
+@@ -157,9 +157,9 @@ static void mtk_plane_atomic_async_update(struct drm_plane *plane,
+ plane->state->src_y = new_state->src_y;
+ plane->state->src_h = new_state->src_h;
+ plane->state->src_w = new_state->src_w;
+- swap(plane->state->fb, new_state->fb);
+
+ mtk_plane_update_new_state(new_state, new_plane_state);
++ swap(plane->state->fb, new_state->fb);
+ wmb(); /* Make sure the above parameters are set before update */
+ new_plane_state->pending.async_dirty = true;
+ mtk_drm_crtc_async_update(new_state->crtc, plane, state);
+--
+2.42.0
+
--- /dev/null
+From ea4cee2596ae4ddd6c80c1ad6655a4dd6e9a106d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Aug 2023 20:57:22 +0800
+Subject: drm/mediatek: Fix iommu fault during crtc enabling
+
+From: Jason-JH.Lin <jason-jh.lin@mediatek.com>
+
+[ Upstream commit 53412dc2905401207f264dc30890f6b9e41524a6 ]
+
+The difference between drm_atomic_helper_commit_tail() and
+drm_atomic_helper_commit_tail_rpm() is
+drm_atomic_helper_commit_tail() will commit plane first and
+then enable crtc, drm_atomic_helper_commit_tail_rpm() will
+enable crtc first and then commit plane.
+
+Before mediatek-drm enables crtc, the power and clk required
+by OVL have not been turned on, so the commit plane cannot be
+committed before crtc is enabled. That means OVL layer should
+not be enabled before crtc is enabled.
+Therefore, the atomic_commit_tail of mediatek-drm is hooked with
+drm_atomic_helper_commit_tail_rpm().
+
+Another reason is that the plane_state of drm_atomic_state is not
+synchronized with the plane_state stored in mtk_crtc during crtc enablng,
+so just set all planes to disabled.
+
+Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
+Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230809125722.24112-3-jason-jh.lin@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index 14ddfe3a6be77..7fb52a573436e 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -402,6 +402,9 @@ static int mtk_crtc_ddp_hw_init(struct mtk_drm_crtc *mtk_crtc)
+ unsigned int local_layer;
+
+ plane_state = to_mtk_plane_state(plane->state);
++
++ /* should not enable layer before crtc enabled */
++ plane_state->pending.enable = false;
+ comp = mtk_drm_ddp_comp_for_plane(crtc, plane, &local_layer);
+ if (comp)
+ mtk_ddp_comp_layer_config(comp, local_layer,
+--
+2.42.0
+
--- /dev/null
+From 021739e02fb2d963a66a1c79f3a1da99babaa542 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 12:42:34 +0200
+Subject: drm: mediatek: mtk_dsi: Fix NO_EOT_PACKET settings/handling
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 5855d422a6f250f3518f43b49092c8e87a5e42be ]
+
+Due to the initial confusion about MIPI_DSI_MODE_EOT_PACKET, properly
+renamed to MIPI_DSI_MODE_NO_EOT_PACKET, reflecting its actual meaning,
+both the DSI_TXRX_CON register setting for bit (HSTX_)DIS_EOT and the
+later calculation for horizontal sync-active (HSA), back (HBP) and
+front (HFP) porches got incorrect due to the logic being inverted.
+
+This means that a number of settings were wrong because....:
+ - DSI_TXRX_CON register setting: bit (HSTX_)DIS_EOT should be
+ set in order to disable the End of Transmission packet;
+ - Horizontal Sync and Back/Front porches: The delta used to
+ calculate all of HSA, HBP and HFP should account for the
+ additional EOT packet.
+
+Before this change...
+ - Bit (HSTX_)DIS_EOT was being set when EOT packet was enabled;
+ - For HSA/HBP/HFP delta... all three were wrong, as words were
+ added when EOT disabled, instead of when EOT packet enabled!
+
+Invert the logic around flag MIPI_DSI_MODE_NO_EOT_PACKET in the
+MediaTek DSI driver to fix the aforementioned issues.
+
+Fixes: 8b2b99fd7931 ("drm/mediatek: dsi: Fine tune the line time caused by EOTp")
+Fixes: c87d1c4b5b9a ("drm/mediatek: dsi: Use symbolized register definition")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Tested-by: Michael Walle <mwalle@kernel.org>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20230523104234.7849-1-angelogioacchino.delregno@collabora.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
+index 9e1363c9fcdb4..3e74c7c1b89fa 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
+@@ -406,7 +406,7 @@ static void mtk_dsi_rxtx_control(struct mtk_dsi *dsi)
+ if (dsi->mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS)
+ tmp_reg |= HSTX_CKLP_EN;
+
+- if (!(dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET))
++ if (dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET)
+ tmp_reg |= DIS_EOT;
+
+ writel(tmp_reg, dsi->regs + DSI_TXRX_CTRL);
+@@ -483,7 +483,7 @@ static void mtk_dsi_config_vdo_timing(struct mtk_dsi *dsi)
+ timing->da_hs_zero + timing->da_hs_exit + 3;
+
+ delta = dsi->mode_flags & MIPI_DSI_MODE_VIDEO_BURST ? 18 : 12;
+- delta += dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET ? 2 : 0;
++ delta += dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET ? 0 : 2;
+
+ horizontal_frontporch_byte = vm->hfront_porch * dsi_tmp_buf_bpp;
+ horizontal_front_back_byte = horizontal_frontporch_byte + horizontal_backporch_byte;
+--
+2.42.0
+
--- /dev/null
+From f4045ef8ab9b9681cb93608499fd31a7634745b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 04:29:09 +0300
+Subject: drm/msm/dsi: free TX buffer in unbind
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 5e05be78264594634860087953649487f486ffcc ]
+
+If the drm/msm init code gets an error during output modeset
+initialisation, the kernel will report an error regarding DRM memory
+manager not being clean during shutdown. This is because
+msm_dsi_modeset_init() allocates a piece of GEM memory for the TX
+buffer, but destruction of the buffer happens only at
+msm_dsi_host_destroy(), which is called during DSI driver's remove()
+time, much later than the DRM MM shutdown.
+
+To solve this issue, move the TX buffer destruction to dsi_unbind(), so
+that the buffer is destructed at the correct time. Note, we also have to
+store a reference to the address space, because priv->kms->aspace is
+cleared before components are unbound.
+
+Reported-by: Bjorn Andersson <andersson@kernel.org>
+Fixes: 8f59ee9a570c ("drm/msm/dsi: Adjust probe order")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/562238/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi.c | 1 +
+ drivers/gpu/drm/msm/dsi/dsi.h | 1 +
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 15 +++++++++------
+ 3 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c
+index 8a95c744972a1..e9036e4036bc6 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi.c
++++ b/drivers/gpu/drm/msm/dsi/dsi.c
+@@ -127,6 +127,7 @@ static void dsi_unbind(struct device *dev, struct device *master,
+ struct msm_drm_private *priv = dev_get_drvdata(master);
+ struct msm_dsi *msm_dsi = dev_get_drvdata(dev);
+
++ msm_dsi_tx_buf_free(msm_dsi->host);
+ priv->dsi[msm_dsi->id] = NULL;
+ }
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi.h b/drivers/gpu/drm/msm/dsi/dsi.h
+index 2a96b4fe7839f..6b239f77fca94 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi.h
++++ b/drivers/gpu/drm/msm/dsi/dsi.h
+@@ -123,6 +123,7 @@ int dsi_tx_buf_alloc_v2(struct msm_dsi_host *msm_host, int size);
+ void *dsi_tx_buf_get_6g(struct msm_dsi_host *msm_host);
+ void *dsi_tx_buf_get_v2(struct msm_dsi_host *msm_host);
+ void dsi_tx_buf_put_6g(struct msm_dsi_host *msm_host);
++void msm_dsi_tx_buf_free(struct mipi_dsi_host *mipi_host);
+ int dsi_dma_base_get_6g(struct msm_dsi_host *msm_host, uint64_t *iova);
+ int dsi_dma_base_get_v2(struct msm_dsi_host *msm_host, uint64_t *iova);
+ int dsi_clk_init_v2(struct msm_dsi_host *msm_host);
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 4162595f15f1e..a7c6e8a1754de 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -149,6 +149,7 @@ struct msm_dsi_host {
+
+ /* DSI 6G TX buffer*/
+ struct drm_gem_object *tx_gem_obj;
++ struct msm_gem_address_space *aspace;
+
+ /* DSI v2 TX buffer */
+ void *tx_buf;
+@@ -1127,8 +1128,10 @@ int dsi_tx_buf_alloc_6g(struct msm_dsi_host *msm_host, int size)
+ uint64_t iova;
+ u8 *data;
+
++ msm_host->aspace = msm_gem_address_space_get(priv->kms->aspace);
++
+ data = msm_gem_kernel_new(dev, size, MSM_BO_WC,
+- priv->kms->aspace,
++ msm_host->aspace,
+ &msm_host->tx_gem_obj, &iova);
+
+ if (IS_ERR(data)) {
+@@ -1157,10 +1160,10 @@ int dsi_tx_buf_alloc_v2(struct msm_dsi_host *msm_host, int size)
+ return 0;
+ }
+
+-static void dsi_tx_buf_free(struct msm_dsi_host *msm_host)
++void msm_dsi_tx_buf_free(struct mipi_dsi_host *host)
+ {
++ struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+ struct drm_device *dev = msm_host->dev;
+- struct msm_drm_private *priv;
+
+ /*
+ * This is possible if we're tearing down before we've had a chance to
+@@ -1171,10 +1174,11 @@ static void dsi_tx_buf_free(struct msm_dsi_host *msm_host)
+ if (!dev)
+ return;
+
+- priv = dev->dev_private;
+ if (msm_host->tx_gem_obj) {
+- msm_gem_kernel_put(msm_host->tx_gem_obj, priv->kms->aspace);
++ msm_gem_kernel_put(msm_host->tx_gem_obj, msm_host->aspace);
++ msm_gem_address_space_put(msm_host->aspace);
+ msm_host->tx_gem_obj = NULL;
++ msm_host->aspace = NULL;
+ }
+
+ if (msm_host->tx_buf)
+@@ -2013,7 +2017,6 @@ void msm_dsi_host_destroy(struct mipi_dsi_host *host)
+ struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+ DBG("");
+- dsi_tx_buf_free(msm_host);
+ if (msm_host->workqueue) {
+ destroy_workqueue(msm_host->workqueue);
+ msm_host->workqueue = NULL;
+--
+2.42.0
+
--- /dev/null
+From 4aafdc4507302b968a256d1dfacdee5d2056492c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 04:29:08 +0300
+Subject: drm/msm/dsi: use msm_gem_kernel_put to free TX buffer
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 69b321b2c3df4f7e51a9de587e41f324b0b717b0 ]
+
+Use exiting function to free the allocated GEM object instead of
+open-coding it. This has a bonus of internally calling
+msm_gem_put_vaddr() to compensate for msm_gem_get_vaddr() in
+msm_get_kernel_new().
+
+Fixes: 1e29dff00400 ("drm/msm: Add a common function to free kernel buffer objects")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/562239/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index e20cd3dd2c6cc..4162595f15f1e 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -1173,8 +1173,7 @@ static void dsi_tx_buf_free(struct msm_dsi_host *msm_host)
+
+ priv = dev->dev_private;
+ if (msm_host->tx_gem_obj) {
+- msm_gem_unpin_iova(msm_host->tx_gem_obj, priv->kms->aspace);
+- drm_gem_object_put(msm_host->tx_gem_obj);
++ msm_gem_kernel_put(msm_host->tx_gem_obj, priv->kms->aspace);
+ msm_host->tx_gem_obj = NULL;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 5f8d70941e93383c5204b7ba319ddadd66452ba8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 19:33:49 +0800
+Subject: drm/radeon: possible buffer overflow
+
+From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
+
+[ Upstream commit dd05484f99d16715a88eedfca363828ef9a4c2d4 ]
+
+Buffer 'afmt_status' of size 6 could overflow, since index 'afmt_idx' is
+checked after access.
+
+Fixes: 5cc4e5fc293b ("drm/radeon: Cleanup HDMI audio interrupt handling for evergreen")
+Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
+Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/evergreen.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index 4f06356d9ce2e..f0ae087be914e 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -4821,14 +4821,15 @@ int evergreen_irq_process(struct radeon_device *rdev)
+ break;
+ case 44: /* hdmi */
+ afmt_idx = src_data;
+- if (!(afmt_status[afmt_idx] & AFMT_AZ_FORMAT_WTRIG))
+- DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+-
+ if (afmt_idx > 5) {
+ DRM_ERROR("Unhandled interrupt: %d %d\n",
+ src_id, src_data);
+ break;
+ }
++
++ if (!(afmt_status[afmt_idx] & AFMT_AZ_FORMAT_WTRIG))
++ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
++
+ afmt_status[afmt_idx] &= ~AFMT_AZ_FORMAT_WTRIG;
+ queue_hdmi = true;
+ DRM_DEBUG("IH: HDMI%d\n", afmt_idx + 1);
+--
+2.42.0
+
--- /dev/null
+From eb3312db09c32e6913eb562e026166f1c2c7502d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 19:34:31 +0200
+Subject: drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 44b968d0d0868b7a9b7a5c64464ada464ff4d532 ]
+
+cdn_dp_audio_codec_init() can fail. So add some error handling.
+
+If component_add() fails, the previous cdn_dp_audio_codec_init() call
+should be undone, as already done in the remove function.
+
+Fixes: 88582f564692 ("drm/rockchip: cdn-dp: Don't unregister audio dev when unbinding")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/8494a41602fadb7439630921a9779640698f2f9f.1693676045.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/cdn-dp-core.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c
+index 8526dda919317..0b33c3a1e6e3b 100644
+--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
++++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
+@@ -1178,6 +1178,7 @@ static int cdn_dp_probe(struct platform_device *pdev)
+ struct cdn_dp_device *dp;
+ struct extcon_dev *extcon;
+ struct phy *phy;
++ int ret;
+ int i;
+
+ dp = devm_kzalloc(dev, sizeof(*dp), GFP_KERNEL);
+@@ -1218,9 +1219,19 @@ static int cdn_dp_probe(struct platform_device *pdev)
+ mutex_init(&dp->lock);
+ dev_set_drvdata(dev, dp);
+
+- cdn_dp_audio_codec_init(dp, dev);
++ ret = cdn_dp_audio_codec_init(dp, dev);
++ if (ret)
++ return ret;
++
++ ret = component_add(dev, &cdn_dp_component_ops);
++ if (ret)
++ goto err_audio_deinit;
+
+- return component_add(dev, &cdn_dp_component_ops);
++ return 0;
++
++err_audio_deinit:
++ platform_device_unregister(dp->audio_pdev);
++ return ret;
+ }
+
+ static int cdn_dp_remove(struct platform_device *pdev)
+--
+2.42.0
+
--- /dev/null
+From f0416c1363caa47409d8f1f67fe57f6b4edefe56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Oct 2023 11:01:48 +0300
+Subject: drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 6471da5ee311d53ef46eebcb7725bc94266cc0cf ]
+
+The "ret" variable is declared as ssize_t and it can hold negative error
+codes but the "rk_obj->base.size" variable is type size_t. This means
+that when we compare them, they are both type promoted to size_t and the
+negative error code becomes a high unsigned value and is treated as
+success. Add a cast to fix this.
+
+Fixes: 38f993b7c59e ("drm/rockchip: Do not use DMA mapping API if attached to IOMMU domain")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/2bfa28b5-145d-4b9e-a18a-98819dd686ce@moroto.mountain
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+index 9426f7976d22e..10a4970ad2d8a 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+@@ -39,7 +39,7 @@ static int rockchip_gem_iommu_map(struct rockchip_gem_object *rk_obj)
+
+ ret = iommu_map_sgtable(private->domain, rk_obj->dma_addr, rk_obj->sgt,
+ prot);
+- if (ret < rk_obj->base.size) {
++ if (ret < (ssize_t)rk_obj->base.size) {
+ DRM_ERROR("failed to map buffer: size=%zd request_size=%zd\n",
+ ret, rk_obj->base.size);
+ ret = -ENOMEM;
+--
+2.42.0
+
--- /dev/null
+From 7d08093e831967b54e9d96735b48ec216a406d63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 22:33:20 +0000
+Subject: drm/rockchip: vop: Fix call to crtc reset helper
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 5aacd290837828c089a83ac9795c74c4c9e2c923 ]
+
+Allocation of crtc_state may fail in vop_crtc_reset, causing an invalid
+pointer to be passed to __drm_atomic_helper_crtc_reset.
+
+Fix this by adding a NULL check of crtc_state, similar to other drivers.
+
+Fixes: 01e2eaf40c9d ("drm/rockchip: Convert to using __drm_atomic_helper_crtc_reset() for reset.")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230621223311.2239547-4-jonas@kwiboo.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+index 071ba60eea99f..ae8c532f7fc84 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -1632,7 +1632,10 @@ static void vop_crtc_reset(struct drm_crtc *crtc)
+ if (crtc->state)
+ vop_crtc_destroy_state(crtc, crtc->state);
+
+- __drm_atomic_helper_crtc_reset(crtc, &crtc_state->base);
++ if (crtc_state)
++ __drm_atomic_helper_crtc_reset(crtc, &crtc_state->base);
++ else
++ __drm_atomic_helper_crtc_reset(crtc, NULL);
+ }
+
+ #ifdef CONFIG_DRM_ANALOGIX_DP
+--
+2.42.0
+
--- /dev/null
+From 750e7640896a299f70f91fa7d78f5f020c4f604a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 22:33:17 +0000
+Subject: drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 13fc28804bf10ca0b7bce3efbba95c534836d7ca ]
+
+struct rockchip_crtc_state members such as output_type, output_bpc and
+enable_afbc is always reset to zero in the atomic_duplicate_state crtc
+funcs.
+
+Fix this by using kmemdup on the subclass rockchip_crtc_state struct.
+
+Fixes: 4e257d9eee23 ("drm/rockchip: get rid of rockchip_drm_crtc_mode_config")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230621223311.2239547-2-jonas@kwiboo.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+index 2e2e08f4359a8..071ba60eea99f 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -1606,7 +1606,8 @@ static struct drm_crtc_state *vop_crtc_duplicate_state(struct drm_crtc *crtc)
+ if (WARN_ON(!crtc->state))
+ return NULL;
+
+- rockchip_state = kzalloc(sizeof(*rockchip_state), GFP_KERNEL);
++ rockchip_state = kmemdup(to_rockchip_crtc_state(crtc->state),
++ sizeof(*rockchip_state), GFP_KERNEL);
+ if (!rockchip_state)
+ return NULL;
+
+--
+2.42.0
+
--- /dev/null
+From fca40187b4da87bb6e421feeafaf7f496147dea8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 22:33:23 +0000
+Subject: drm/rockchip: vop2: Add missing call to crtc reset helper
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 4d49d87b3606369c6e29b9d051892ee1a6fc4e75 ]
+
+Add missing call to crtc reset helper to properly vblank reset.
+
+Also move vop2_crtc_reset and call vop2_crtc_destroy_state to simplify
+and remove duplicated code.
+
+Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230621223311.2239547-6-jonas@kwiboo.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 31 +++++++++-----------
+ 1 file changed, 14 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index adccb88c04ad0..b233f52675dc4 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -2075,23 +2075,6 @@ static const struct drm_crtc_helper_funcs vop2_crtc_helper_funcs = {
+ .atomic_disable = vop2_crtc_atomic_disable,
+ };
+
+-static void vop2_crtc_reset(struct drm_crtc *crtc)
+-{
+- struct rockchip_crtc_state *vcstate = to_rockchip_crtc_state(crtc->state);
+-
+- if (crtc->state) {
+- __drm_atomic_helper_crtc_destroy_state(crtc->state);
+- kfree(vcstate);
+- }
+-
+- vcstate = kzalloc(sizeof(*vcstate), GFP_KERNEL);
+- if (!vcstate)
+- return;
+-
+- crtc->state = &vcstate->base;
+- crtc->state->crtc = crtc;
+-}
+-
+ static struct drm_crtc_state *vop2_crtc_duplicate_state(struct drm_crtc *crtc)
+ {
+ struct rockchip_crtc_state *vcstate;
+@@ -2118,6 +2101,20 @@ static void vop2_crtc_destroy_state(struct drm_crtc *crtc,
+ kfree(vcstate);
+ }
+
++static void vop2_crtc_reset(struct drm_crtc *crtc)
++{
++ struct rockchip_crtc_state *vcstate =
++ kzalloc(sizeof(*vcstate), GFP_KERNEL);
++
++ if (crtc->state)
++ vop2_crtc_destroy_state(crtc, crtc->state);
++
++ if (vcstate)
++ __drm_atomic_helper_crtc_reset(crtc, &vcstate->base);
++ else
++ __drm_atomic_helper_crtc_reset(crtc, NULL);
++}
++
+ static const struct drm_crtc_funcs vop2_crtc_funcs = {
+ .set_config = drm_atomic_helper_set_config,
+ .page_flip = drm_atomic_helper_page_flip,
+--
+2.42.0
+
--- /dev/null
+From fb2fad8305c29564d9f69233c589bd644bbfb8cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 22:33:21 +0000
+Subject: drm/rockchip: vop2: Don't crash for invalid duplicate_state
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 342f7e4967d02b0ec263b15916304fc54841b608 ]
+
+It's possible for users to try to duplicate the CRTC state even when the
+state doesn't exist. drm_atomic_helper_crtc_duplicate_state() (and other
+users of __drm_atomic_helper_crtc_duplicate_state()) already guard this
+with a WARN_ON() instead of crashing, so let's do that here too.
+
+Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230621223311.2239547-5-jonas@kwiboo.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index 3c05ce01f73b8..adccb88c04ad0 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -2094,11 +2094,13 @@ static void vop2_crtc_reset(struct drm_crtc *crtc)
+
+ static struct drm_crtc_state *vop2_crtc_duplicate_state(struct drm_crtc *crtc)
+ {
+- struct rockchip_crtc_state *vcstate, *old_vcstate;
++ struct rockchip_crtc_state *vcstate;
+
+- old_vcstate = to_rockchip_crtc_state(crtc->state);
++ if (WARN_ON(!crtc->state))
++ return NULL;
+
+- vcstate = kmemdup(old_vcstate, sizeof(*old_vcstate), GFP_KERNEL);
++ vcstate = kmemdup(to_rockchip_crtc_state(crtc->state),
++ sizeof(*vcstate), GFP_KERNEL);
+ if (!vcstate)
+ return NULL;
+
+--
+2.42.0
+
--- /dev/null
+From 48c72524e7bf8f1645278654fad7f854071201a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Oct 2022 18:20:45 +0200
+Subject: dt-bindings: mfd: mt6397: Add binding for MT6357
+
+From: Fabien Parent <fparent@baylibre.com>
+
+[ Upstream commit 118ee241c423636c03527eada8f672301514751e ]
+
+Add binding documentation for the MT6357 PMIC.
+
+Signed-off-by: Fabien Parent <fparent@baylibre.com>
+Signed-off-by: Alexandre Mergnat <amergnat@baylibre.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20221005-mt6357-support-v3-1-7e0bd7c315b2@baylibre.com
+Stable-dep-of: 61fdd1f1d2c1 ("dt-bindings: mfd: mt6397: Split out compatible for MediaTek MT6366 PMIC")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/mfd/mt6397.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Documentation/devicetree/bindings/mfd/mt6397.txt b/Documentation/devicetree/bindings/mfd/mt6397.txt
+index 0088442efca1a..518986c44880f 100644
+--- a/Documentation/devicetree/bindings/mfd/mt6397.txt
++++ b/Documentation/devicetree/bindings/mfd/mt6397.txt
+@@ -21,6 +21,7 @@ Required properties:
+ compatible:
+ "mediatek,mt6323" for PMIC MT6323
+ "mediatek,mt6331" for PMIC MT6331 and MT6332
++ "mediatek,mt6357" for PMIC MT6357
+ "mediatek,mt6358" for PMIC MT6358 and MT6366
+ "mediatek,mt6359" for PMIC MT6359
+ "mediatek,mt6397" for PMIC MT6397
+--
+2.42.0
+
--- /dev/null
+From b85c32114224d230c215b176ec82e39c7d49b5e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 16:55:24 +0800
+Subject: dt-bindings: mfd: mt6397: Split out compatible for MediaTek MT6366
+ PMIC
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 61fdd1f1d2c183ec256527d16d75e75c3582af82 ]
+
+The MT6366 PMIC is mostly, but not fully, compatible with MT6358. It has
+a different set of regulators. Specifically, it lacks the camera related
+VCAM* LDOs and VLDO28, but has additional VM18, VMDDR, and VSRAM_CORE LDOs.
+
+The PMICs contain a chip ID register that can be used to detect which
+exact model is preset, so it is possible to share a common base
+compatible string.
+
+Add a separate compatible for the MT6366 PMIC, with a fallback to the
+MT6358 PMIC.
+
+Fixes: 49be16305587 ("dt-bindings: mfd: Add compatible for the MediaTek MT6366 PMIC")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230928085537.3246669-2-wenst@chromium.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/mfd/mt6397.txt | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/mfd/mt6397.txt b/Documentation/devicetree/bindings/mfd/mt6397.txt
+index 518986c44880f..8f9784af92d6e 100644
+--- a/Documentation/devicetree/bindings/mfd/mt6397.txt
++++ b/Documentation/devicetree/bindings/mfd/mt6397.txt
+@@ -22,8 +22,9 @@ compatible:
+ "mediatek,mt6323" for PMIC MT6323
+ "mediatek,mt6331" for PMIC MT6331 and MT6332
+ "mediatek,mt6357" for PMIC MT6357
+- "mediatek,mt6358" for PMIC MT6358 and MT6366
++ "mediatek,mt6358" for PMIC MT6358
+ "mediatek,mt6359" for PMIC MT6359
++ "mediatek,mt6366", "mediatek,mt6358" for PMIC MT6366
+ "mediatek,mt6397" for PMIC MT6397
+
+ Optional subnodes:
+@@ -40,6 +41,7 @@ Optional subnodes:
+ - compatible: "mediatek,mt6323-regulator"
+ see ../regulator/mt6323-regulator.txt
+ - compatible: "mediatek,mt6358-regulator"
++ - compatible: "mediatek,mt6366-regulator", "mediatek-mt6358-regulator"
+ see ../regulator/mt6358-regulator.txt
+ - compatible: "mediatek,mt6397-regulator"
+ see ../regulator/mt6397-regulator.txt
+--
+2.42.0
+
--- /dev/null
+From c09696b994babb1b8bb88ccf65ebb5af8838453b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 09:33:41 +0800
+Subject: ext4: move 'ix' sanity check to corrent position
+
+From: Gou Hao <gouhao@uniontech.com>
+
+[ Upstream commit af90a8f4a09ec4a3de20142e37f37205d4687f28 ]
+
+Check 'ix' before it is used.
+
+Fixes: 80e675f906db ("ext4: optimize memmmove lengths in extent/index insertions")
+Signed-off-by: Gou Hao <gouhao@uniontech.com>
+Link: https://lore.kernel.org/r/20230906013341.7199-1-gouhao@uniontech.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 1bb55a6d79c23..aa5aadd70bbc2 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -1010,6 +1010,11 @@ static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
+ ix = curp->p_idx;
+ }
+
++ if (unlikely(ix > EXT_MAX_INDEX(curp->p_hdr))) {
++ EXT4_ERROR_INODE(inode, "ix > EXT_MAX_INDEX!");
++ return -EFSCORRUPTED;
++ }
++
+ len = EXT_LAST_INDEX(curp->p_hdr) - ix + 1;
+ BUG_ON(len < 0);
+ if (len > 0) {
+@@ -1019,11 +1024,6 @@ static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
+ memmove(ix + 1, ix, len * sizeof(struct ext4_extent_idx));
+ }
+
+- if (unlikely(ix > EXT_MAX_INDEX(curp->p_hdr))) {
+- EXT4_ERROR_INODE(inode, "ix > EXT_MAX_INDEX!");
+- return -EFSCORRUPTED;
+- }
+-
+ ix->ei_block = cpu_to_le32(logical);
+ ext4_idx_store_pblock(ix, ptr);
+ le16_add_cpu(&curp->p_hdr->eh_entries, 1);
+--
+2.42.0
+
--- /dev/null
+From b675e87e610d478ca420732104f178e594996306 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 22:04:14 +0800
+Subject: f2fs: compress: fix deadloop in f2fs_write_cache_pages()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit c5d3f9b7649abb20aa5ab3ebff9421a171eaeb22 ]
+
+With below mount option and testcase, it hangs kernel.
+
+1. mount -t f2fs -o compress_log_size=5 /dev/vdb /mnt/f2fs
+2. touch /mnt/f2fs/file
+3. chattr +c /mnt/f2fs/file
+4. dd if=/dev/zero of=/mnt/f2fs/file bs=1MB count=1
+5. sync
+6. dd if=/dev/zero of=/mnt/f2fs/file bs=111 count=11 conv=notrunc
+7. sync
+
+INFO: task sync:4788 blocked for more than 120 seconds.
+ Not tainted 6.5.0-rc1+ #322
+"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+task:sync state:D stack:0 pid:4788 ppid:509 flags:0x00000002
+Call Trace:
+ <TASK>
+ __schedule+0x335/0xf80
+ schedule+0x6f/0xf0
+ wb_wait_for_completion+0x5e/0x90
+ sync_inodes_sb+0xd8/0x2a0
+ sync_inodes_one_sb+0x1d/0x30
+ iterate_supers+0x99/0xf0
+ ksys_sync+0x46/0xb0
+ __do_sys_sync+0x12/0x20
+ do_syscall_64+0x3f/0x90
+ entry_SYSCALL_64_after_hwframe+0x6e/0xd8
+
+The reason is f2fs_all_cluster_page_ready() assumes that pages array should
+cover at least one cluster, otherwise, it will always return false, result
+in deadloop.
+
+By default, pages array size is 16, and it can cover the case cluster_size
+is equal or less than 16, for the case cluster_size is larger than 16, let's
+allocate memory of pages array dynamically.
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index f4d3b3c6f6da7..47483634b06a3 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2950,7 +2950,8 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ {
+ int ret = 0;
+ int done = 0, retry = 0;
+- struct page *pages[F2FS_ONSTACK_PAGES];
++ struct page *pages_local[F2FS_ONSTACK_PAGES];
++ struct page **pages = pages_local;
+ struct folio_batch fbatch;
+ struct f2fs_sb_info *sbi = F2FS_M_SB(mapping);
+ struct bio *bio = NULL;
+@@ -2974,6 +2975,7 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ #endif
+ int nr_folios, p, idx;
+ int nr_pages;
++ unsigned int max_pages = F2FS_ONSTACK_PAGES;
+ pgoff_t index;
+ pgoff_t end; /* Inclusive */
+ pgoff_t done_index;
+@@ -2983,6 +2985,15 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ int submitted = 0;
+ int i;
+
++#ifdef CONFIG_F2FS_FS_COMPRESSION
++ if (f2fs_compressed_file(inode) &&
++ 1 << cc.log_cluster_size > F2FS_ONSTACK_PAGES) {
++ pages = f2fs_kzalloc(sbi, sizeof(struct page *) <<
++ cc.log_cluster_size, GFP_NOFS | __GFP_NOFAIL);
++ max_pages = 1 << cc.log_cluster_size;
++ }
++#endif
++
+ folio_batch_init(&fbatch);
+
+ if (get_dirty_pages(mapping->host) <=
+@@ -3028,7 +3039,7 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ add_more:
+ pages[nr_pages] = folio_page(folio, idx);
+ folio_get(folio);
+- if (++nr_pages == F2FS_ONSTACK_PAGES) {
++ if (++nr_pages == max_pages) {
+ index = folio->index + idx + 1;
+ folio_batch_release(&fbatch);
+ goto write;
+@@ -3214,6 +3225,11 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ if (bio)
+ f2fs_submit_merged_ipu_write(sbi, &bio, NULL);
+
++#ifdef CONFIG_F2FS_FS_COMPRESSION
++ if (pages != pages_local)
++ kfree(pages);
++#endif
++
+ return ret;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 92a5792b242ab79112d48afca25fc265ff85b75a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 22:04:17 +0800
+Subject: f2fs: compress: fix to avoid redundant compress extension
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 7e1b150fece033703a824df1bbc03df091ea53cc ]
+
+With below script, redundant compress extension will be parsed and added
+by parse_options(), because parse_options() doesn't check whether the
+extension is existed or not, fix it.
+
+1. mount -t f2fs -o compress_extension=so /dev/vdb /mnt/f2fs
+2. mount -t f2fs -o remount,compress_extension=so /mnt/f2fs
+3. mount|grep f2fs
+
+/dev/vdb on /mnt/f2fs type f2fs (...,compress_extension=so,compress_extension=so,...)
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Fixes: 151b1982be5d ("f2fs: compress: add nocompress extensions support")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 2046f633fe57a..1ba85ef97cbd3 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -548,6 +548,29 @@ static int f2fs_set_test_dummy_encryption(struct super_block *sb,
+ }
+
+ #ifdef CONFIG_F2FS_FS_COMPRESSION
++static bool is_compress_extension_exist(struct f2fs_sb_info *sbi,
++ const char *new_ext, bool is_ext)
++{
++ unsigned char (*ext)[F2FS_EXTENSION_LEN];
++ int ext_cnt;
++ int i;
++
++ if (is_ext) {
++ ext = F2FS_OPTION(sbi).extensions;
++ ext_cnt = F2FS_OPTION(sbi).compress_ext_cnt;
++ } else {
++ ext = F2FS_OPTION(sbi).noextensions;
++ ext_cnt = F2FS_OPTION(sbi).nocompress_ext_cnt;
++ }
++
++ for (i = 0; i < ext_cnt; i++) {
++ if (!strcasecmp(new_ext, ext[i]))
++ return true;
++ }
++
++ return false;
++}
++
+ /*
+ * 1. The same extension name cannot not appear in both compress and non-compress extension
+ * at the same time.
+@@ -1145,6 +1168,11 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount)
+ return -EINVAL;
+ }
+
++ if (is_compress_extension_exist(sbi, name, true)) {
++ kfree(name);
++ break;
++ }
++
+ strcpy(ext[ext_cnt], name);
+ F2FS_OPTION(sbi).compress_ext_cnt++;
+ kfree(name);
+@@ -1169,6 +1197,11 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount)
+ return -EINVAL;
+ }
+
++ if (is_compress_extension_exist(sbi, name, false)) {
++ kfree(name);
++ break;
++ }
++
+ strcpy(noext[noext_cnt], name);
+ F2FS_OPTION(sbi).nocompress_ext_cnt++;
+ kfree(name);
+--
+2.42.0
+
--- /dev/null
+From 5bf4932ad76a4ee8737260a861b1576f638b3910 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 22:04:15 +0800
+Subject: f2fs: compress: fix to avoid use-after-free on dic
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit b0327c84e91a0f4f0abced8cb83ec86a7083f086 ]
+
+Call trace:
+ __memcpy+0x128/0x250
+ f2fs_read_multi_pages+0x940/0xf7c
+ f2fs_mpage_readpages+0x5a8/0x624
+ f2fs_readahead+0x5c/0x110
+ page_cache_ra_unbounded+0x1b8/0x590
+ do_sync_mmap_readahead+0x1dc/0x2e4
+ filemap_fault+0x254/0xa8c
+ f2fs_filemap_fault+0x2c/0x104
+ __do_fault+0x7c/0x238
+ do_handle_mm_fault+0x11bc/0x2d14
+ do_mem_abort+0x3a8/0x1004
+ el0_da+0x3c/0xa0
+ el0t_64_sync_handler+0xc4/0xec
+ el0t_64_sync+0x1b4/0x1b8
+
+In f2fs_read_multi_pages(), once f2fs_decompress_cluster() was called if
+we hit cached page in compress_inode's cache, dic may be released, it needs
+break the loop rather than continuing it, in order to avoid accessing
+invalid dic pointer.
+
+Fixes: 6ce19aff0b8c ("f2fs: compress: add compress_inode to cache compressed blocks")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 47483634b06a3..ea05710ca9bdf 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2263,8 +2263,10 @@ int f2fs_read_multi_pages(struct compress_ctx *cc, struct bio **bio_ret,
+ f2fs_wait_on_block_writeback(inode, blkaddr);
+
+ if (f2fs_load_compressed_page(sbi, page, blkaddr)) {
+- if (atomic_dec_and_test(&dic->remaining_pages))
++ if (atomic_dec_and_test(&dic->remaining_pages)) {
+ f2fs_decompress_cluster(dic, true);
++ break;
++ }
+ continue;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 73eb986001756822e1f281cfca269a877fe674c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 13:14:39 -0800
+Subject: f2fs: convert f2fs_write_cache_pages() to use
+ filemap_get_folios_tag()
+
+From: Vishal Moola (Oracle) <vishal.moola@gmail.com>
+
+[ Upstream commit 1cd98ee747cff120ee9b93988ddb7315d8d8f8e7 ]
+
+Convert the function to use a folio_batch instead of pagevec. This is in
+preparation for the removal of find_get_pages_range_tag().
+
+Also modified f2fs_all_cluster_page_ready to take in a folio_batch instead
+of pagevec. This does NOT support large folios. The function currently
+only utilizes folios of size 1 so this shouldn't cause any issues right
+now.
+
+This version of the patch limits the number of pages fetched to
+F2FS_ONSTACK_PAGES. If that ever happens, update the start index here
+since filemap_get_folios_tag() updates the index to be after the last
+found folio, not necessarily the last used page.
+
+Link: https://lkml.kernel.org/r/20230104211448.4804-15-vishal.moola@gmail.com
+Signed-off-by: Vishal Moola (Oracle) <vishal.moola@gmail.com>
+Acked-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: c5d3f9b7649a ("f2fs: compress: fix deadloop in f2fs_write_cache_pages()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 84 ++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 58 insertions(+), 26 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index a982f91b71eb2..f4d3b3c6f6da7 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2951,6 +2951,7 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ int ret = 0;
+ int done = 0, retry = 0;
+ struct page *pages[F2FS_ONSTACK_PAGES];
++ struct folio_batch fbatch;
+ struct f2fs_sb_info *sbi = F2FS_M_SB(mapping);
+ struct bio *bio = NULL;
+ sector_t last_block;
+@@ -2971,6 +2972,7 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ .private = NULL,
+ };
+ #endif
++ int nr_folios, p, idx;
+ int nr_pages;
+ pgoff_t index;
+ pgoff_t end; /* Inclusive */
+@@ -2981,6 +2983,8 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ int submitted = 0;
+ int i;
+
++ folio_batch_init(&fbatch);
++
+ if (get_dirty_pages(mapping->host) <=
+ SM_I(F2FS_M_SB(mapping))->min_hot_blocks)
+ set_inode_flag(mapping->host, FI_HOT_DATA);
+@@ -3006,13 +3010,38 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ tag_pages_for_writeback(mapping, index, end);
+ done_index = index;
+ while (!done && !retry && (index <= end)) {
+- nr_pages = find_get_pages_range_tag(mapping, &index, end,
+- tag, F2FS_ONSTACK_PAGES, pages);
+- if (nr_pages == 0)
++ nr_pages = 0;
++again:
++ nr_folios = filemap_get_folios_tag(mapping, &index, end,
++ tag, &fbatch);
++ if (nr_folios == 0) {
++ if (nr_pages)
++ goto write;
+ break;
++ }
+
++ for (i = 0; i < nr_folios; i++) {
++ struct folio *folio = fbatch.folios[i];
++
++ idx = 0;
++ p = folio_nr_pages(folio);
++add_more:
++ pages[nr_pages] = folio_page(folio, idx);
++ folio_get(folio);
++ if (++nr_pages == F2FS_ONSTACK_PAGES) {
++ index = folio->index + idx + 1;
++ folio_batch_release(&fbatch);
++ goto write;
++ }
++ if (++idx < p)
++ goto add_more;
++ }
++ folio_batch_release(&fbatch);
++ goto again;
++write:
+ for (i = 0; i < nr_pages; i++) {
+ struct page *page = pages[i];
++ struct folio *folio = page_folio(page);
+ bool need_readd;
+ readd:
+ need_readd = false;
+@@ -3029,7 +3058,7 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ }
+
+ if (!f2fs_cluster_can_merge_page(&cc,
+- page->index)) {
++ folio->index)) {
+ ret = f2fs_write_multi_pages(&cc,
+ &submitted, wbc, io_type);
+ if (!ret)
+@@ -3038,27 +3067,28 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ }
+
+ if (unlikely(f2fs_cp_error(sbi)))
+- goto lock_page;
++ goto lock_folio;
+
+ if (!f2fs_cluster_is_empty(&cc))
+- goto lock_page;
++ goto lock_folio;
+
+ if (f2fs_all_cluster_page_ready(&cc,
+ pages, i, nr_pages, true))
+- goto lock_page;
++ goto lock_folio;
+
+ ret2 = f2fs_prepare_compress_overwrite(
+ inode, &pagep,
+- page->index, &fsdata);
++ folio->index, &fsdata);
+ if (ret2 < 0) {
+ ret = ret2;
+ done = 1;
+ break;
+ } else if (ret2 &&
+ (!f2fs_compress_write_end(inode,
+- fsdata, page->index, 1) ||
++ fsdata, folio->index, 1) ||
+ !f2fs_all_cluster_page_ready(&cc,
+- pages, i, nr_pages, false))) {
++ pages, i, nr_pages,
++ false))) {
+ retry = 1;
+ break;
+ }
+@@ -3071,46 +3101,47 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ break;
+ }
+ #ifdef CONFIG_F2FS_FS_COMPRESSION
+-lock_page:
++lock_folio:
+ #endif
+- done_index = page->index;
++ done_index = folio->index;
+ retry_write:
+- lock_page(page);
++ folio_lock(folio);
+
+- if (unlikely(page->mapping != mapping)) {
++ if (unlikely(folio->mapping != mapping)) {
+ continue_unlock:
+- unlock_page(page);
++ folio_unlock(folio);
+ continue;
+ }
+
+- if (!PageDirty(page)) {
++ if (!folio_test_dirty(folio)) {
+ /* someone wrote it for us */
+ goto continue_unlock;
+ }
+
+- if (PageWriteback(page)) {
++ if (folio_test_writeback(folio)) {
+ if (wbc->sync_mode != WB_SYNC_NONE)
+- f2fs_wait_on_page_writeback(page,
++ f2fs_wait_on_page_writeback(
++ &folio->page,
+ DATA, true, true);
+ else
+ goto continue_unlock;
+ }
+
+- if (!clear_page_dirty_for_io(page))
++ if (!folio_clear_dirty_for_io(folio))
+ goto continue_unlock;
+
+ #ifdef CONFIG_F2FS_FS_COMPRESSION
+ if (f2fs_compressed_file(inode)) {
+- get_page(page);
+- f2fs_compress_ctx_add_page(&cc, page);
++ folio_get(folio);
++ f2fs_compress_ctx_add_page(&cc, &folio->page);
+ continue;
+ }
+ #endif
+- ret = f2fs_write_single_data_page(page, &submitted,
+- &bio, &last_block, wbc, io_type,
+- 0, true);
++ ret = f2fs_write_single_data_page(&folio->page,
++ &submitted, &bio, &last_block,
++ wbc, io_type, 0, true);
+ if (ret == AOP_WRITEPAGE_ACTIVATE)
+- unlock_page(page);
++ folio_unlock(folio);
+ #ifdef CONFIG_F2FS_FS_COMPRESSION
+ result:
+ #endif
+@@ -3134,7 +3165,8 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ }
+ goto next;
+ }
+- done_index = page->index + 1;
++ done_index = folio->index +
++ folio_nr_pages(folio);
+ done = 1;
+ break;
+ }
+--
+2.42.0
+
--- /dev/null
+From c9b7f569d6e7faefa8041dba8a37f991d40ff659 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Oct 2023 15:45:52 +0800
+Subject: f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 8b07c1fb0f1ad139373c8253f2fad8bc43fab07d ]
+
+Otherwise, it may print random physical block address in tracepoint
+of f2fs_map_blocks() as below:
+
+f2fs_map_blocks: dev = (253,16), ino = 2297, file offset = 0, start blkaddr = 0xa356c421, len = 0x0, flags = 0
+
+Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 746c71716bead..d0c17366ebf48 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3249,6 +3249,7 @@ int f2fs_precache_extents(struct inode *inode)
+ return -EOPNOTSUPP;
+
+ map.m_lblk = 0;
++ map.m_pblk = 0;
+ map.m_next_pgofs = NULL;
+ map.m_next_extent = &m_next_extent;
+ map.m_seg_type = NO_CHECK_TYPE;
+--
+2.42.0
+
--- /dev/null
+From bc515231327d43f69b8fe263571cd88bcc15014c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 13:14:27 -0800
+Subject: filemap: add filemap_get_folios_tag()
+
+From: Vishal Moola (Oracle) <vishal.moola@gmail.com>
+
+[ Upstream commit 247f9e1feef4e57911510c8f82348efb4491ea0e ]
+
+This is the equivalent of find_get_pages_range_tag(), except for folios
+instead of pages.
+
+One noteable difference is filemap_get_folios_tag() does not take in a
+maximum pages argument. It instead tries to fill a folio batch and stops
+either once full (15 folios) or reaching the end of the search range.
+
+The new function supports large folios, the initial function did not since
+all callers don't use large folios.
+
+Link: https://lkml.kernel.org/r/20230104211448.4804-3-vishal.moola@gmail.com
+Signed-off-by: Vishal Moola (Oracle) <vishal.moola@gmail.com>
+Reviewed-by: Matthew Wilcow (Oracle) <willy@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: c5d3f9b7649a ("f2fs: compress: fix deadloop in f2fs_write_cache_pages()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pagemap.h | 2 ++
+ mm/filemap.c | 54 +++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 56 insertions(+)
+
+diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
+index bbccb40442224..03307b72de6c6 100644
+--- a/include/linux/pagemap.h
++++ b/include/linux/pagemap.h
+@@ -720,6 +720,8 @@ unsigned filemap_get_folios(struct address_space *mapping, pgoff_t *start,
+ pgoff_t end, struct folio_batch *fbatch);
+ unsigned filemap_get_folios_contig(struct address_space *mapping,
+ pgoff_t *start, pgoff_t end, struct folio_batch *fbatch);
++unsigned filemap_get_folios_tag(struct address_space *mapping, pgoff_t *start,
++ pgoff_t end, xa_mark_t tag, struct folio_batch *fbatch);
+ unsigned find_get_pages_range_tag(struct address_space *mapping, pgoff_t *index,
+ pgoff_t end, xa_mark_t tag, unsigned int nr_pages,
+ struct page **pages);
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 322aea78058a0..2d930470aacaa 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -2262,6 +2262,60 @@ unsigned filemap_get_folios_contig(struct address_space *mapping,
+ }
+ EXPORT_SYMBOL(filemap_get_folios_contig);
+
++/**
++ * filemap_get_folios_tag - Get a batch of folios matching @tag
++ * @mapping: The address_space to search
++ * @start: The starting page index
++ * @end: The final page index (inclusive)
++ * @tag: The tag index
++ * @fbatch: The batch to fill
++ *
++ * Same as filemap_get_folios(), but only returning folios tagged with @tag.
++ *
++ * Return: The number of folios found.
++ * Also update @start to index the next folio for traversal.
++ */
++unsigned filemap_get_folios_tag(struct address_space *mapping, pgoff_t *start,
++ pgoff_t end, xa_mark_t tag, struct folio_batch *fbatch)
++{
++ XA_STATE(xas, &mapping->i_pages, *start);
++ struct folio *folio;
++
++ rcu_read_lock();
++ while ((folio = find_get_entry(&xas, end, tag)) != NULL) {
++ /*
++ * Shadow entries should never be tagged, but this iteration
++ * is lockless so there is a window for page reclaim to evict
++ * a page we saw tagged. Skip over it.
++ */
++ if (xa_is_value(folio))
++ continue;
++ if (!folio_batch_add(fbatch, folio)) {
++ unsigned long nr = folio_nr_pages(folio);
++
++ if (folio_test_hugetlb(folio))
++ nr = 1;
++ *start = folio->index + nr;
++ goto out;
++ }
++ }
++ /*
++ * We come here when there is no page beyond @end. We take care to not
++ * overflow the index @start as it confuses some of the callers. This
++ * breaks the iteration when there is a page at index -1 but that is
++ * already broke anyway.
++ */
++ if (end == (pgoff_t)-1)
++ *start = (pgoff_t)-1;
++ else
++ *start = end + 1;
++out:
++ rcu_read_unlock();
++
++ return folio_batch_count(fbatch);
++}
++EXPORT_SYMBOL(filemap_get_folios_tag);
++
+ /**
+ * find_get_pages_range_tag - Find and return head pages matching @tag.
+ * @mapping: the address_space to search
+--
+2.42.0
+
--- /dev/null
+From eadfe8be8a47c35bba25938de1453ee15dd2d286 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Oct 2023 15:28:23 +0100
+Subject: firmware: arm_ffa: Allow the FF-A drivers to use 32bit mode of
+ messaging
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 2d698e8b4fd22374dac0a2d5150ab24d57a222ab ]
+
+An FF-A ABI could support both the SMC32 and SMC64 conventions.
+A callee that runs in the AArch64 execution state and implements such
+an ABI must implement both SMC32 and SMC64 conventions of the ABI.
+
+So the FF-A drivers will need the option to choose the mode irrespective
+of FF-A version and the partition execution mode flag in the partition
+information.
+
+Let us remove the check on the FF-A version for allowing the selection
+of 32bit mode of messaging. The driver will continue to set the 32-bit
+mode if the partition execution mode flag specified that the partition
+supports only 32-bit execution.
+
+Fixes: 106b11b1ccd5 ("firmware: arm_ffa: Set up 32bit execution mode flag using partiion property")
+Link: https://lore.kernel.org/r/20231005142823.278121-1-sudeep.holla@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_ffa/driver.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
+index 21481fc05800f..e9f86b7573012 100644
+--- a/drivers/firmware/arm_ffa/driver.c
++++ b/drivers/firmware/arm_ffa/driver.c
+@@ -668,17 +668,9 @@ static int ffa_partition_info_get(const char *uuid_str,
+ return 0;
+ }
+
+-static void _ffa_mode_32bit_set(struct ffa_device *dev)
+-{
+- dev->mode_32bit = true;
+-}
+-
+ static void ffa_mode_32bit_set(struct ffa_device *dev)
+ {
+- if (drv_info->version > FFA_VERSION_1_0)
+- return;
+-
+- _ffa_mode_32bit_set(dev);
++ dev->mode_32bit = true;
+ }
+
+ static int ffa_sync_send_receive(struct ffa_device *dev,
+@@ -787,7 +779,7 @@ static void ffa_setup_partitions(void)
+
+ if (drv_info->version > FFA_VERSION_1_0 &&
+ !(tpbuf->properties & FFA_PARTITION_AARCH64_EXEC))
+- _ffa_mode_32bit_set(ffa_dev);
++ ffa_mode_32bit_set(ffa_dev);
+ }
+ kfree(pbuf);
+ }
+--
+2.42.0
+
--- /dev/null
+From 81d1980caad699189e53096de0c316cc19a599c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 09:59:32 +0100
+Subject: firmware: arm_ffa: Assign the missing IDR allocation ID to the FFA
+ device
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 7d0bc6360f17ea323ab25939a34857123d7d87e5 ]
+
+Commit 19b8766459c4 ("firmware: arm_ffa: Fix FFA device names for logical
+partitions") added an ID to the FFA device using ida_alloc() and append
+the same to "arm-ffa" to make up a unique device name. However it missed
+to stash the id value in ffa_dev to help freeing the ID later when the
+device is destroyed.
+
+Due to the missing/unassigned ID in FFA device, we get the following
+warning when the FF-A device is unregistered.
+
+ | ida_free called for id=0 which is not allocated.
+ | WARNING: CPU: 7 PID: 1 at lib/idr.c:525 ida_free+0x114/0x164
+ | CPU: 7 PID: 1 Comm: swapper/0 Not tainted 6.6.0-rc4 #209
+ | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+ | pc : ida_free+0x114/0x164
+ | lr : ida_free+0x114/0x164
+ | Call trace:
+ | ida_free+0x114/0x164
+ | ffa_release_device+0x24/0x3c
+ | device_release+0x34/0x8c
+ | kobject_put+0x94/0xf8
+ | put_device+0x18/0x24
+ | klist_devices_put+0x14/0x20
+ | klist_next+0xc8/0x114
+ | bus_for_each_dev+0xd8/0x144
+ | arm_ffa_bus_exit+0x30/0x54
+ | ffa_init+0x68/0x330
+ | do_one_initcall+0xdc/0x250
+ | do_initcall_level+0x8c/0xac
+ | do_initcalls+0x54/0x94
+ | do_basic_setup+0x1c/0x28
+ | kernel_init_freeable+0x104/0x170
+ | kernel_init+0x20/0x1a0
+ | ret_from_fork+0x10/0x20
+
+Fix the same by actually assigning the ID in the FFA device this time
+for real.
+
+Fixes: 19b8766459c4 ("firmware: arm_ffa: Fix FFA device names for logical partitions")
+Link: https://lore.kernel.org/r/20231003085932.3553985-1-sudeep.holla@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_ffa/bus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/arm_ffa/bus.c b/drivers/firmware/arm_ffa/bus.c
+index b9ce784f087df..248594b59c64d 100644
+--- a/drivers/firmware/arm_ffa/bus.c
++++ b/drivers/firmware/arm_ffa/bus.c
+@@ -193,6 +193,7 @@ struct ffa_device *ffa_device_register(const uuid_t *uuid, int vm_id,
+ dev->release = ffa_release_device;
+ dev_set_name(&ffa_dev->dev, "arm-ffa-%d", id);
+
++ ffa_dev->id = id;
+ ffa_dev->vm_id = vm_id;
+ ffa_dev->ops = ops;
+ uuid_copy(&ffa_dev->uuid, uuid);
+--
+2.42.0
+
--- /dev/null
+From 03c799a5e7077ba522ddc572e2c68fb183c8d7f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 14:40:26 +0530
+Subject: firmware: ti_sci: Mark driver as non removable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit 7b7a224b1ba1703583b25a3641ad9798f34d832a ]
+
+The TI-SCI message protocol provides a way to communicate between
+various compute processors with a central system controller entity. It
+provides the fundamental device management capability and clock control
+in the SOCs that it's used in.
+
+The remove function failed to do all the necessary cleanup if
+there are registered users. Some things are freed however which
+likely results in an oops later on.
+
+Ensure that the driver isn't unbound by suppressing its bind and unbind
+sysfs attributes. As the driver is built-in there is no way to remove
+device once bound.
+
+We can also remove the ti_sci_remove call along with the
+ti_sci_debugfs_destroy as there are no callers for it any longer.
+
+Fixes: aa276781a64a ("firmware: Add basic support for TI System Control Interface (TI-SCI) protocol")
+Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Closes: https://lore.kernel.org/linux-arm-kernel/20230216083908.mvmydic5lpi3ogo7@pengutronix.de/
+Suggested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230921091025.133130-1-d-gole@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/ti_sci.c | 46 +--------------------------------------
+ 1 file changed, 1 insertion(+), 45 deletions(-)
+
+diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
+index 4c550cfbc086c..597d1a367d96d 100644
+--- a/drivers/firmware/ti_sci.c
++++ b/drivers/firmware/ti_sci.c
+@@ -190,19 +190,6 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
+ return 0;
+ }
+
+-/**
+- * ti_sci_debugfs_destroy() - clean up log debug file
+- * @pdev: platform device pointer
+- * @info: Pointer to SCI entity information
+- */
+-static void ti_sci_debugfs_destroy(struct platform_device *pdev,
+- struct ti_sci_info *info)
+-{
+- if (IS_ERR(info->debug_region))
+- return;
+-
+- debugfs_remove(info->d);
+-}
+ #else /* CONFIG_DEBUG_FS */
+ static inline int ti_sci_debugfs_create(struct platform_device *dev,
+ struct ti_sci_info *info)
+@@ -3451,43 +3438,12 @@ static int ti_sci_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-static int ti_sci_remove(struct platform_device *pdev)
+-{
+- struct ti_sci_info *info;
+- struct device *dev = &pdev->dev;
+- int ret = 0;
+-
+- of_platform_depopulate(dev);
+-
+- info = platform_get_drvdata(pdev);
+-
+- if (info->nb.notifier_call)
+- unregister_restart_handler(&info->nb);
+-
+- mutex_lock(&ti_sci_list_mutex);
+- if (info->users)
+- ret = -EBUSY;
+- else
+- list_del(&info->node);
+- mutex_unlock(&ti_sci_list_mutex);
+-
+- if (!ret) {
+- ti_sci_debugfs_destroy(pdev, info);
+-
+- /* Safe to free channels since no more users */
+- mbox_free_channel(info->chan_tx);
+- mbox_free_channel(info->chan_rx);
+- }
+-
+- return ret;
+-}
+-
+ static struct platform_driver ti_sci_driver = {
+ .probe = ti_sci_probe,
+- .remove = ti_sci_remove,
+ .driver = {
+ .name = "ti-sci",
+ .of_match_table = of_match_ptr(ti_sci_of_match),
++ .suppress_bind_attrs = true,
+ },
+ };
+ module_platform_driver(ti_sci_driver);
+--
+2.42.0
+
--- /dev/null
+From 3d9df2efae326d9470f0975980fd41ed04dd6406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 16:45:49 -0400
+Subject: futex: Don't include process MM in futex key on no-MMU
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+
+[ Upstream commit c73801ae4f22b390228ebf471d55668e824198b6 ]
+
+On no-MMU, all futexes are treated as private because there is no need
+to map a virtual address to physical to match the futex across
+processes. This doesn't quite work though, because private futexes
+include the current process's mm_struct as part of their key. This makes
+it impossible for one process to wake up a shared futex being waited on
+in another process.
+
+Fix this bug by excluding the mm_struct from the key. With
+a single address space, the futex address is already a unique key.
+
+Fixes: 784bdf3bb694 ("futex: Assume all mappings are private on !MMU systems")
+Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Darren Hart <dvhart@infradead.org>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: André Almeida <andrealmeid@igalia.com>
+Link: https://lore.kernel.org/r/20231019204548.1236437-2-ben.wolsieffer@hefring.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex/core.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/futex/core.c b/kernel/futex/core.c
+index 514e4582b8634..d4141b0547187 100644
+--- a/kernel/futex/core.c
++++ b/kernel/futex/core.c
+@@ -248,7 +248,17 @@ int get_futex_key(u32 __user *uaddr, bool fshared, union futex_key *key,
+ * but access_ok() should be faster than find_vma()
+ */
+ if (!fshared) {
+- key->private.mm = mm;
++ /*
++ * On no-MMU, shared futexes are treated as private, therefore
++ * we must not include the current process in the key. Since
++ * there is only one address space, the address is a unique key
++ * on its own.
++ */
++ if (IS_ENABLED(CONFIG_MMU))
++ key->private.mm = mm;
++ else
++ key->private.mm = NULL;
++
+ key->private.address = address;
+ return 0;
+ }
+--
+2.42.0
+
--- /dev/null
+From 873d4997bbf12cd315cf0e91f7d63a23e863d8f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 15:25:22 +0800
+Subject: genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()
+
+From: Chen Yu <yu.c.chen@intel.com>
+
+[ Upstream commit a0b0bad10587ae2948a7c36ca4ffc206007fbcf3 ]
+
+When a CPU is about to be offlined, x86 validates that all active
+interrupts which are targeted to this CPU can be migrated to the remaining
+online CPUs. If not, the offline operation is aborted.
+
+The validation uses irq_matrix_allocated() to retrieve the number of
+vectors which are allocated on the outgoing CPU. The returned number of
+allocated vectors includes also vectors which are associated to managed
+interrupts.
+
+That's overaccounting because managed interrupts are:
+
+ - not migrated when the affinity mask of the interrupt targets only
+ the outgoing CPU
+
+ - migrated to another CPU, but in that case the vector is already
+ pre-allocated on the potential target CPUs and must not be taken into
+ account.
+
+As a consequence the check whether the remaining online CPUs have enough
+capacity for migrating the allocated vectors from the outgoing CPU might
+fail incorrectly.
+
+Let irq_matrix_allocated() return only the number of allocated non-managed
+interrupts to make this validation check correct.
+
+[ tglx: Amend changelog and fixup kernel-doc comment ]
+
+Fixes: 2f75d9e1c905 ("genirq: Implement bitmap matrix allocator")
+Reported-by: Wendy Wang <wendy.wang@intel.com>
+Signed-off-by: Chen Yu <yu.c.chen@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20231020072522.557846-1-yu.c.chen@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/matrix.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
+index 1698e77645acf..75d0ae490e29c 100644
+--- a/kernel/irq/matrix.c
++++ b/kernel/irq/matrix.c
+@@ -466,16 +466,16 @@ unsigned int irq_matrix_reserved(struct irq_matrix *m)
+ }
+
+ /**
+- * irq_matrix_allocated - Get the number of allocated irqs on the local cpu
++ * irq_matrix_allocated - Get the number of allocated non-managed irqs on the local CPU
+ * @m: Pointer to the matrix to search
+ *
+- * This returns number of allocated irqs
++ * This returns number of allocated non-managed interrupts.
+ */
+ unsigned int irq_matrix_allocated(struct irq_matrix *m)
+ {
+ struct cpumap *cm = this_cpu_ptr(m->maps);
+
+- return cm->allocated;
++ return cm->allocated - cm->managed_allocated;
+ }
+
+ #ifdef CONFIG_GENERIC_IRQ_DEBUGFS
+--
+2.42.0
+
--- /dev/null
+From 080e26a2f78c35f64033ebf654d4aecf8a91a342 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Sep 2023 14:59:09 +0300
+Subject: gpu: host1x: Correct allocated size for contexts
+
+From: Johnny Liu <johnliu@nvidia.com>
+
+[ Upstream commit e889a311f74f4ae8bd40755a2c58d02e1c684fef ]
+
+Original implementation over allocates the memory size for the
+contexts list. The size of memory for the contexts list is based
+on the number of iommu groups specified in the device tree.
+
+Fixes: 8aa5bcb61612 ("gpu: host1x: Add context device management code")
+Signed-off-by: Johnny Liu <johnliu@nvidia.com>
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230901115910.701518-1-cyndis@kapsi.fi
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/context.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/host1x/context.c b/drivers/gpu/host1x/context.c
+index 047696432eb21..93c0c532fe5af 100644
+--- a/drivers/gpu/host1x/context.c
++++ b/drivers/gpu/host1x/context.c
+@@ -34,10 +34,10 @@ int host1x_memory_context_list_init(struct host1x *host1x)
+ if (err < 0)
+ return 0;
+
+- cdl->devs = kcalloc(err, sizeof(*cdl->devs), GFP_KERNEL);
++ cdl->len = err / 4;
++ cdl->devs = kcalloc(cdl->len, sizeof(*cdl->devs), GFP_KERNEL);
+ if (!cdl->devs)
+ return -ENOMEM;
+- cdl->len = err / 4;
+
+ for (i = 0; i < cdl->len; i++) {
+ struct iommu_fwspec *fwspec;
+--
+2.42.0
+
--- /dev/null
+From 4330c1784b128993c83ea129e38d4b55331b33df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 12:17:49 -0600
+Subject: gve: Use size_add() in call to struct_size()
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit d692873cbe861a870cdc9cbfb120eefd113c3dfd ]
+
+If, for any reason, `tx_stats_num + rx_stats_num` wraps around, the
+protection that struct_size() adds against potential integer overflows
+is defeated. Fix this by hardening call to struct_size() with size_add().
+
+Fixes: 691f4077d560 ("gve: Replace zero-length array with flexible-array member")
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/google/gve/gve_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
+index 2e5e0a8872704..d3f6ad586ba1b 100644
+--- a/drivers/net/ethernet/google/gve/gve_main.c
++++ b/drivers/net/ethernet/google/gve/gve_main.c
+@@ -139,7 +139,7 @@ static int gve_alloc_stats_report(struct gve_priv *priv)
+ rx_stats_num = (GVE_RX_STATS_REPORT_NUM + NIC_RX_STATS_REPORT_NUM) *
+ priv->rx_cfg.num_queues;
+ priv->stats_report_len = struct_size(priv->stats_report, stats,
+- tx_stats_num + rx_stats_num);
++ size_add(tx_stats_num, rx_stats_num));
+ priv->stats_report =
+ dma_alloc_coherent(&priv->pdev->dev, priv->stats_report_len,
+ &priv->stats_report_bus, GFP_KERNEL);
+--
+2.42.0
+
--- /dev/null
+From b4173af3be1db88f7072a0d6b9f36c8d45158e3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Sep 2023 16:22:45 -0500
+Subject: hid: cp2112: Fix duplicate workqueue initialization
+
+From: Danny Kaehn <danny.kaehn@plexus.com>
+
+[ Upstream commit e3c2d2d144c082dd71596953193adf9891491f42 ]
+
+Previously the cp2112 driver called INIT_DELAYED_WORK within
+cp2112_gpio_irq_startup, resulting in duplicate initilizations of the
+workqueue on subsequent IRQ startups following an initial request. This
+resulted in a warning in set_work_data in workqueue.c, as well as a rare
+NULL dereference within process_one_work in workqueue.c.
+
+Initialize the workqueue within _probe instead.
+
+Fixes: 13de9cca514e ("HID: cp2112: add IRQ chip handling")
+Signed-off-by: Danny Kaehn <danny.kaehn@plexus.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-cp2112.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
+index 27cadadda7c9d..86e0861caf7ca 100644
+--- a/drivers/hid/hid-cp2112.c
++++ b/drivers/hid/hid-cp2112.c
+@@ -1159,8 +1159,6 @@ static unsigned int cp2112_gpio_irq_startup(struct irq_data *d)
+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+ struct cp2112_device *dev = gpiochip_get_data(gc);
+
+- INIT_DELAYED_WORK(&dev->gpio_poll_worker, cp2112_gpio_poll_callback);
+-
+ if (!dev->gpio_poll) {
+ dev->gpio_poll = true;
+ schedule_delayed_work(&dev->gpio_poll_worker, 0);
+@@ -1356,6 +1354,8 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ girq->handler = handle_simple_irq;
+ girq->threaded = true;
+
++ INIT_DELAYED_WORK(&dev->gpio_poll_worker, cp2112_gpio_poll_callback);
++
+ ret = gpiochip_add_data(&dev->gc, dev);
+ if (ret < 0) {
+ hid_err(hdev, "error registering gpio chip\n");
+--
+2.42.0
+
--- /dev/null
+From 46fbe1b4474acba37441863ca80f81c3e821cc86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Oct 2023 13:23:17 -0500
+Subject: hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip
+
+From: Danny Kaehn <danny.kaehn@plexus.com>
+
+[ Upstream commit dc3115e6c5d9863ec1a9ff1acf004ede93c34361 ]
+
+Previously cp2112_gpio_irq_shutdown() always cancelled the
+gpio_poll_worker, even if other IRQs were still active, and did not set
+the gpio_poll flag to false. This resulted in any call to _shutdown()
+resulting in interrupts no longer functioning on the chip until a
+_remove() occurred (a.e. the cp2112 is unplugged or system rebooted).
+
+Only cancel polling if all IRQs are disabled/masked, and correctly set
+the gpio_poll flag, allowing polling to restart when an interrupt is
+next enabled.
+
+Signed-off-by: Danny Kaehn <danny.kaehn@plexus.com>
+Fixes: 13de9cca514e ("HID: cp2112: add IRQ chip handling")
+Link: https://lore.kernel.org/r/20231011182317.1053344-1-danny.kaehn@plexus.com
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-cp2112.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
+index 3e669a867e319..2770d964133d5 100644
+--- a/drivers/hid/hid-cp2112.c
++++ b/drivers/hid/hid-cp2112.c
+@@ -1177,7 +1177,11 @@ static void cp2112_gpio_irq_shutdown(struct irq_data *d)
+ struct cp2112_device *dev = gpiochip_get_data(gc);
+
+ cp2112_gpio_irq_mask(d);
+- cancel_delayed_work_sync(&dev->gpio_poll_worker);
++
++ if (!dev->irq_mask) {
++ dev->gpio_poll = false;
++ cancel_delayed_work_sync(&dev->gpio_poll_worker);
++ }
+ }
+
+ static int cp2112_gpio_irq_type(struct irq_data *d, unsigned int type)
+--
+2.42.0
+
--- /dev/null
+From 071657e9a0aa953fd6192712f15ed02efd626d77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 21:52:13 +0300
+Subject: HID: cp2112: Make irq_chip immutable
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 3e2977c425ad2789ca18084fff913cceacae75a2 ]
+
+Since recently, the kernel is nagging about mutable irq_chips:
+
+ "not an immutable chip, please consider fixing it!"
+
+Drop the unneeded copy, flag it as IRQCHIP_IMMUTABLE, add the new
+helper functions and call the appropriate gpiolib functions.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20230703185222.50554-4-andriy.shevchenko@linux.intel.com
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Stable-dep-of: dc3115e6c5d9 ("hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-cp2112.c | 33 ++++++++++++++++++++-------------
+ 1 file changed, 20 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
+index 86e0861caf7ca..3e669a867e319 100644
+--- a/drivers/hid/hid-cp2112.c
++++ b/drivers/hid/hid-cp2112.c
+@@ -163,7 +163,6 @@ struct cp2112_device {
+ atomic_t read_avail;
+ atomic_t xfer_avail;
+ struct gpio_chip gc;
+- struct irq_chip irq;
+ u8 *in_out_buffer;
+ struct mutex lock;
+
+@@ -1080,16 +1079,20 @@ static void cp2112_gpio_irq_mask(struct irq_data *d)
+ {
+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+ struct cp2112_device *dev = gpiochip_get_data(gc);
++ irq_hw_number_t hwirq = irqd_to_hwirq(d);
+
+- __clear_bit(d->hwirq, &dev->irq_mask);
++ __clear_bit(hwirq, &dev->irq_mask);
++ gpiochip_disable_irq(gc, hwirq);
+ }
+
+ static void cp2112_gpio_irq_unmask(struct irq_data *d)
+ {
+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+ struct cp2112_device *dev = gpiochip_get_data(gc);
++ irq_hw_number_t hwirq = irqd_to_hwirq(d);
+
+- __set_bit(d->hwirq, &dev->irq_mask);
++ gpiochip_enable_irq(gc, hwirq);
++ __set_bit(hwirq, &dev->irq_mask);
+ }
+
+ static void cp2112_gpio_poll_callback(struct work_struct *work)
+@@ -1173,6 +1176,7 @@ static void cp2112_gpio_irq_shutdown(struct irq_data *d)
+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+ struct cp2112_device *dev = gpiochip_get_data(gc);
+
++ cp2112_gpio_irq_mask(d);
+ cancel_delayed_work_sync(&dev->gpio_poll_worker);
+ }
+
+@@ -1226,6 +1230,18 @@ static int __maybe_unused cp2112_allocate_irq(struct cp2112_device *dev,
+ return ret;
+ }
+
++static const struct irq_chip cp2112_gpio_irqchip = {
++ .name = "cp2112-gpio",
++ .irq_startup = cp2112_gpio_irq_startup,
++ .irq_shutdown = cp2112_gpio_irq_shutdown,
++ .irq_ack = cp2112_gpio_irq_ack,
++ .irq_mask = cp2112_gpio_irq_mask,
++ .irq_unmask = cp2112_gpio_irq_unmask,
++ .irq_set_type = cp2112_gpio_irq_type,
++ .flags = IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_IMMUTABLE,
++ GPIOCHIP_IRQ_RESOURCE_HELPERS,
++};
++
+ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ {
+ struct cp2112_device *dev;
+@@ -1335,17 +1351,8 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ dev->gc.can_sleep = 1;
+ dev->gc.parent = &hdev->dev;
+
+- dev->irq.name = "cp2112-gpio";
+- dev->irq.irq_startup = cp2112_gpio_irq_startup;
+- dev->irq.irq_shutdown = cp2112_gpio_irq_shutdown;
+- dev->irq.irq_ack = cp2112_gpio_irq_ack;
+- dev->irq.irq_mask = cp2112_gpio_irq_mask;
+- dev->irq.irq_unmask = cp2112_gpio_irq_unmask;
+- dev->irq.irq_set_type = cp2112_gpio_irq_type;
+- dev->irq.flags = IRQCHIP_MASK_ON_SUSPEND;
+-
+ girq = &dev->gc.irq;
+- girq->chip = &dev->irq;
++ gpio_irq_chip_set_chip(girq, &cp2112_gpio_irqchip);
+ /* The event comes from the outside so no parent handler */
+ girq->parent_handler = NULL;
+ girq->num_parents = 0;
+--
+2.42.0
+
--- /dev/null
+From 8f7e421dcbef25703dddf0c20e01a341643f9406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Oct 2023 12:20:18 +0200
+Subject: HID: logitech-hidpp: Don't restart IO, instead defer hid_connect()
+ only
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 11ca0322a41920df2b462d2e45b0731e47ff475b ]
+
+Restarting IO causes 2 problems:
+
+1. Some devices do not like IO being restarted this was addressed in
+ commit 498ba2069035 ("HID: logitech-hidpp: Don't restart communication
+ if not necessary"), but that change has issues of its own and needs to
+ be reverted.
+
+2. Restarting IO and specifically calling hid_device_io_stop() causes
+ received packets to be missed, which may cause connect-events to
+ get missed.
+
+Restarting IO was introduced in commit 91cf9a98ae41 ("HID: logitech-hidpp:
+make .probe usbhid capable") to allow to retrieve the device's name and
+serial number and store these in hdev->name and hdev->uniq before
+connecting any hid subdrivers (hid-input, hidraw) exporting this info
+to userspace.
+
+But this does not require restarting IO, this merely requires deferring
+calling hid_connect(). Calling hid_hw_start() with a connect-mask of
+0 makes it skip calling hid_connect(), so hidpp_probe() can simply call
+hid_connect() later without needing to restart IO.
+
+Remove the stop + restart of IO and instead just call hid_connect() later
+to avoid the issues caused by restarting IO.
+
+Now that IO is no longer stopped, hid_hw_close() must be called at the end
+of probe() to balance the hid_hw_open() done at the beginning probe().
+
+This series has been tested on the following devices:
+Logitech Bluetooth Laser Travel Mouse (bluetooth, HID++ 1.0)
+Logitech M720 Triathlon (bluetooth, HID++ 4.5)
+Logitech M720 Triathlon (unifying, HID++ 4.5)
+Logitech K400 Pro (unifying, HID++ 4.1)
+Logitech K270 (eQUAD nano Lite, HID++ 2.0)
+Logitech M185 (eQUAD nano Lite, HID++ 4.5)
+Logitech LX501 keyboard (27 Mhz, HID++ builtin scroll-wheel, HID++ 1.0)
+Logitech M-RAZ105 mouse (27 Mhz, HID++ extra mouse buttons, HID++ 1.0)
+
+And by bentiss:
+Logitech Touchpad T650 (unifying)
+Logitech Touchpad T651 (bluetooth)
+Logitech MX Master 3B (BLE)
+Logitech G403 (plain USB / Gaming receiver)
+
+Fixes: 498ba2069035 ("HID: logitech-hidpp: Don't restart communication if not necessary")
+Suggested-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20231010102029.111003-2-hdegoede@redhat.com
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index fb9ce038bf684..d7e15989cb578 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -4208,8 +4208,10 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ hdev->name);
+
+ /*
+- * Plain USB connections need to actually call start and open
+- * on the transport driver to allow incoming data.
++ * First call hid_hw_start(hdev, 0) to allow IO without connecting any
++ * hid subdrivers (hid-input, hidraw). This allows retrieving the dev's
++ * name and serial number and store these in hdev->name and hdev->uniq,
++ * before the hid-input and hidraw drivers expose these to userspace.
+ */
+ ret = hid_hw_start(hdev, will_restart ? 0 : connect_mask);
+ if (ret) {
+@@ -4267,19 +4269,14 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ flush_work(&hidpp->work);
+
+ if (will_restart) {
+- /* Reset the HID node state */
+- hid_device_io_stop(hdev);
+- hid_hw_close(hdev);
+- hid_hw_stop(hdev);
+-
+ if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT)
+ connect_mask &= ~HID_CONNECT_HIDINPUT;
+
+ /* Now export the actual inputs and hidraw nodes to the world */
+- ret = hid_hw_start(hdev, connect_mask);
++ ret = hid_connect(hdev, connect_mask);
+ if (ret) {
+- hid_err(hdev, "%s:hid_hw_start returned error\n", __func__);
+- goto hid_hw_start_fail;
++ hid_err(hdev, "%s:hid_connect returned error %d\n", __func__, ret);
++ goto hid_hw_init_fail;
+ }
+ }
+
+@@ -4291,6 +4288,11 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ ret);
+ }
+
++ /*
++ * This relies on logi_dj_ll_close() being a no-op so that DJ connection
++ * events will still be received.
++ */
++ hid_hw_close(hdev);
+ return ret;
+
+ hid_hw_init_fail:
+--
+2.42.0
+
--- /dev/null
+From b9f1bb84bb0df03c063d68b734e4a24082779233 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Oct 2023 12:20:20 +0200
+Subject: HID: logitech-hidpp: Move get_wireless_feature_index() check to
+ hidpp_connect_event()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit ba9de350509504fb748837b71e23d7e84c83d93c ]
+
+Calling get_wireless_feature_index() from probe() causes
+the wireless_feature_index to only get set for unifying devices which
+are already connected at probe() time. It does not get set for devices
+which connect later.
+
+Fix this by moving get_wireless_feature_index() to hidpp_connect_event(),
+this does not make a difference for devices connected at probe() since
+probe() will queue the hidpp_connect_event() for those at probe time.
+
+This series has been tested on the following devices:
+Logitech Bluetooth Laser Travel Mouse (bluetooth, HID++ 1.0)
+Logitech M720 Triathlon (bluetooth, HID++ 4.5)
+Logitech M720 Triathlon (unifying, HID++ 4.5)
+Logitech K400 Pro (unifying, HID++ 4.1)
+Logitech K270 (eQUAD nano Lite, HID++ 2.0)
+Logitech M185 (eQUAD nano Lite, HID++ 4.5)
+Logitech LX501 keyboard (27 Mhz, HID++ builtin scroll-wheel, HID++ 1.0)
+Logitech M-RAZ105 mouse (27 Mhz, HID++ extra mouse buttons, HID++ 1.0)
+
+And by bentiss:
+Logitech Touchpad T650 (unifying)
+Logitech Touchpad T651 (bluetooth)
+Logitech MX Master 3B (BLE)
+Logitech G403 (plain USB / Gaming receiver)
+
+Fixes: 0da0a63b7cba ("HID: logitech-hidpp: Support WirelessDeviceStatus connect events")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20231010102029.111003-4-hdegoede@redhat.com
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 2c212f835e8c5..fa1c7e07e220b 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -1757,15 +1757,14 @@ static int hidpp_battery_get_property(struct power_supply *psy,
+ /* -------------------------------------------------------------------------- */
+ #define HIDPP_PAGE_WIRELESS_DEVICE_STATUS 0x1d4b
+
+-static int hidpp_set_wireless_feature_index(struct hidpp_device *hidpp)
++static int hidpp_get_wireless_feature_index(struct hidpp_device *hidpp, u8 *feature_index)
+ {
+ u8 feature_type;
+ int ret;
+
+ ret = hidpp_root_get_feature(hidpp,
+ HIDPP_PAGE_WIRELESS_DEVICE_STATUS,
+- &hidpp->wireless_feature_index,
+- &feature_type);
++ feature_index, &feature_type);
+
+ return ret;
+ }
+@@ -3999,6 +3998,13 @@ static void hidpp_connect_event(struct hidpp_device *hidpp)
+ }
+ }
+
++ if (hidpp->protocol_major >= 2) {
++ u8 feature_index;
++
++ if (!hidpp_get_wireless_feature_index(hidpp, &feature_index))
++ hidpp->wireless_feature_index = feature_index;
++ }
++
+ if (hidpp->name == hdev->name && hidpp->protocol_major >= 2) {
+ name = hidpp_get_device_name(hidpp);
+ if (name) {
+@@ -4241,14 +4247,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ hidpp_overwrite_name(hdev);
+ }
+
+- if (connected && hidpp->protocol_major >= 2) {
+- ret = hidpp_set_wireless_feature_index(hidpp);
+- if (ret == -ENOENT)
+- hidpp->wireless_feature_index = 0;
+- else if (ret)
+- goto hid_hw_init_fail;
+- }
+-
+ if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) {
+ ret = wtp_get_config(hidpp);
+ if (ret)
+--
+2.42.0
+
--- /dev/null
+From 13264c14765d718ce1e9d303f0d41ead0d538e96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 13:17:23 +0100
+Subject: HID: logitech-hidpp: Remove HIDPP_QUIRK_NO_HIDINPUT quirk
+
+From: Bastien Nocera <hadess@hadess.net>
+
+[ Upstream commit d83956c8855c6c2ed4bd16cec4a5083d63df17e4 ]
+
+HIDPP_QUIRK_NO_HIDINPUT isn't used by any devices but still happens to
+work as HIDPP_QUIRK_DELAYED_INIT is defined to the same value. Remove
+HIDPP_QUIRK_NO_HIDINPUT and use HIDPP_QUIRK_DELAYED_INIT everywhere
+instead.
+
+Tested on a T650 which requires that quirk, and a number of unifying and
+Bluetooth devices that don't.
+
+Signed-off-by: Bastien Nocera <hadess@hadess.net>
+Link: https://lore.kernel.org/r/20230125121723.3122-2-hadess@hadess.net
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Stable-dep-of: 11ca0322a419 ("HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index d2772dfc4da6a..fb9ce038bf684 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -66,7 +66,7 @@ MODULE_PARM_DESC(disable_tap_to_click,
+ /* bits 2..20 are reserved for classes */
+ /* #define HIDPP_QUIRK_CONNECT_EVENTS BIT(21) disabled */
+ #define HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS BIT(22)
+-#define HIDPP_QUIRK_NO_HIDINPUT BIT(23)
++#define HIDPP_QUIRK_DELAYED_INIT BIT(23)
+ #define HIDPP_QUIRK_FORCE_OUTPUT_REPORTS BIT(24)
+ #define HIDPP_QUIRK_UNIFYING BIT(25)
+ #define HIDPP_QUIRK_HIDPP_WHEELS BIT(26)
+@@ -83,8 +83,6 @@ MODULE_PARM_DESC(disable_tap_to_click,
+ HIDPP_CAPABILITY_HIDPP20_HI_RES_SCROLL | \
+ HIDPP_CAPABILITY_HIDPP20_HI_RES_WHEEL)
+
+-#define HIDPP_QUIRK_DELAYED_INIT HIDPP_QUIRK_NO_HIDINPUT
+-
+ #define HIDPP_CAPABILITY_HIDPP10_BATTERY BIT(0)
+ #define HIDPP_CAPABILITY_HIDPP20_BATTERY BIT(1)
+ #define HIDPP_CAPABILITY_BATTERY_MILEAGE BIT(2)
+@@ -4039,7 +4037,7 @@ static void hidpp_connect_event(struct hidpp_device *hidpp)
+ if (hidpp->capabilities & HIDPP_CAPABILITY_HI_RES_SCROLL)
+ hi_res_scroll_enable(hidpp);
+
+- if (!(hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT) || hidpp->delayed_input)
++ if (!(hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT) || hidpp->delayed_input)
+ /* if the input nodes are already created, we can stop now */
+ return;
+
+@@ -4274,7 +4272,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ hid_hw_close(hdev);
+ hid_hw_stop(hdev);
+
+- if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT)
++ if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT)
+ connect_mask &= ~HID_CONNECT_HIDINPUT;
+
+ /* Now export the actual inputs and hidraw nodes to the world */
+--
+2.42.0
+
--- /dev/null
+From 761c0fe8bab6545c57a22c08693009d21ea0987a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Oct 2023 12:20:19 +0200
+Subject: HID: logitech-hidpp: Revert "Don't restart communication if not
+ necessary"
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 55bf70362ffc4ddd7c8745e2fe880edac00e4aff ]
+
+Commit 91cf9a98ae41 ("HID: logitech-hidpp: make .probe usbhid capable")
+makes hidpp_probe() first call hid_hw_start(hdev, 0) to allow IO
+without connecting any hid subdrivers (hid-input, hidraw).
+
+This is done to allow to retrieve the device's name and serial number
+and store these in hdev->name and hdev->uniq.
+
+Then later on IO was stopped and started again with hid_hw_start(hdev,
+HID_CONNECT_DEFAULT) connecting hid-input and hidraw after the name
+and serial number have been setup.
+
+Commit 498ba2069035 ("HID: logitech-hidpp: Don't restart communication
+if not necessary") changed the probe() code to only do the start with
+a 0 connect-mask + restart later for unifying devices.
+
+But for non unifying devices hdev->name and hdev->uniq are updated too.
+So this change re-introduces the problem for which the start with
+a 0 connect-mask + restart later behavior was introduced.
+
+The previous patch in this series changes the unifying path to instead of
+restarting IO only call hid_connect() later. This avoids possible issues
+with restarting IO seen on non unifying devices.
+
+Revert the change to limit the restart behavior to unifying devices to
+fix hdev->name changing after userspace facing devices have already been
+registered.
+
+This series has been tested on the following devices:
+Logitech Bluetooth Laser Travel Mouse (bluetooth, HID++ 1.0)
+Logitech M720 Triathlon (bluetooth, HID++ 4.5)
+Logitech M720 Triathlon (unifying, HID++ 4.5)
+Logitech K400 Pro (unifying, HID++ 4.1)
+Logitech K270 (eQUAD nano Lite, HID++ 2.0)
+Logitech M185 (eQUAD nano Lite, HID++ 4.5)
+Logitech LX501 keyboard (27 Mhz, HID++ builtin scroll-wheel, HID++ 1.0)
+Logitech M-RAZ105 mouse (27 Mhz, HID++ extra mouse buttons, HID++ 1.0)
+
+And by bentiss:
+Logitech Touchpad T650 (unifying)
+Logitech Touchpad T651 (bluetooth)
+Logitech MX Master 3B (BLE)
+Logitech G403 (plain USB / Gaming receiver)
+
+Fixes: 498ba2069035 ("HID: logitech-hidpp: Don't restart communication if not necessary")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20231010102029.111003-3-hdegoede@redhat.com
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 24 ++++++++----------------
+ 1 file changed, 8 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index d7e15989cb578..2c212f835e8c5 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -4142,7 +4142,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ bool connected;
+ unsigned int connect_mask = HID_CONNECT_DEFAULT;
+ struct hidpp_ff_private_data data;
+- bool will_restart = false;
+
+ /* report_fixup needs drvdata to be set before we call hid_parse */
+ hidpp = devm_kzalloc(&hdev->dev, sizeof(*hidpp), GFP_KERNEL);
+@@ -4193,10 +4192,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ return ret;
+ }
+
+- if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT ||
+- hidpp->quirks & HIDPP_QUIRK_UNIFYING)
+- will_restart = true;
+-
+ INIT_WORK(&hidpp->work, delayed_work_cb);
+ mutex_init(&hidpp->send_mutex);
+ init_waitqueue_head(&hidpp->wait);
+@@ -4213,7 +4208,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ * name and serial number and store these in hdev->name and hdev->uniq,
+ * before the hid-input and hidraw drivers expose these to userspace.
+ */
+- ret = hid_hw_start(hdev, will_restart ? 0 : connect_mask);
++ ret = hid_hw_start(hdev, 0);
+ if (ret) {
+ hid_err(hdev, "hw start failed\n");
+ goto hid_hw_start_fail;
+@@ -4252,7 +4247,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ hidpp->wireless_feature_index = 0;
+ else if (ret)
+ goto hid_hw_init_fail;
+- ret = 0;
+ }
+
+ if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) {
+@@ -4268,16 +4262,14 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ schedule_work(&hidpp->work);
+ flush_work(&hidpp->work);
+
+- if (will_restart) {
+- if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT)
+- connect_mask &= ~HID_CONNECT_HIDINPUT;
++ if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT)
++ connect_mask &= ~HID_CONNECT_HIDINPUT;
+
+- /* Now export the actual inputs and hidraw nodes to the world */
+- ret = hid_connect(hdev, connect_mask);
+- if (ret) {
+- hid_err(hdev, "%s:hid_connect returned error %d\n", __func__, ret);
+- goto hid_hw_init_fail;
+- }
++ /* Now export the actual inputs and hidraw nodes to the world */
++ ret = hid_connect(hdev, connect_mask);
++ if (ret) {
++ hid_err(hdev, "%s:hid_connect returned error %d\n", __func__, ret);
++ goto hid_hw_init_fail;
+ }
+
+ if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
+--
+2.42.0
+
--- /dev/null
+From e28a904c15b9a0c66f5b3dc5775f0cffd3c1712b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Oct 2023 00:53:28 -0700
+Subject: hte: tegra: Fix missing error code in tegra_hte_test_probe()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+[ Upstream commit b7c3ca3553d1de5e86c85636828e186d30cd0628 ]
+
+The value of 'ret' is zero when of_hte_req_count() fails to get number
+of entitties to timestamp. And returning success(zero) on this failure
+path is incorrect.
+
+Fixes: 9a75a7cd03c9 ("hte: Add Tegra HTE test driver")
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Reviewed-by: Dipen Patel <dipenp@nvidia.com>
+Signed-off-by: Dipen Patel <dipenp@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hte/hte-tegra194-test.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hte/hte-tegra194-test.c b/drivers/hte/hte-tegra194-test.c
+index ce8c44e792213..60f0ef2cb324f 100644
+--- a/drivers/hte/hte-tegra194-test.c
++++ b/drivers/hte/hte-tegra194-test.c
+@@ -154,8 +154,10 @@ static int tegra_hte_test_probe(struct platform_device *pdev)
+ }
+
+ cnt = of_hte_req_count(hte.pdev);
+- if (cnt < 0)
++ if (cnt < 0) {
++ ret = cnt;
+ goto free_irq;
++ }
+
+ dev_info(&pdev->dev, "Total requested lines:%d\n", cnt);
+
+--
+2.42.0
+
--- /dev/null
+From 3078467977856f70ca91e33a60b65367dbc42e54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Oct 2023 15:21:00 +0200
+Subject: hwmon: (axi-fan-control) Fix possible NULL pointer dereference
+
+From: Dragos Bogdan <dragos.bogdan@analog.com>
+
+[ Upstream commit 2a5b3370a1d9750eca325292e291c8c7cb8cf2e0 ]
+
+axi_fan_control_irq_handler(), dependent on the private
+axi_fan_control_data structure, might be called before the hwmon
+device is registered. That will cause an "Unable to handle kernel
+NULL pointer dereference" error.
+
+Fixes: 8412b410fa5e ("hwmon: Support ADI Fan Control IP")
+Signed-off-by: Dragos Bogdan <dragos.bogdan@analog.com>
+Signed-off-by: Nuno Sa <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20231025132100.649499-1-nuno.sa@analog.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/axi-fan-control.c | 29 ++++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/hwmon/axi-fan-control.c b/drivers/hwmon/axi-fan-control.c
+index 6724e0dd30880..25abf28084c96 100644
+--- a/drivers/hwmon/axi-fan-control.c
++++ b/drivers/hwmon/axi-fan-control.c
+@@ -496,6 +496,21 @@ static int axi_fan_control_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
++ ret = axi_fan_control_init(ctl, pdev->dev.of_node);
++ if (ret) {
++ dev_err(&pdev->dev, "Failed to initialize device\n");
++ return ret;
++ }
++
++ ctl->hdev = devm_hwmon_device_register_with_info(&pdev->dev,
++ name,
++ ctl,
++ &axi_chip_info,
++ axi_fan_control_groups);
++
++ if (IS_ERR(ctl->hdev))
++ return PTR_ERR(ctl->hdev);
++
+ ctl->irq = platform_get_irq(pdev, 0);
+ if (ctl->irq < 0)
+ return ctl->irq;
+@@ -509,19 +524,7 @@ static int axi_fan_control_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- ret = axi_fan_control_init(ctl, pdev->dev.of_node);
+- if (ret) {
+- dev_err(&pdev->dev, "Failed to initialize device\n");
+- return ret;
+- }
+-
+- ctl->hdev = devm_hwmon_device_register_with_info(&pdev->dev,
+- name,
+- ctl,
+- &axi_chip_info,
+- axi_fan_control_groups);
+-
+- return PTR_ERR_OR_ZERO(ctl->hdev);
++ return 0;
+ }
+
+ static struct platform_driver axi_fan_control_driver = {
+--
+2.42.0
+
--- /dev/null
+From 5152a28e9d082f32344427cedcecbc932c9175b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Oct 2023 20:23:16 +0800
+Subject: hwmon: (coretemp) Fix potentially truncated sysfs attribute name
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+[ Upstream commit bbfff736d30e5283ad09e748caff979d75ddef7f ]
+
+When build with W=1 and "-Werror=format-truncation", below error is
+observed in coretemp driver,
+
+ drivers/hwmon/coretemp.c: In function 'create_core_data':
+>> drivers/hwmon/coretemp.c:393:34: error: '%s' directive output may be truncated writing likely 5 or more bytes into a region of size between 3 and 13 [-Werror=format-truncation=]
+ 393 | "temp%d_%s", attr_no, suffixes[i]);
+ | ^~
+ drivers/hwmon/coretemp.c:393:26: note: assuming directive output of 5 bytes
+ 393 | "temp%d_%s", attr_no, suffixes[i]);
+ | ^~~~~~~~~~~
+ drivers/hwmon/coretemp.c:392:17: note: 'snprintf' output 7 or more bytes (assuming 22) into a destination of size 19
+ 392 | snprintf(tdata->attr_name[i], CORETEMP_NAME_LENGTH,
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ 393 | "temp%d_%s", attr_no, suffixes[i]);
+ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ cc1: all warnings being treated as errors
+
+Given that
+1. '%d' could take 10 charactors,
+2. '%s' could take 10 charactors ("crit_alarm"),
+3. "temp", "_" and the NULL terminator take 6 charactors,
+fix the problem by increasing CORETEMP_NAME_LENGTH to 28.
+
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Fixes: 7108b80a542b ("hwmon/coretemp: Handle large core ID value")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202310200443.iD3tUbbK-lkp@intel.com/
+Link: https://lore.kernel.org/r/20231025122316.836400-1-rui.zhang@intel.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/coretemp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index baaf8af4cb443..09aab5859fa75 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -41,7 +41,7 @@ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
+ #define PKG_SYSFS_ATTR_NO 1 /* Sysfs attribute for package temp */
+ #define BASE_SYSFS_ATTR_NO 2 /* Sysfs Base attr no for coretemp */
+ #define NUM_REAL_CORES 128 /* Number of Real cores per cpu */
+-#define CORETEMP_NAME_LENGTH 19 /* String Length of attrs */
++#define CORETEMP_NAME_LENGTH 28 /* String Length of attrs */
+ #define MAX_CORE_ATTRS 4 /* Maximum no of basic attrs */
+ #define TOTAL_ATTRS (MAX_CORE_ATTRS + 1)
+ #define MAX_CORE_DATA (NUM_REAL_CORES + BASE_SYSFS_ATTR_NO)
+--
+2.42.0
+
--- /dev/null
+From 7fa3f9d9eb4582e34c3a70d8457da819af397fcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 07:26:36 +0200
+Subject: hwmon: (sch5627) Disallow write access if virtual registers are
+ locked
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 7da8a635436029957c5350da3acf51d78ed64071 ]
+
+When the lock bit inside SCH5627_REG_CTRL is set, then the virtual
+registers become read-only until the next power cycle.
+Disallow write access to those registers in such a case.
+
+Tested on a Fujitsu Esprimo P720.
+
+Fixes: aa9f833dfc12 ("hwmon: (sch5627) Add pwmX_auto_channels_temp support")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20230907052639.16491-3-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sch5627.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hwmon/sch5627.c b/drivers/hwmon/sch5627.c
+index 87fc1fcf4ca3e..886386272b9f4 100644
+--- a/drivers/hwmon/sch5627.c
++++ b/drivers/hwmon/sch5627.c
+@@ -34,6 +34,7 @@
+ #define SCH5627_REG_CTRL 0x40
+
+ #define SCH5627_CTRL_START BIT(0)
++#define SCH5627_CTRL_LOCK BIT(1)
+ #define SCH5627_CTRL_VBAT BIT(4)
+
+ #define SCH5627_NO_TEMPS 8
+@@ -231,6 +232,14 @@ static int reg_to_rpm(u16 reg)
+ static umode_t sch5627_is_visible(const void *drvdata, enum hwmon_sensor_types type, u32 attr,
+ int channel)
+ {
++ const struct sch5627_data *data = drvdata;
++
++ /* Once the lock bit is set, the virtual registers become read-only
++ * until the next power cycle.
++ */
++ if (data->control & SCH5627_CTRL_LOCK)
++ return 0444;
++
+ if (type == hwmon_pwm && attr == hwmon_pwm_auto_channels_temp)
+ return 0644;
+
+--
+2.42.0
+
--- /dev/null
+From 299d86739deec95533d1c2916371efac9acc4eb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 07:26:35 +0200
+Subject: hwmon: (sch5627) Use bit macros when accessing the control register
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 7f0b28e0653f36b51542d25dd54ed312c397ecfc ]
+
+Use bit macros then accessing SCH5627_REG_CTRL, so that people
+do not need to look at the datasheet to find out what each bit
+does.
+
+Tested on a Fujitsu Esprimo P720.
+
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20230907052639.16491-2-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Stable-dep-of: 7da8a6354360 ("hwmon: (sch5627) Disallow write access if virtual registers are locked")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sch5627.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hwmon/sch5627.c b/drivers/hwmon/sch5627.c
+index 25fbbd4c9a2b3..87fc1fcf4ca3e 100644
+--- a/drivers/hwmon/sch5627.c
++++ b/drivers/hwmon/sch5627.c
+@@ -6,6 +6,7 @@
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
++#include <linux/bits.h>
+ #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/init.h>
+@@ -32,6 +33,9 @@
+ #define SCH5627_REG_PRIMARY_ID 0x3f
+ #define SCH5627_REG_CTRL 0x40
+
++#define SCH5627_CTRL_START BIT(0)
++#define SCH5627_CTRL_VBAT BIT(4)
++
+ #define SCH5627_NO_TEMPS 8
+ #define SCH5627_NO_FANS 4
+ #define SCH5627_NO_IN 5
+@@ -147,7 +151,8 @@ static int sch5627_update_in(struct sch5627_data *data)
+
+ /* Trigger a Vbat voltage measurement every 5 minutes */
+ if (time_after(jiffies, data->last_battery + 300 * HZ)) {
+- sch56xx_write_virtual_reg(data->addr, SCH5627_REG_CTRL, data->control | 0x10);
++ sch56xx_write_virtual_reg(data->addr, SCH5627_REG_CTRL,
++ data->control | SCH5627_CTRL_VBAT);
+ data->last_battery = jiffies;
+ }
+
+@@ -483,14 +488,13 @@ static int sch5627_probe(struct platform_device *pdev)
+ return val;
+
+ data->control = val;
+- if (!(data->control & 0x01)) {
++ if (!(data->control & SCH5627_CTRL_START)) {
+ pr_err("hardware monitoring not enabled\n");
+ return -ENODEV;
+ }
+ /* Trigger a Vbat voltage measurement, so that we get a valid reading
+ the first time we read Vbat */
+- sch56xx_write_virtual_reg(data->addr, SCH5627_REG_CTRL,
+- data->control | 0x10);
++ sch56xx_write_virtual_reg(data->addr, SCH5627_REG_CTRL, data->control | SCH5627_CTRL_VBAT);
+ data->last_battery = jiffies;
+
+ /*
+--
+2.42.0
+
--- /dev/null
+From f3727b92445327a501099636863cfaa8065b77b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 01:27:57 +0200
+Subject: hwrng: bcm2835 - Fix hwrng throughput regression
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit b58a36008bfa1aadf55f516bcbfae40c779eb54b ]
+
+The last RCU stall fix caused a massive throughput regression of the
+hwrng on Raspberry Pi 0 - 3. hwrng_msleep doesn't sleep precisely enough
+and usleep_range doesn't allow scheduling. So try to restore the
+best possible throughput by introducing hwrng_yield which interruptable
+sleeps for one jiffy.
+
+Some performance measurements on Raspberry Pi 3B+ (arm64/defconfig):
+
+sudo dd if=/dev/hwrng of=/dev/null count=1 bs=10000
+
+cpu_relax ~138025 Bytes / sec
+hwrng_msleep(1000) ~13 Bytes / sec
+hwrng_yield ~2510 Bytes / sec
+
+Fixes: 96cb9d055445 ("hwrng: bcm2835 - use hwrng_msleep() instead of cpu_relax()")
+Link: https://lore.kernel.org/linux-arm-kernel/bc97ece5-44a3-4c4e-77da-2db3eb66b128@gmx.net/
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/bcm2835-rng.c | 2 +-
+ drivers/char/hw_random/core.c | 6 ++++++
+ include/linux/hw_random.h | 1 +
+ 3 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c
+index e98fcac578d66..634eab4776f32 100644
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -71,7 +71,7 @@ static int bcm2835_rng_read(struct hwrng *rng, void *buf, size_t max,
+ while ((rng_readl(priv, RNG_STATUS) >> 24) == 0) {
+ if (!wait)
+ return 0;
+- hwrng_msleep(rng, 1000);
++ hwrng_yield(rng);
+ }
+
+ num_words = rng_readl(priv, RNG_STATUS) >> 24;
+diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
+index cc002b0c2f0c3..8f31f9d810305 100644
+--- a/drivers/char/hw_random/core.c
++++ b/drivers/char/hw_random/core.c
+@@ -680,6 +680,12 @@ long hwrng_msleep(struct hwrng *rng, unsigned int msecs)
+ }
+ EXPORT_SYMBOL_GPL(hwrng_msleep);
+
++long hwrng_yield(struct hwrng *rng)
++{
++ return wait_for_completion_interruptible_timeout(&rng->dying, 1);
++}
++EXPORT_SYMBOL_GPL(hwrng_yield);
++
+ static int __init hwrng_modinit(void)
+ {
+ int ret;
+diff --git a/include/linux/hw_random.h b/include/linux/hw_random.h
+index 77c2885c4c130..2505d58bd5829 100644
+--- a/include/linux/hw_random.h
++++ b/include/linux/hw_random.h
+@@ -63,5 +63,6 @@ extern void hwrng_unregister(struct hwrng *rng);
+ extern void devm_hwrng_unregister(struct device *dve, struct hwrng *rng);
+
+ extern long hwrng_msleep(struct hwrng *rng, unsigned int msecs);
++extern long hwrng_yield(struct hwrng *rng);
+
+ #endif /* LINUX_HWRANDOM_H_ */
+--
+2.42.0
+
--- /dev/null
+From 2b546e4cbe3a19c610480dfef8b76b82303bad8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Sep 2023 10:34:17 +0200
+Subject: hwrng: geode - fix accessing registers
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 464bd8ec2f06707f3773676a1bd2c64832a3c805 ]
+
+When the membase and pci_dev pointer were moved to a new struct in priv,
+the actual membase users were left untouched, and they started reading
+out arbitrary memory behind the struct instead of registers. This
+unfortunately turned the RNG into a constant number generator, depending
+on the content of what was at that offset.
+
+To fix this, update geode_rng_data_{read,present}() to also get the
+membase via amd_geode_priv, and properly read from the right addresses
+again.
+
+Fixes: 9f6ec8dc574e ("hwrng: geode - Fix PCI device refcount leak")
+Reported-by: Timur I. Davletshin <timur.davletshin@gmail.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217882
+Tested-by: Timur I. Davletshin <timur.davletshin@gmail.com>
+Suggested-by: Jo-Philipp Wich <jo@mein.io>
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/geode-rng.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c
+index 12fbe80918319..159baf00a8675 100644
+--- a/drivers/char/hw_random/geode-rng.c
++++ b/drivers/char/hw_random/geode-rng.c
+@@ -58,7 +58,8 @@ struct amd_geode_priv {
+
+ static int geode_rng_data_read(struct hwrng *rng, u32 *data)
+ {
+- void __iomem *mem = (void __iomem *)rng->priv;
++ struct amd_geode_priv *priv = (struct amd_geode_priv *)rng->priv;
++ void __iomem *mem = priv->membase;
+
+ *data = readl(mem + GEODE_RNG_DATA_REG);
+
+@@ -67,7 +68,8 @@ static int geode_rng_data_read(struct hwrng *rng, u32 *data)
+
+ static int geode_rng_data_present(struct hwrng *rng, int wait)
+ {
+- void __iomem *mem = (void __iomem *)rng->priv;
++ struct amd_geode_priv *priv = (struct amd_geode_priv *)rng->priv;
++ void __iomem *mem = priv->membase;
+ int data, i;
+
+ for (i = 0; i < 20; i++) {
+--
+2.42.0
+
--- /dev/null
+From 87d174607d6b92b1e676a463bbe1d5eed2510f5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 16:24:10 +0800
+Subject: i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit cab63f64887616e3c4e31cfd8103320be6ebc8d3 ]
+
+put_device() needs to be called on failure of device_register()
+to give up the reference initialized in it to avoid refcount leak.
+
+Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Link: https://lore.kernel.org/r/20230921082410.25548-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
+index 351c81a929a6c..ab0b5691b03e0 100644
+--- a/drivers/i3c/master.c
++++ b/drivers/i3c/master.c
+@@ -1508,9 +1508,11 @@ i3c_master_register_new_i3c_devs(struct i3c_master_controller *master)
+ desc->dev->dev.of_node = desc->boardinfo->of_node;
+
+ ret = device_register(&desc->dev->dev);
+- if (ret)
++ if (ret) {
+ dev_err(&master->dev,
+ "Failed to add I3C device (err = %d)\n", ret);
++ put_device(&desc->dev->dev);
++ }
+ }
+ }
+
+--
+2.42.0
+
--- /dev/null
+From f0960da1f56e6cdaf43617170332a605b9675e1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Sep 2023 14:42:01 +0200
+Subject: i40e: fix potential memory leaks in i40e_remove()
+
+From: Andrii Staikov <andrii.staikov@intel.com>
+
+[ Upstream commit 5ca636d927a106780451d957734f02589b972e2b ]
+
+Instead of freeing memory of a single VSI, make sure
+the memory for all VSIs is cleared before releasing VSIs.
+Add releasing of their resources in a loop with the iteration
+number equal to the number of allocated VSIs.
+
+Fixes: 41c445ff0f48 ("i40e: main driver core")
+Signed-off-by: Andrii Staikov <andrii.staikov@intel.com>
+Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 08ccf0024ce1a..68ee2c59692d1 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -16283,11 +16283,15 @@ static void i40e_remove(struct pci_dev *pdev)
+ i40e_switch_branch_release(pf->veb[i]);
+ }
+
+- /* Now we can shutdown the PF's VSI, just before we kill
++ /* Now we can shutdown the PF's VSIs, just before we kill
+ * adminq and hmc.
+ */
+- if (pf->vsi[pf->lan_vsi])
+- i40e_vsi_release(pf->vsi[pf->lan_vsi]);
++ for (i = pf->num_alloc_vsi; i--;)
++ if (pf->vsi[i]) {
++ i40e_vsi_close(pf->vsi[i]);
++ i40e_vsi_release(pf->vsi[i]);
++ pf->vsi[i] = NULL;
++ }
+
+ i40e_cloud_filter_exit(pf);
+
+--
+2.42.0
+
--- /dev/null
+From bc33dc569d16f5e1aa3bb729a4f9de303a5301de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Aug 2023 17:01:44 -0600
+Subject: iavf: Fix promiscuous mode configuration flow messages
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit 221465de6bd8090ab61267f019866e8d2dd4ea3d ]
+
+Currently when configuring promiscuous mode on the AVF we detect a
+change in the netdev->flags. We use IFF_PROMISC and IFF_ALLMULTI to
+determine whether or not we need to request/release promiscuous mode
+and/or multicast promiscuous mode. The problem is that the AQ calls for
+setting/clearing promiscuous/multicast mode are treated separately. This
+leads to a case where we can trigger two promiscuous mode AQ calls in
+a row with the incorrect state. To fix this make a few changes.
+
+Use IAVF_FLAG_AQ_CONFIGURE_PROMISC_MODE instead of the previous
+IAVF_FLAG_AQ_[REQUEST|RELEASE]_[PROMISC|ALLMULTI] flags.
+
+In iavf_set_rx_mode() detect if there is a change in the
+netdev->flags in comparison with adapter->flags and set the
+IAVF_FLAG_AQ_CONFIGURE_PROMISC_MODE aq_required bit. Then in
+iavf_process_aq_command() only check for IAVF_FLAG_CONFIGURE_PROMISC_MODE
+and call iavf_set_promiscuous() if it's set.
+
+In iavf_set_promiscuous() check again to see which (if any) promiscuous
+mode bits have changed when comparing the netdev->flags with the
+adapter->flags. Use this to set the flags which get sent to the PF
+driver.
+
+Add a spinlock that is used for updating current_netdev_promisc_flags
+and only allows one promiscuous mode AQ at a time.
+
+[1] Fixes the fact that we will only have one AQ call in the aq_required
+queue at any one time.
+
+[2] Streamlines the change in promiscuous mode to only set one AQ
+required bit.
+
+[3] This allows us to keep track of the current state of the flags and
+also makes it so we can take the most recent netdev->flags promiscuous
+mode state.
+
+[4] This fixes the problem where a change in the netdev->flags can cause
+IAVF_FLAG_AQ_CONFIGURE_PROMISC_MODE to be set in iavf_set_rx_mode(),
+but cleared in iavf_set_promiscuous() before the change is ever made via
+AQ call.
+
+Fixes: 47d3483988f6 ("i40evf: Add driver support for promiscuous mode")
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Signed-off-by: Ahmed Zaki <ahmed.zaki@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf.h | 16 ++--
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 43 +++++------
+ .../net/ethernet/intel/iavf/iavf_virtchnl.c | 75 ++++++++++++-------
+ 3 files changed, 74 insertions(+), 60 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h
+index 06cfd567866c2..7389855fa307a 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf.h
++++ b/drivers/net/ethernet/intel/iavf/iavf.h
+@@ -298,8 +298,6 @@ struct iavf_adapter {
+ #define IAVF_FLAG_CLIENT_NEEDS_OPEN BIT(10)
+ #define IAVF_FLAG_CLIENT_NEEDS_CLOSE BIT(11)
+ #define IAVF_FLAG_CLIENT_NEEDS_L2_PARAMS BIT(12)
+-#define IAVF_FLAG_PROMISC_ON BIT(13)
+-#define IAVF_FLAG_ALLMULTI_ON BIT(14)
+ #define IAVF_FLAG_LEGACY_RX BIT(15)
+ #define IAVF_FLAG_REINIT_ITR_NEEDED BIT(16)
+ #define IAVF_FLAG_QUEUES_DISABLED BIT(17)
+@@ -325,10 +323,7 @@ struct iavf_adapter {
+ #define IAVF_FLAG_AQ_SET_HENA BIT_ULL(12)
+ #define IAVF_FLAG_AQ_SET_RSS_KEY BIT_ULL(13)
+ #define IAVF_FLAG_AQ_SET_RSS_LUT BIT_ULL(14)
+-#define IAVF_FLAG_AQ_REQUEST_PROMISC BIT_ULL(15)
+-#define IAVF_FLAG_AQ_RELEASE_PROMISC BIT_ULL(16)
+-#define IAVF_FLAG_AQ_REQUEST_ALLMULTI BIT_ULL(17)
+-#define IAVF_FLAG_AQ_RELEASE_ALLMULTI BIT_ULL(18)
++#define IAVF_FLAG_AQ_CONFIGURE_PROMISC_MODE BIT_ULL(15)
+ #define IAVF_FLAG_AQ_ENABLE_VLAN_STRIPPING BIT_ULL(19)
+ #define IAVF_FLAG_AQ_DISABLE_VLAN_STRIPPING BIT_ULL(20)
+ #define IAVF_FLAG_AQ_ENABLE_CHANNELS BIT_ULL(21)
+@@ -365,6 +360,12 @@ struct iavf_adapter {
+ (IAVF_EXTENDED_CAP_SEND_VLAN_V2 | \
+ IAVF_EXTENDED_CAP_RECV_VLAN_V2)
+
++ /* Lock to prevent possible clobbering of
++ * current_netdev_promisc_flags
++ */
++ spinlock_t current_netdev_promisc_flags_lock;
++ netdev_features_t current_netdev_promisc_flags;
++
+ /* OS defined structs */
+ struct net_device *netdev;
+ struct pci_dev *pdev;
+@@ -551,7 +552,8 @@ void iavf_add_ether_addrs(struct iavf_adapter *adapter);
+ void iavf_del_ether_addrs(struct iavf_adapter *adapter);
+ void iavf_add_vlans(struct iavf_adapter *adapter);
+ void iavf_del_vlans(struct iavf_adapter *adapter);
+-void iavf_set_promiscuous(struct iavf_adapter *adapter, int flags);
++void iavf_set_promiscuous(struct iavf_adapter *adapter);
++bool iavf_promiscuous_mode_changed(struct iavf_adapter *adapter);
+ void iavf_request_stats(struct iavf_adapter *adapter);
+ int iavf_request_reset(struct iavf_adapter *adapter);
+ void iavf_get_hena(struct iavf_adapter *adapter);
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index 326bb5fdf5f90..4836bac2bd09d 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -1198,6 +1198,16 @@ static int iavf_addr_unsync(struct net_device *netdev, const u8 *addr)
+ return 0;
+ }
+
++/**
++ * iavf_promiscuous_mode_changed - check if promiscuous mode bits changed
++ * @adapter: device specific adapter
++ */
++bool iavf_promiscuous_mode_changed(struct iavf_adapter *adapter)
++{
++ return (adapter->current_netdev_promisc_flags ^ adapter->netdev->flags) &
++ (IFF_PROMISC | IFF_ALLMULTI);
++}
++
+ /**
+ * iavf_set_rx_mode - NDO callback to set the netdev filters
+ * @netdev: network interface device structure
+@@ -1211,19 +1221,10 @@ static void iavf_set_rx_mode(struct net_device *netdev)
+ __dev_mc_sync(netdev, iavf_addr_sync, iavf_addr_unsync);
+ spin_unlock_bh(&adapter->mac_vlan_list_lock);
+
+- if (netdev->flags & IFF_PROMISC &&
+- !(adapter->flags & IAVF_FLAG_PROMISC_ON))
+- adapter->aq_required |= IAVF_FLAG_AQ_REQUEST_PROMISC;
+- else if (!(netdev->flags & IFF_PROMISC) &&
+- adapter->flags & IAVF_FLAG_PROMISC_ON)
+- adapter->aq_required |= IAVF_FLAG_AQ_RELEASE_PROMISC;
+-
+- if (netdev->flags & IFF_ALLMULTI &&
+- !(adapter->flags & IAVF_FLAG_ALLMULTI_ON))
+- adapter->aq_required |= IAVF_FLAG_AQ_REQUEST_ALLMULTI;
+- else if (!(netdev->flags & IFF_ALLMULTI) &&
+- adapter->flags & IAVF_FLAG_ALLMULTI_ON)
+- adapter->aq_required |= IAVF_FLAG_AQ_RELEASE_ALLMULTI;
++ spin_lock_bh(&adapter->current_netdev_promisc_flags_lock);
++ if (iavf_promiscuous_mode_changed(adapter))
++ adapter->aq_required |= IAVF_FLAG_AQ_CONFIGURE_PROMISC_MODE;
++ spin_unlock_bh(&adapter->current_netdev_promisc_flags_lock);
+ }
+
+ /**
+@@ -2174,19 +2175,8 @@ static int iavf_process_aq_command(struct iavf_adapter *adapter)
+ return 0;
+ }
+
+- if (adapter->aq_required & IAVF_FLAG_AQ_REQUEST_PROMISC) {
+- iavf_set_promiscuous(adapter, FLAG_VF_UNICAST_PROMISC |
+- FLAG_VF_MULTICAST_PROMISC);
+- return 0;
+- }
+-
+- if (adapter->aq_required & IAVF_FLAG_AQ_REQUEST_ALLMULTI) {
+- iavf_set_promiscuous(adapter, FLAG_VF_MULTICAST_PROMISC);
+- return 0;
+- }
+- if ((adapter->aq_required & IAVF_FLAG_AQ_RELEASE_PROMISC) ||
+- (adapter->aq_required & IAVF_FLAG_AQ_RELEASE_ALLMULTI)) {
+- iavf_set_promiscuous(adapter, 0);
++ if (adapter->aq_required & IAVF_FLAG_AQ_CONFIGURE_PROMISC_MODE) {
++ iavf_set_promiscuous(adapter);
+ return 0;
+ }
+
+@@ -5008,6 +4998,7 @@ static int iavf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ spin_lock_init(&adapter->cloud_filter_list_lock);
+ spin_lock_init(&adapter->fdir_fltr_lock);
+ spin_lock_init(&adapter->adv_rss_lock);
++ spin_lock_init(&adapter->current_netdev_promisc_flags_lock);
+
+ INIT_LIST_HEAD(&adapter->mac_filter_list);
+ INIT_LIST_HEAD(&adapter->vlan_filter_list);
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
+index 2fc8e60ef6afb..5a66b05c03222 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
+@@ -948,14 +948,14 @@ void iavf_del_vlans(struct iavf_adapter *adapter)
+ /**
+ * iavf_set_promiscuous
+ * @adapter: adapter structure
+- * @flags: bitmask to control unicast/multicast promiscuous.
+ *
+ * Request that the PF enable promiscuous mode for our VSI.
+ **/
+-void iavf_set_promiscuous(struct iavf_adapter *adapter, int flags)
++void iavf_set_promiscuous(struct iavf_adapter *adapter)
+ {
++ struct net_device *netdev = adapter->netdev;
+ struct virtchnl_promisc_info vpi;
+- int promisc_all;
++ unsigned int flags;
+
+ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+ /* bail because we already have a command pending */
+@@ -964,36 +964,57 @@ void iavf_set_promiscuous(struct iavf_adapter *adapter, int flags)
+ return;
+ }
+
+- promisc_all = FLAG_VF_UNICAST_PROMISC |
+- FLAG_VF_MULTICAST_PROMISC;
+- if ((flags & promisc_all) == promisc_all) {
+- adapter->flags |= IAVF_FLAG_PROMISC_ON;
+- adapter->aq_required &= ~IAVF_FLAG_AQ_REQUEST_PROMISC;
+- dev_info(&adapter->pdev->dev, "Entering promiscuous mode\n");
+- }
++ /* prevent changes to promiscuous flags */
++ spin_lock_bh(&adapter->current_netdev_promisc_flags_lock);
+
+- if (flags & FLAG_VF_MULTICAST_PROMISC) {
+- adapter->flags |= IAVF_FLAG_ALLMULTI_ON;
+- adapter->aq_required &= ~IAVF_FLAG_AQ_REQUEST_ALLMULTI;
+- dev_info(&adapter->pdev->dev, "%s is entering multicast promiscuous mode\n",
+- adapter->netdev->name);
++ /* sanity check to prevent duplicate AQ calls */
++ if (!iavf_promiscuous_mode_changed(adapter)) {
++ adapter->aq_required &= ~IAVF_FLAG_AQ_CONFIGURE_PROMISC_MODE;
++ dev_dbg(&adapter->pdev->dev, "No change in promiscuous mode\n");
++ /* allow changes to promiscuous flags */
++ spin_unlock_bh(&adapter->current_netdev_promisc_flags_lock);
++ return;
+ }
+
+- if (!flags) {
+- if (adapter->flags & IAVF_FLAG_PROMISC_ON) {
+- adapter->flags &= ~IAVF_FLAG_PROMISC_ON;
+- adapter->aq_required &= ~IAVF_FLAG_AQ_RELEASE_PROMISC;
+- dev_info(&adapter->pdev->dev, "Leaving promiscuous mode\n");
+- }
++ /* there are 2 bits, but only 3 states */
++ if (!(netdev->flags & IFF_PROMISC) &&
++ netdev->flags & IFF_ALLMULTI) {
++ /* State 1 - only multicast promiscuous mode enabled
++ * - !IFF_PROMISC && IFF_ALLMULTI
++ */
++ flags = FLAG_VF_MULTICAST_PROMISC;
++ adapter->current_netdev_promisc_flags |= IFF_ALLMULTI;
++ adapter->current_netdev_promisc_flags &= ~IFF_PROMISC;
++ dev_info(&adapter->pdev->dev, "Entering multicast promiscuous mode\n");
++ } else if (!(netdev->flags & IFF_PROMISC) &&
++ !(netdev->flags & IFF_ALLMULTI)) {
++ /* State 2 - unicast/multicast promiscuous mode disabled
++ * - !IFF_PROMISC && !IFF_ALLMULTI
++ */
++ flags = 0;
++ adapter->current_netdev_promisc_flags &=
++ ~(IFF_PROMISC | IFF_ALLMULTI);
++ dev_info(&adapter->pdev->dev, "Leaving promiscuous mode\n");
++ } else {
++ /* State 3 - unicast/multicast promiscuous mode enabled
++ * - IFF_PROMISC && IFF_ALLMULTI
++ * - IFF_PROMISC && !IFF_ALLMULTI
++ */
++ flags = FLAG_VF_UNICAST_PROMISC | FLAG_VF_MULTICAST_PROMISC;
++ adapter->current_netdev_promisc_flags |= IFF_PROMISC;
++ if (netdev->flags & IFF_ALLMULTI)
++ adapter->current_netdev_promisc_flags |= IFF_ALLMULTI;
++ else
++ adapter->current_netdev_promisc_flags &= ~IFF_ALLMULTI;
+
+- if (adapter->flags & IAVF_FLAG_ALLMULTI_ON) {
+- adapter->flags &= ~IAVF_FLAG_ALLMULTI_ON;
+- adapter->aq_required &= ~IAVF_FLAG_AQ_RELEASE_ALLMULTI;
+- dev_info(&adapter->pdev->dev, "%s is leaving multicast promiscuous mode\n",
+- adapter->netdev->name);
+- }
++ dev_info(&adapter->pdev->dev, "Entering promiscuous mode\n");
+ }
+
++ adapter->aq_required &= ~IAVF_FLAG_AQ_CONFIGURE_PROMISC_MODE;
++
++ /* allow changes to promiscuous flags */
++ spin_unlock_bh(&adapter->current_netdev_promisc_flags_lock);
++
+ adapter->current_op = VIRTCHNL_OP_CONFIG_PROMISCUOUS_MODE;
+ vpi.vsi_id = adapter->vsi_res->vsi_id;
+ vpi.flags = flags;
+--
+2.42.0
+
--- /dev/null
+From 111b0306725e2da55c2b3b375f4c468f83f7e683 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 13:01:58 -0500
+Subject: IB/mlx5: Fix init stage error handling to avoid double free of same
+ QP and UAF
+
+From: George Kennedy <george.kennedy@oracle.com>
+
+[ Upstream commit 2ef422f063b74adcc4a4a9004b0a87bb55e0a836 ]
+
+In the unlikely event that workqueue allocation fails and returns NULL in
+mlx5_mkey_cache_init(), delete the call to
+mlx5r_umr_resource_cleanup() (which frees the QP) in
+mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double
+free of the same QP when __mlx5_ib_add() does its cleanup.
+
+Resolves a splat:
+
+ Syzkaller reported a UAF in ib_destroy_qp_user
+
+ workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR
+ infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642):
+ failed to create work queue
+ infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642):
+ mr cache init failed -12
+ ==================================================================
+ BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073)
+ Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642
+
+ Call Trace:
+ <TASK>
+ kasan_report (mm/kasan/report.c:590)
+ ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073)
+ mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198)
+ __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178)
+ mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)
+ ...
+ </TASK>
+
+ Allocated by task 1642:
+ __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026
+ mm/slab_common.c:1039)
+ create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720
+ ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209)
+ ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347)
+ mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164)
+ mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070)
+ __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168)
+ mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)
+ ...
+
+ Freed by task 1642:
+ __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822)
+ ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112)
+ mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198)
+ mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076
+ drivers/infiniband/hw/mlx5/main.c:4065)
+ __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168)
+ mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)
+ ...
+
+Fixes: 04876c12c19e ("RDMA/mlx5: Move init and cleanup of UMR to umr.c")
+Link: https://lore.kernel.org/r/1698170518-4006-1-git-send-email-george.kennedy@oracle.com
+Suggested-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: George Kennedy <george.kennedy@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 0baf3b5518b46..bce31e28eb303 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -4027,10 +4027,8 @@ static int mlx5_ib_stage_post_ib_reg_umr_init(struct mlx5_ib_dev *dev)
+ return ret;
+
+ ret = mlx5_mkey_cache_init(dev);
+- if (ret) {
++ if (ret)
+ mlx5_ib_warn(dev, "mr cache init failed %d\n", ret);
+- mlx5r_umr_resource_cleanup(dev);
+- }
+ return ret;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From e809eeff6f83e80c82e255e0de547756004ed9a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2023 13:41:20 +0300
+Subject: IB/mlx5: Fix rdma counter binding for RAW QP
+
+From: Patrisious Haddad <phaddad@nvidia.com>
+
+[ Upstream commit c1336bb4aa5e809a622a87d74311275514086596 ]
+
+Previously when we had a RAW QP, we bound a counter to it when it moved
+to INIT state, using the counter context inside RQC.
+
+But when we try to modify that counter later in RTS state we used
+modify QP which tries to change the counter inside QPC instead of RQC.
+
+Now we correctly modify the counter set_id inside of RQC instead of QPC
+for the RAW QP.
+
+Fixes: d14133dd4161 ("IB/mlx5: Support set qp counter")
+Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
+Reviewed-by: Mark Zhang <markzhang@nvidia.com>
+Link: https://lore.kernel.org/r/2e5ab6713784a8fe997d19c508187a0dfecf2dfc.1696847964.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index ac53ed79ca64c..e0df3017e241a 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3960,6 +3960,30 @@ static unsigned int get_tx_affinity(struct ib_qp *qp,
+ return tx_affinity;
+ }
+
++static int __mlx5_ib_qp_set_raw_qp_counter(struct mlx5_ib_qp *qp, u32 set_id,
++ struct mlx5_core_dev *mdev)
++{
++ struct mlx5_ib_raw_packet_qp *raw_packet_qp = &qp->raw_packet_qp;
++ struct mlx5_ib_rq *rq = &raw_packet_qp->rq;
++ u32 in[MLX5_ST_SZ_DW(modify_rq_in)] = {};
++ void *rqc;
++
++ if (!qp->rq.wqe_cnt)
++ return 0;
++
++ MLX5_SET(modify_rq_in, in, rq_state, rq->state);
++ MLX5_SET(modify_rq_in, in, uid, to_mpd(qp->ibqp.pd)->uid);
++
++ rqc = MLX5_ADDR_OF(modify_rq_in, in, ctx);
++ MLX5_SET(rqc, rqc, state, MLX5_RQC_STATE_RDY);
++
++ MLX5_SET64(modify_rq_in, in, modify_bitmask,
++ MLX5_MODIFY_RQ_IN_MODIFY_BITMASK_RQ_COUNTER_SET_ID);
++ MLX5_SET(rqc, rqc, counter_set_id, set_id);
++
++ return mlx5_core_modify_rq(mdev, rq->base.mqp.qpn, in);
++}
++
+ static int __mlx5_ib_qp_set_counter(struct ib_qp *qp,
+ struct rdma_counter *counter)
+ {
+@@ -3975,6 +3999,9 @@ static int __mlx5_ib_qp_set_counter(struct ib_qp *qp,
+ else
+ set_id = mlx5_ib_get_counters_id(dev, mqp->port - 1);
+
++ if (mqp->type == IB_QPT_RAW_PACKET)
++ return __mlx5_ib_qp_set_raw_qp_counter(mqp, set_id, dev->mdev);
++
+ base = &mqp->trans_qp.base;
+ MLX5_SET(rts2rts_qp_in, in, opcode, MLX5_CMD_OP_RTS2RTS_QP);
+ MLX5_SET(rts2rts_qp_in, in, qpn, base->mqp.qpn);
+--
+2.42.0
+
--- /dev/null
+From 2f140a27eb75312525ef1a27ae33cfb94073c0fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 14:27:16 +0800
+Subject: iio: frequency: adf4350: Use device managed functions and fix power
+ down issue.
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 9979cc64853b598518a485c2e554657d5c7a00c8 ]
+
+The devm_clk_get_enabled() helper:
+ - calls devm_clk_get()
+ - calls clk_prepare_enable() and registers what is needed in order to
+ call clk_disable_unprepare() when needed, as a managed resource.
+
+Also replace devm_regulator_get() and regulator_enable() with
+devm_regulator_get_enable() helper and remove regulator_disable().
+
+Replace iio_device_register() with devm_iio_device_register() and remove
+iio_device_unregister().
+
+And st->reg is not used anymore, so remove it.
+
+As Jonathan pointed out, couple of things that are wrong:
+
+1) The device is powered down 'before' we unregister it with the
+ subsystem and as such userspace interfaces are still exposed which
+ probably won't do the right thing if the chip is powered down.
+
+2) This isn't done in the error paths in probe.
+
+To solve this problem, register a new callback adf4350_power_down()
+with devm_add_action_or_reset(), to enable software power down in both
+error and device detach path. So the remove function can be removed.
+
+Remove spi_set_drvdata() from the probe function, since spi_get_drvdata()
+is not used anymore.
+
+Fixes: e31166f0fd48 ("iio: frequency: New driver for Analog Devices ADF4350/ADF4351 Wideband Synthesizers")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://lore.kernel.org/r/20230828062717.2310219-1-ruanjinjie@huawei.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/frequency/adf4350.c | 75 ++++++++++-----------------------
+ 1 file changed, 23 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/iio/frequency/adf4350.c b/drivers/iio/frequency/adf4350.c
+index 85e289700c3c5..4abf80f75ef5d 100644
+--- a/drivers/iio/frequency/adf4350.c
++++ b/drivers/iio/frequency/adf4350.c
+@@ -33,7 +33,6 @@ enum {
+
+ struct adf4350_state {
+ struct spi_device *spi;
+- struct regulator *reg;
+ struct gpio_desc *lock_detect_gpiod;
+ struct adf4350_platform_data *pdata;
+ struct clk *clk;
+@@ -469,6 +468,15 @@ static struct adf4350_platform_data *adf4350_parse_dt(struct device *dev)
+ return pdata;
+ }
+
++static void adf4350_power_down(void *data)
++{
++ struct iio_dev *indio_dev = data;
++ struct adf4350_state *st = iio_priv(indio_dev);
++
++ st->regs[ADF4350_REG2] |= ADF4350_REG2_POWER_DOWN_EN;
++ adf4350_sync_config(st);
++}
++
+ static int adf4350_probe(struct spi_device *spi)
+ {
+ struct adf4350_platform_data *pdata;
+@@ -491,31 +499,21 @@ static int adf4350_probe(struct spi_device *spi)
+ }
+
+ if (!pdata->clkin) {
+- clk = devm_clk_get(&spi->dev, "clkin");
++ clk = devm_clk_get_enabled(&spi->dev, "clkin");
+ if (IS_ERR(clk))
+- return -EPROBE_DEFER;
+-
+- ret = clk_prepare_enable(clk);
+- if (ret < 0)
+- return ret;
++ return PTR_ERR(clk);
+ }
+
+ indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st));
+- if (indio_dev == NULL) {
+- ret = -ENOMEM;
+- goto error_disable_clk;
+- }
++ if (indio_dev == NULL)
++ return -ENOMEM;
+
+ st = iio_priv(indio_dev);
+
+- st->reg = devm_regulator_get(&spi->dev, "vcc");
+- if (!IS_ERR(st->reg)) {
+- ret = regulator_enable(st->reg);
+- if (ret)
+- goto error_disable_clk;
+- }
++ ret = devm_regulator_get_enable(&spi->dev, "vcc");
++ if (ret)
++ return ret;
+
+- spi_set_drvdata(spi, indio_dev);
+ st->spi = spi;
+ st->pdata = pdata;
+
+@@ -544,47 +542,21 @@ static int adf4350_probe(struct spi_device *spi)
+
+ st->lock_detect_gpiod = devm_gpiod_get_optional(&spi->dev, NULL,
+ GPIOD_IN);
+- if (IS_ERR(st->lock_detect_gpiod)) {
+- ret = PTR_ERR(st->lock_detect_gpiod);
+- goto error_disable_reg;
+- }
++ if (IS_ERR(st->lock_detect_gpiod))
++ return PTR_ERR(st->lock_detect_gpiod);
+
+ if (pdata->power_up_frequency) {
+ ret = adf4350_set_freq(st, pdata->power_up_frequency);
+ if (ret)
+- goto error_disable_reg;
++ return ret;
+ }
+
+- ret = iio_device_register(indio_dev);
++ ret = devm_add_action_or_reset(&spi->dev, adf4350_power_down, indio_dev);
+ if (ret)
+- goto error_disable_reg;
+-
+- return 0;
+-
+-error_disable_reg:
+- if (!IS_ERR(st->reg))
+- regulator_disable(st->reg);
+-error_disable_clk:
+- clk_disable_unprepare(clk);
+-
+- return ret;
+-}
+-
+-static void adf4350_remove(struct spi_device *spi)
+-{
+- struct iio_dev *indio_dev = spi_get_drvdata(spi);
+- struct adf4350_state *st = iio_priv(indio_dev);
+- struct regulator *reg = st->reg;
+-
+- st->regs[ADF4350_REG2] |= ADF4350_REG2_POWER_DOWN_EN;
+- adf4350_sync_config(st);
+-
+- iio_device_unregister(indio_dev);
+-
+- clk_disable_unprepare(st->clk);
++ return dev_err_probe(&spi->dev, ret,
++ "Failed to add action to managed power down\n");
+
+- if (!IS_ERR(reg))
+- regulator_disable(reg);
++ return devm_iio_device_register(&spi->dev, indio_dev);
+ }
+
+ static const struct of_device_id adf4350_of_match[] = {
+@@ -607,7 +579,6 @@ static struct spi_driver adf4350_driver = {
+ .of_match_table = adf4350_of_match,
+ },
+ .probe = adf4350_probe,
+- .remove = adf4350_remove,
+ .id_table = adf4350_id,
+ };
+ module_spi_driver(adf4350_driver);
+--
+2.42.0
+
--- /dev/null
+From 9c7a3998a4726fd574ae9ad587f5d2c907ceb53e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 02:29:26 +0200
+Subject: interconnect: move ignore_list out of of_count_icc_providers()
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 88387e21d224923eaa0074e3eef699a30f437e62 ]
+
+Move the const ignore_list definition out of the
+of_count_icc_providers() function. This prevents the following stack
+frame size warnings if the list is expanded:
+
+drivers/interconnect/core.c:1082:12: warning: stack frame size (1216) exceeds limit (1024) in 'of_count_icc_providers' [-Wframe-larger-than]
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230109002935.244320-4-dmitry.baryshkov@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Stable-dep-of: 7ed42176406e ("interconnect: qcom: sm8150: Set ACV enable_mask")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/core.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c
+index e4b2d9ef61b4d..e970ee0fcb0a3 100644
+--- a/drivers/interconnect/core.c
++++ b/drivers/interconnect/core.c
+@@ -1100,15 +1100,16 @@ void icc_provider_del(struct icc_provider *provider)
+ }
+ EXPORT_SYMBOL_GPL(icc_provider_del);
+
++static const struct of_device_id __maybe_unused ignore_list[] = {
++ { .compatible = "qcom,sc7180-ipa-virt" },
++ { .compatible = "qcom,sdx55-ipa-virt" },
++ {}
++};
++
+ static int of_count_icc_providers(struct device_node *np)
+ {
+ struct device_node *child;
+ int count = 0;
+- const struct of_device_id __maybe_unused ignore_list[] = {
+- { .compatible = "qcom,sc7180-ipa-virt" },
+- { .compatible = "qcom,sdx55-ipa-virt" },
+- {}
+- };
+
+ for_each_available_child_of_node(np, child) {
+ if (of_property_read_bool(child, "#interconnect-cells") &&
+--
+2.42.0
+
--- /dev/null
+From 75d4cc8d7ce461d7dddeb64bb76f81bd65026933 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Aug 2023 14:15:22 +0200
+Subject: interconnect: qcom: sc7180: Retire DEFINE_QBCM
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit e451b2ea5a11fb3f6d83e1f834ae6a5f55a02bba ]
+
+The struct definition macros are hard to read and compare, expand them.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Link: https://lore.kernel.org/r/20230811-topic-icc_retire_macrosd-v1-11-c03aaeffc769@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Stable-dep-of: 1ad83c479272 ("interconnect: qcom: sc7180: Set ACV enable_mask")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sc7180.c | 255 ++++++++++++++++++++++++++---
+ 1 file changed, 231 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/sc7180.c b/drivers/interconnect/qcom/sc7180.c
+index 82d5e8a8c19ea..a521b26758046 100644
+--- a/drivers/interconnect/qcom/sc7180.c
++++ b/drivers/interconnect/qcom/sc7180.c
+@@ -153,30 +153,237 @@ DEFINE_QNODE(srvc_snoc, SC7180_SLAVE_SERVICE_SNOC, 1, 4);
+ DEFINE_QNODE(xs_qdss_stm, SC7180_SLAVE_QDSS_STM, 1, 4);
+ DEFINE_QNODE(xs_sys_tcu_cfg, SC7180_SLAVE_TCU, 1, 8);
+
+-DEFINE_QBCM(bcm_acv, "ACV", false, &ebi);
+-DEFINE_QBCM(bcm_mc0, "MC0", true, &ebi);
+-DEFINE_QBCM(bcm_sh0, "SH0", true, &qns_llcc);
+-DEFINE_QBCM(bcm_mm0, "MM0", false, &qns_mem_noc_hf);
+-DEFINE_QBCM(bcm_ce0, "CE0", false, &qxm_crypto);
+-DEFINE_QBCM(bcm_cn0, "CN0", true, &qnm_snoc, &xm_qdss_dap, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_ahb2phy0, &qhs_aop, &qhs_aoss, &qhs_boot_rom, &qhs_camera_cfg, &qhs_camera_nrt_throttle_cfg, &qhs_camera_rt_throttle_cfg, &qhs_clk_ctl, &qhs_cpr_cx, &qhs_cpr_mx, &qhs_crypto0_cfg, &qhs_dcc_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_display_rt_throttle_cfg, &qhs_display_throttle_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_mss_cfg, &qhs_npu_cfg, &qhs_npu_dma_throttle_cfg, &qhs_npu_dsp_throttle_cfg, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qm_cfg, &qhs_qm_mpu_cfg, &qhs_qup0, &qhs_qup1, &qhs_security, &qhs_snoc_cfg, &qhs_tcsr, &qhs_tlmm_1, &qhs_tlmm_2, &qhs_tlmm_3, &qhs_ufs_mem_cfg, &qhs_usb3, &qhs_venus_cfg, &qhs_venus_throttle_cfg, &qhs_vsense_ctrl_cfg, &srvc_cnoc);
+-DEFINE_QBCM(bcm_mm1, "MM1", false, &qxm_camnoc_hf0_uncomp, &qxm_camnoc_hf1_uncomp, &qxm_camnoc_sf_uncomp, &qhm_mnoc_cfg, &qxm_mdp0, &qxm_rot, &qxm_venus0, &qxm_venus_arm9);
+-DEFINE_QBCM(bcm_sh2, "SH2", false, &acm_sys_tcu);
+-DEFINE_QBCM(bcm_mm2, "MM2", false, &qns_mem_noc_sf);
+-DEFINE_QBCM(bcm_qup0, "QUP0", false, &qup_core_master_1, &qup_core_master_2);
+-DEFINE_QBCM(bcm_sh3, "SH3", false, &qnm_cmpnoc);
+-DEFINE_QBCM(bcm_sh4, "SH4", false, &acm_apps0);
+-DEFINE_QBCM(bcm_sn0, "SN0", true, &qns_gemnoc_sf);
+-DEFINE_QBCM(bcm_co0, "CO0", false, &qns_cdsp_gemnoc);
+-DEFINE_QBCM(bcm_sn1, "SN1", false, &qxs_imem);
+-DEFINE_QBCM(bcm_cn1, "CN1", false, &qhm_qspi, &xm_sdc2, &xm_emmc, &qhs_ahb2phy2, &qhs_emmc_cfg, &qhs_pdm, &qhs_qspi, &qhs_sdc2);
+-DEFINE_QBCM(bcm_sn2, "SN2", false, &qxm_pimem, &qns_gemnoc_gc);
+-DEFINE_QBCM(bcm_co2, "CO2", false, &qnm_npu);
+-DEFINE_QBCM(bcm_sn3, "SN3", false, &qxs_pimem);
+-DEFINE_QBCM(bcm_co3, "CO3", false, &qxm_npu_dsp);
+-DEFINE_QBCM(bcm_sn4, "SN4", false, &xs_qdss_stm);
+-DEFINE_QBCM(bcm_sn7, "SN7", false, &qnm_aggre1_noc);
+-DEFINE_QBCM(bcm_sn9, "SN9", false, &qnm_aggre2_noc);
+-DEFINE_QBCM(bcm_sn12, "SN12", false, &qnm_gemnoc);
++static struct qcom_icc_bcm bcm_acv = {
++ .name = "ACV",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &ebi },
++};
++
++static struct qcom_icc_bcm bcm_mc0 = {
++ .name = "MC0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &ebi },
++};
++
++static struct qcom_icc_bcm bcm_sh0 = {
++ .name = "SH0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_llcc },
++};
++
++static struct qcom_icc_bcm bcm_mm0 = {
++ .name = "MM0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_mem_noc_hf },
++};
++
++static struct qcom_icc_bcm bcm_ce0 = {
++ .name = "CE0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxm_crypto },
++};
++
++static struct qcom_icc_bcm bcm_cn0 = {
++ .name = "CN0",
++ .keepalive = true,
++ .num_nodes = 48,
++ .nodes = { &qnm_snoc,
++ &xm_qdss_dap,
++ &qhs_a1_noc_cfg,
++ &qhs_a2_noc_cfg,
++ &qhs_ahb2phy0,
++ &qhs_aop,
++ &qhs_aoss,
++ &qhs_boot_rom,
++ &qhs_camera_cfg,
++ &qhs_camera_nrt_throttle_cfg,
++ &qhs_camera_rt_throttle_cfg,
++ &qhs_clk_ctl,
++ &qhs_cpr_cx,
++ &qhs_cpr_mx,
++ &qhs_crypto0_cfg,
++ &qhs_dcc_cfg,
++ &qhs_ddrss_cfg,
++ &qhs_display_cfg,
++ &qhs_display_rt_throttle_cfg,
++ &qhs_display_throttle_cfg,
++ &qhs_glm,
++ &qhs_gpuss_cfg,
++ &qhs_imem_cfg,
++ &qhs_ipa,
++ &qhs_mnoc_cfg,
++ &qhs_mss_cfg,
++ &qhs_npu_cfg,
++ &qhs_npu_dma_throttle_cfg,
++ &qhs_npu_dsp_throttle_cfg,
++ &qhs_pimem_cfg,
++ &qhs_prng,
++ &qhs_qdss_cfg,
++ &qhs_qm_cfg,
++ &qhs_qm_mpu_cfg,
++ &qhs_qup0,
++ &qhs_qup1,
++ &qhs_security,
++ &qhs_snoc_cfg,
++ &qhs_tcsr,
++ &qhs_tlmm_1,
++ &qhs_tlmm_2,
++ &qhs_tlmm_3,
++ &qhs_ufs_mem_cfg,
++ &qhs_usb3,
++ &qhs_venus_cfg,
++ &qhs_venus_throttle_cfg,
++ &qhs_vsense_ctrl_cfg,
++ &srvc_cnoc
++ },
++};
++
++static struct qcom_icc_bcm bcm_mm1 = {
++ .name = "MM1",
++ .keepalive = false,
++ .num_nodes = 8,
++ .nodes = { &qxm_camnoc_hf0_uncomp,
++ &qxm_camnoc_hf1_uncomp,
++ &qxm_camnoc_sf_uncomp,
++ &qhm_mnoc_cfg,
++ &qxm_mdp0,
++ &qxm_rot,
++ &qxm_venus0,
++ &qxm_venus_arm9
++ },
++};
++
++static struct qcom_icc_bcm bcm_sh2 = {
++ .name = "SH2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &acm_sys_tcu },
++};
++
++static struct qcom_icc_bcm bcm_mm2 = {
++ .name = "MM2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_mem_noc_sf },
++};
++
++static struct qcom_icc_bcm bcm_qup0 = {
++ .name = "QUP0",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &qup_core_master_1, &qup_core_master_2 },
++};
++
++static struct qcom_icc_bcm bcm_sh3 = {
++ .name = "SH3",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_cmpnoc },
++};
++
++static struct qcom_icc_bcm bcm_sh4 = {
++ .name = "SH4",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &acm_apps0 },
++};
++
++static struct qcom_icc_bcm bcm_sn0 = {
++ .name = "SN0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_gemnoc_sf },
++};
++
++static struct qcom_icc_bcm bcm_co0 = {
++ .name = "CO0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_cdsp_gemnoc },
++};
++
++static struct qcom_icc_bcm bcm_sn1 = {
++ .name = "SN1",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxs_imem },
++};
++
++static struct qcom_icc_bcm bcm_cn1 = {
++ .name = "CN1",
++ .keepalive = false,
++ .num_nodes = 8,
++ .nodes = { &qhm_qspi,
++ &xm_sdc2,
++ &xm_emmc,
++ &qhs_ahb2phy2,
++ &qhs_emmc_cfg,
++ &qhs_pdm,
++ &qhs_qspi,
++ &qhs_sdc2
++ },
++};
++
++static struct qcom_icc_bcm bcm_sn2 = {
++ .name = "SN2",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &qxm_pimem, &qns_gemnoc_gc },
++};
++
++static struct qcom_icc_bcm bcm_co2 = {
++ .name = "CO2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_npu },
++};
++
++static struct qcom_icc_bcm bcm_sn3 = {
++ .name = "SN3",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxs_pimem },
++};
++
++static struct qcom_icc_bcm bcm_co3 = {
++ .name = "CO3",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxm_npu_dsp },
++};
++
++static struct qcom_icc_bcm bcm_sn4 = {
++ .name = "SN4",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &xs_qdss_stm },
++};
++
++static struct qcom_icc_bcm bcm_sn7 = {
++ .name = "SN7",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_aggre1_noc },
++};
++
++static struct qcom_icc_bcm bcm_sn9 = {
++ .name = "SN9",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_aggre2_noc },
++};
++
++static struct qcom_icc_bcm bcm_sn12 = {
++ .name = "SN12",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_gemnoc },
++};
+
+ static struct qcom_icc_bcm * const aggre1_noc_bcms[] = {
+ &bcm_cn1,
+--
+2.42.0
+
--- /dev/null
+From 8f95ec839e918eeda3aace34f45c43ed2fa4a813 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 01:20:45 +0200
+Subject: interconnect: qcom: sc7180: Set ACV enable_mask
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 1ad83c4792722fe134c1352591420702ff7b9091 ]
+
+ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
+
+Fixes: 2d1f95ab9feb ("interconnect: qcom: Add SC7180 interconnect provider driver")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230811-topic-acv-v2-2-765ad70e539a@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sc7180.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sc7180.c b/drivers/interconnect/qcom/sc7180.c
+index a521b26758046..6d0450351a5a7 100644
+--- a/drivers/interconnect/qcom/sc7180.c
++++ b/drivers/interconnect/qcom/sc7180.c
+@@ -155,6 +155,7 @@ DEFINE_QNODE(xs_sys_tcu_cfg, SC7180_SLAVE_TCU, 1, 8);
+
+ static struct qcom_icc_bcm bcm_acv = {
+ .name = "ACV",
++ .enable_mask = BIT(3),
+ .keepalive = false,
+ .num_nodes = 1,
+ .nodes = { &ebi },
+--
+2.42.0
+
--- /dev/null
+From ae99215caf0258db120213fab3894d1af850bc8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 01:20:46 +0200
+Subject: interconnect: qcom: sc7280: Set ACV enable_mask
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 437b8e7fcd5df792cb8b8095e9f6eccefec6c099 ]
+
+ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
+
+Fixes: 46bdcac533cc ("interconnect: qcom: Add SC7280 interconnect provider driver")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230811-topic-acv-v2-3-765ad70e539a@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sc7280.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sc7280.c b/drivers/interconnect/qcom/sc7280.c
+index 971f538bc98ad..3c39edd21b6ca 100644
+--- a/drivers/interconnect/qcom/sc7280.c
++++ b/drivers/interconnect/qcom/sc7280.c
+@@ -1284,6 +1284,7 @@ static struct qcom_icc_node srvc_snoc = {
+
+ static struct qcom_icc_bcm bcm_acv = {
+ .name = "ACV",
++ .enable_mask = BIT(3),
+ .num_nodes = 1,
+ .nodes = { &ebi },
+ };
+--
+2.42.0
+
--- /dev/null
+From 7d86dce7d0905b1611539add43391683bc58a23f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 01:20:47 +0200
+Subject: interconnect: qcom: sc8180x: Set ACV enable_mask
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 0fcaaed3ff4b99e5b688b799f48989f1e4bb8a8b ]
+
+ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
+
+Fixes: 9c8c6bac1ae8 ("interconnect: qcom: Add SC8180x providers")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230811-topic-acv-v2-4-765ad70e539a@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sc8180x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sc8180x.c b/drivers/interconnect/qcom/sc8180x.c
+index 8e32ca958824c..83461e31774ec 100644
+--- a/drivers/interconnect/qcom/sc8180x.c
++++ b/drivers/interconnect/qcom/sc8180x.c
+@@ -1360,6 +1360,7 @@ static struct qcom_icc_node slv_qup_core_2 = {
+
+ static struct qcom_icc_bcm bcm_acv = {
+ .name = "ACV",
++ .enable_mask = BIT(3),
+ .num_nodes = 1,
+ .nodes = { &slv_ebi }
+ };
+--
+2.42.0
+
--- /dev/null
+From 7d6e6c5040771cd594ed89a3aef90ef7014c7e24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 01:20:48 +0200
+Subject: interconnect: qcom: sc8280xp: Set ACV enable_mask
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 688ffb3dcf85fc4b7ea82af842493013747a9e2c ]
+
+ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
+
+Fixes: f29dabda7917 ("interconnect: qcom: Add SC8280XP interconnect provider")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230811-topic-acv-v2-5-765ad70e539a@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sc8280xp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sc8280xp.c b/drivers/interconnect/qcom/sc8280xp.c
+index 507fe5f89791a..489f259a02e5b 100644
+--- a/drivers/interconnect/qcom/sc8280xp.c
++++ b/drivers/interconnect/qcom/sc8280xp.c
+@@ -1727,6 +1727,7 @@ static struct qcom_icc_node srvc_snoc = {
+
+ static struct qcom_icc_bcm bcm_acv = {
+ .name = "ACV",
++ .enable_mask = BIT(3),
+ .num_nodes = 1,
+ .nodes = { &ebi },
+ };
+--
+2.42.0
+
--- /dev/null
+From 94fd102ea62e8d8800ac611f4530c486134369c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Aug 2023 14:15:24 +0200
+Subject: interconnect: qcom: sdm845: Retire DEFINE_QBCM
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 35f490c5e4e833e81be464d89404b26ee20740ef ]
+
+The struct definition macros are hard to read and compare, expand them.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Link: https://lore.kernel.org/r/20230811-topic-icc_retire_macrosd-v1-13-c03aaeffc769@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Stable-dep-of: f8fe97a9fd20 ("interconnect: qcom: sdm845: Set ACV enable_mask")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sdm845.c | 277 ++++++++++++++++++++++++++---
+ 1 file changed, 249 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/sdm845.c b/drivers/interconnect/qcom/sdm845.c
+index 954e7bd13fc41..39ee54ffdb7ba 100644
+--- a/drivers/interconnect/qcom/sdm845.c
++++ b/drivers/interconnect/qcom/sdm845.c
+@@ -146,34 +146,255 @@ DEFINE_QNODE(srvc_snoc, SDM845_SLAVE_SERVICE_SNOC, 1, 4);
+ DEFINE_QNODE(xs_qdss_stm, SDM845_SLAVE_QDSS_STM, 1, 4);
+ DEFINE_QNODE(xs_sys_tcu_cfg, SDM845_SLAVE_TCU, 1, 8);
+
+-DEFINE_QBCM(bcm_acv, "ACV", false, &ebi);
+-DEFINE_QBCM(bcm_mc0, "MC0", true, &ebi);
+-DEFINE_QBCM(bcm_sh0, "SH0", true, &qns_llcc);
+-DEFINE_QBCM(bcm_mm0, "MM0", false, &qns_mem_noc_hf);
+-DEFINE_QBCM(bcm_sh1, "SH1", false, &qns_apps_io);
+-DEFINE_QBCM(bcm_mm1, "MM1", true, &qxm_camnoc_hf0_uncomp, &qxm_camnoc_hf1_uncomp, &qxm_camnoc_sf_uncomp, &qxm_camnoc_hf0, &qxm_camnoc_hf1, &qxm_mdp0, &qxm_mdp1);
+-DEFINE_QBCM(bcm_sh2, "SH2", false, &qns_memnoc_snoc);
+-DEFINE_QBCM(bcm_mm2, "MM2", false, &qns2_mem_noc);
+-DEFINE_QBCM(bcm_sh3, "SH3", false, &acm_tcu);
+-DEFINE_QBCM(bcm_mm3, "MM3", false, &qxm_camnoc_sf, &qxm_rot, &qxm_venus0, &qxm_venus1, &qxm_venus_arm9);
+-DEFINE_QBCM(bcm_sh5, "SH5", false, &qnm_apps);
+-DEFINE_QBCM(bcm_sn0, "SN0", true, &qns_memnoc_sf);
+-DEFINE_QBCM(bcm_ce0, "CE0", false, &qxm_crypto);
+-DEFINE_QBCM(bcm_cn0, "CN0", false, &qhm_spdm, &qhm_tic, &qnm_snoc, &xm_qdss_dap, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_aop, &qhs_aoss, &qhs_camera_cfg, &qhs_clk_ctl, &qhs_compute_dsp_cfg, &qhs_cpr_cx, &qhs_crypto0_cfg, &qhs_dcc_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_pcie0_cfg, &qhs_pcie_gen3_cfg, &qhs_pdm, &qhs_phy_refgen_south, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qupv3_north, &qhs_qupv3_south, &qhs_sdc2, &qhs_sdc4, &qhs_snoc_cfg, &qhs_spdm, &qhs_spss_cfg, &qhs_tcsr, &qhs_tlmm_north, &qhs_tlmm_south, &qhs_tsif, &qhs_ufs_card_cfg, &qhs_ufs_mem_cfg, &qhs_usb3_0, &qhs_usb3_1, &qhs_venus_cfg, &qhs_vsense_ctrl_cfg, &qns_cnoc_a2noc, &srvc_cnoc);
+-DEFINE_QBCM(bcm_qup0, "QUP0", false, &qhm_qup1, &qhm_qup2);
+-DEFINE_QBCM(bcm_sn1, "SN1", false, &qxs_imem);
+-DEFINE_QBCM(bcm_sn2, "SN2", false, &qns_memnoc_gc);
+-DEFINE_QBCM(bcm_sn3, "SN3", false, &qns_cnoc);
+-DEFINE_QBCM(bcm_sn4, "SN4", false, &qxm_pimem);
+-DEFINE_QBCM(bcm_sn5, "SN5", false, &xs_qdss_stm);
+-DEFINE_QBCM(bcm_sn6, "SN6", false, &qhs_apss, &srvc_snoc, &xs_sys_tcu_cfg);
+-DEFINE_QBCM(bcm_sn7, "SN7", false, &qxs_pcie);
+-DEFINE_QBCM(bcm_sn8, "SN8", false, &qxs_pcie_gen3);
+-DEFINE_QBCM(bcm_sn9, "SN9", false, &srvc_aggre1_noc, &qnm_aggre1_noc);
+-DEFINE_QBCM(bcm_sn11, "SN11", false, &srvc_aggre2_noc, &qnm_aggre2_noc);
+-DEFINE_QBCM(bcm_sn12, "SN12", false, &qnm_gladiator_sodv, &xm_gic);
+-DEFINE_QBCM(bcm_sn14, "SN14", false, &qnm_pcie_anoc);
+-DEFINE_QBCM(bcm_sn15, "SN15", false, &qnm_memnoc);
++static struct qcom_icc_bcm bcm_acv = {
++ .name = "ACV",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &ebi },
++};
++
++static struct qcom_icc_bcm bcm_mc0 = {
++ .name = "MC0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &ebi },
++};
++
++static struct qcom_icc_bcm bcm_sh0 = {
++ .name = "SH0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_llcc },
++};
++
++static struct qcom_icc_bcm bcm_mm0 = {
++ .name = "MM0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_mem_noc_hf },
++};
++
++static struct qcom_icc_bcm bcm_sh1 = {
++ .name = "SH1",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_apps_io },
++};
++
++static struct qcom_icc_bcm bcm_mm1 = {
++ .name = "MM1",
++ .keepalive = true,
++ .num_nodes = 7,
++ .nodes = { &qxm_camnoc_hf0_uncomp,
++ &qxm_camnoc_hf1_uncomp,
++ &qxm_camnoc_sf_uncomp,
++ &qxm_camnoc_hf0,
++ &qxm_camnoc_hf1,
++ &qxm_mdp0,
++ &qxm_mdp1
++ },
++};
++
++static struct qcom_icc_bcm bcm_sh2 = {
++ .name = "SH2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_memnoc_snoc },
++};
++
++static struct qcom_icc_bcm bcm_mm2 = {
++ .name = "MM2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns2_mem_noc },
++};
++
++static struct qcom_icc_bcm bcm_sh3 = {
++ .name = "SH3",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &acm_tcu },
++};
++
++static struct qcom_icc_bcm bcm_mm3 = {
++ .name = "MM3",
++ .keepalive = false,
++ .num_nodes = 5,
++ .nodes = { &qxm_camnoc_sf, &qxm_rot, &qxm_venus0, &qxm_venus1, &qxm_venus_arm9 },
++};
++
++static struct qcom_icc_bcm bcm_sh5 = {
++ .name = "SH5",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_apps },
++};
++
++static struct qcom_icc_bcm bcm_sn0 = {
++ .name = "SN0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_memnoc_sf },
++};
++
++static struct qcom_icc_bcm bcm_ce0 = {
++ .name = "CE0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxm_crypto },
++};
++
++static struct qcom_icc_bcm bcm_cn0 = {
++ .name = "CN0",
++ .keepalive = false,
++ .num_nodes = 47,
++ .nodes = { &qhm_spdm,
++ &qhm_tic,
++ &qnm_snoc,
++ &xm_qdss_dap,
++ &qhs_a1_noc_cfg,
++ &qhs_a2_noc_cfg,
++ &qhs_aop,
++ &qhs_aoss,
++ &qhs_camera_cfg,
++ &qhs_clk_ctl,
++ &qhs_compute_dsp_cfg,
++ &qhs_cpr_cx,
++ &qhs_crypto0_cfg,
++ &qhs_dcc_cfg,
++ &qhs_ddrss_cfg,
++ &qhs_display_cfg,
++ &qhs_glm,
++ &qhs_gpuss_cfg,
++ &qhs_imem_cfg,
++ &qhs_ipa,
++ &qhs_mnoc_cfg,
++ &qhs_pcie0_cfg,
++ &qhs_pcie_gen3_cfg,
++ &qhs_pdm,
++ &qhs_phy_refgen_south,
++ &qhs_pimem_cfg,
++ &qhs_prng,
++ &qhs_qdss_cfg,
++ &qhs_qupv3_north,
++ &qhs_qupv3_south,
++ &qhs_sdc2,
++ &qhs_sdc4,
++ &qhs_snoc_cfg,
++ &qhs_spdm,
++ &qhs_spss_cfg,
++ &qhs_tcsr,
++ &qhs_tlmm_north,
++ &qhs_tlmm_south,
++ &qhs_tsif,
++ &qhs_ufs_card_cfg,
++ &qhs_ufs_mem_cfg,
++ &qhs_usb3_0,
++ &qhs_usb3_1,
++ &qhs_venus_cfg,
++ &qhs_vsense_ctrl_cfg,
++ &qns_cnoc_a2noc,
++ &srvc_cnoc
++ },
++};
++
++static struct qcom_icc_bcm bcm_qup0 = {
++ .name = "QUP0",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &qhm_qup1, &qhm_qup2 },
++};
++
++static struct qcom_icc_bcm bcm_sn1 = {
++ .name = "SN1",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxs_imem },
++};
++
++static struct qcom_icc_bcm bcm_sn2 = {
++ .name = "SN2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_memnoc_gc },
++};
++
++static struct qcom_icc_bcm bcm_sn3 = {
++ .name = "SN3",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_cnoc },
++};
++
++static struct qcom_icc_bcm bcm_sn4 = {
++ .name = "SN4",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxm_pimem },
++};
++
++static struct qcom_icc_bcm bcm_sn5 = {
++ .name = "SN5",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &xs_qdss_stm },
++};
++
++static struct qcom_icc_bcm bcm_sn6 = {
++ .name = "SN6",
++ .keepalive = false,
++ .num_nodes = 3,
++ .nodes = { &qhs_apss, &srvc_snoc, &xs_sys_tcu_cfg },
++};
++
++static struct qcom_icc_bcm bcm_sn7 = {
++ .name = "SN7",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxs_pcie },
++};
++
++static struct qcom_icc_bcm bcm_sn8 = {
++ .name = "SN8",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxs_pcie_gen3 },
++};
++
++static struct qcom_icc_bcm bcm_sn9 = {
++ .name = "SN9",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &srvc_aggre1_noc, &qnm_aggre1_noc },
++};
++
++static struct qcom_icc_bcm bcm_sn11 = {
++ .name = "SN11",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &srvc_aggre2_noc, &qnm_aggre2_noc },
++};
++
++static struct qcom_icc_bcm bcm_sn12 = {
++ .name = "SN12",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &qnm_gladiator_sodv, &xm_gic },
++};
++
++static struct qcom_icc_bcm bcm_sn14 = {
++ .name = "SN14",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_pcie_anoc },
++};
++
++static struct qcom_icc_bcm bcm_sn15 = {
++ .name = "SN15",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_memnoc },
++};
+
+ static struct qcom_icc_bcm * const aggre1_noc_bcms[] = {
+ &bcm_sn9,
+--
+2.42.0
+
--- /dev/null
+From 8228104593229ecf520010641b074ad6af749928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 01:20:50 +0200
+Subject: interconnect: qcom: sdm845: Set ACV enable_mask
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit f8fe97a9fd2098de0570387029065eef657d50ee ]
+
+ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
+
+Fixes: b5d2f741077a ("interconnect: qcom: Add sdm845 interconnect provider driver")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230811-topic-acv-v2-7-765ad70e539a@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sdm845.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sdm845.c b/drivers/interconnect/qcom/sdm845.c
+index 39ee54ffdb7ba..02cf890684441 100644
+--- a/drivers/interconnect/qcom/sdm845.c
++++ b/drivers/interconnect/qcom/sdm845.c
+@@ -148,6 +148,7 @@ DEFINE_QNODE(xs_sys_tcu_cfg, SDM845_SLAVE_TCU, 1, 8);
+
+ static struct qcom_icc_bcm bcm_acv = {
+ .name = "ACV",
++ .enable_mask = BIT(3),
+ .keepalive = false,
+ .num_nodes = 1,
+ .nodes = { &ebi },
+--
+2.42.0
+
--- /dev/null
+From 0a5e4a39351fad5004c0a4e895183f8581c059f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Aug 2023 14:15:27 +0200
+Subject: interconnect: qcom: sm6350: Retire DEFINE_QBCM
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit ab2c1cb5740a7d2240b40b7b494700078db4eb13 ]
+
+The struct definition macros are hard to read and compare, expand them.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Link: https://lore.kernel.org/r/20230811-topic-icc_retire_macrosd-v1-16-c03aaeffc769@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Stable-dep-of: fe7a3abf4111 ("interconnect: qcom: sm6350: Set ACV enable_mask")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sm6350.c | 251 ++++++++++++++++++++++++++---
+ 1 file changed, 226 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/sm6350.c b/drivers/interconnect/qcom/sm6350.c
+index a3d46e59444e0..8a33a39f13260 100644
+--- a/drivers/interconnect/qcom/sm6350.c
++++ b/drivers/interconnect/qcom/sm6350.c
+@@ -142,31 +142,232 @@ DEFINE_QNODE(srvc_snoc, SM6350_SLAVE_SERVICE_SNOC, 1, 4);
+ DEFINE_QNODE(xs_qdss_stm, SM6350_SLAVE_QDSS_STM, 1, 4);
+ DEFINE_QNODE(xs_sys_tcu_cfg, SM6350_SLAVE_TCU, 1, 8);
+
+-DEFINE_QBCM(bcm_acv, "ACV", false, &ebi);
+-DEFINE_QBCM(bcm_ce0, "CE0", false, &qxm_crypto);
+-DEFINE_QBCM(bcm_cn0, "CN0", true, &qnm_snoc, &xm_qdss_dap, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_ahb2phy0, &qhs_aoss, &qhs_boot_rom, &qhs_camera_cfg, &qhs_camera_nrt_thrott_cfg, &qhs_camera_rt_throttle_cfg, &qhs_clk_ctl, &qhs_cpr_cx, &qhs_cpr_mx, &qhs_crypto0_cfg, &qhs_dcc_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_display_throttle_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_mss_cfg, &qhs_npu_cfg, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qm_cfg, &qhs_qm_mpu_cfg, &qhs_qup0, &qhs_qup1, &qhs_security, &qhs_snoc_cfg, &qhs_tcsr, &qhs_ufs_mem_cfg, &qhs_usb3_0, &qhs_venus_cfg, &qhs_venus_throttle_cfg, &qhs_vsense_ctrl_cfg, &srvc_cnoc);
+-DEFINE_QBCM(bcm_cn1, "CN1", false, &xm_emmc, &xm_sdc2, &qhs_ahb2phy2, &qhs_emmc_cfg, &qhs_pdm, &qhs_sdc2);
+-DEFINE_QBCM(bcm_co0, "CO0", false, &qns_cdsp_gemnoc);
+-DEFINE_QBCM(bcm_co2, "CO2", false, &qnm_npu);
+-DEFINE_QBCM(bcm_co3, "CO3", false, &qxm_npu_dsp);
+-DEFINE_QBCM(bcm_mc0, "MC0", true, &ebi);
+-DEFINE_QBCM(bcm_mm0, "MM0", true, &qns_mem_noc_hf);
+-DEFINE_QBCM(bcm_mm1, "MM1", true, &qxm_camnoc_hf0_uncomp, &qxm_camnoc_icp_uncomp, &qxm_camnoc_sf_uncomp, &qxm_camnoc_hf, &qxm_mdp0);
+-DEFINE_QBCM(bcm_mm2, "MM2", false, &qns_mem_noc_sf);
+-DEFINE_QBCM(bcm_mm3, "MM3", false, &qhm_mnoc_cfg, &qnm_video0, &qnm_video_cvp, &qxm_camnoc_sf);
+-DEFINE_QBCM(bcm_qup0, "QUP0", false, &qup0_core_master, &qup1_core_master, &qup0_core_slave, &qup1_core_slave);
+-DEFINE_QBCM(bcm_sh0, "SH0", true, &qns_llcc);
+-DEFINE_QBCM(bcm_sh2, "SH2", false, &acm_sys_tcu);
+-DEFINE_QBCM(bcm_sh3, "SH3", false, &qnm_cmpnoc);
+-DEFINE_QBCM(bcm_sh4, "SH4", false, &acm_apps);
+-DEFINE_QBCM(bcm_sn0, "SN0", true, &qns_gemnoc_sf);
+-DEFINE_QBCM(bcm_sn1, "SN1", false, &qxs_imem);
+-DEFINE_QBCM(bcm_sn2, "SN2", false, &qns_gemnoc_gc);
+-DEFINE_QBCM(bcm_sn3, "SN3", false, &qxs_pimem);
+-DEFINE_QBCM(bcm_sn4, "SN4", false, &xs_qdss_stm);
+-DEFINE_QBCM(bcm_sn5, "SN5", false, &qnm_aggre1_noc);
+-DEFINE_QBCM(bcm_sn6, "SN6", false, &qnm_aggre2_noc);
+-DEFINE_QBCM(bcm_sn10, "SN10", false, &qnm_gemnoc);
++static struct qcom_icc_bcm bcm_acv = {
++ .name = "ACV",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &ebi },
++};
++
++static struct qcom_icc_bcm bcm_ce0 = {
++ .name = "CE0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxm_crypto },
++};
++
++static struct qcom_icc_bcm bcm_cn0 = {
++ .name = "CN0",
++ .keepalive = true,
++ .num_nodes = 41,
++ .nodes = { &qnm_snoc,
++ &xm_qdss_dap,
++ &qhs_a1_noc_cfg,
++ &qhs_a2_noc_cfg,
++ &qhs_ahb2phy0,
++ &qhs_aoss,
++ &qhs_boot_rom,
++ &qhs_camera_cfg,
++ &qhs_camera_nrt_thrott_cfg,
++ &qhs_camera_rt_throttle_cfg,
++ &qhs_clk_ctl,
++ &qhs_cpr_cx,
++ &qhs_cpr_mx,
++ &qhs_crypto0_cfg,
++ &qhs_dcc_cfg,
++ &qhs_ddrss_cfg,
++ &qhs_display_cfg,
++ &qhs_display_throttle_cfg,
++ &qhs_glm,
++ &qhs_gpuss_cfg,
++ &qhs_imem_cfg,
++ &qhs_ipa,
++ &qhs_mnoc_cfg,
++ &qhs_mss_cfg,
++ &qhs_npu_cfg,
++ &qhs_pimem_cfg,
++ &qhs_prng,
++ &qhs_qdss_cfg,
++ &qhs_qm_cfg,
++ &qhs_qm_mpu_cfg,
++ &qhs_qup0,
++ &qhs_qup1,
++ &qhs_security,
++ &qhs_snoc_cfg,
++ &qhs_tcsr,
++ &qhs_ufs_mem_cfg,
++ &qhs_usb3_0,
++ &qhs_venus_cfg,
++ &qhs_venus_throttle_cfg,
++ &qhs_vsense_ctrl_cfg,
++ &srvc_cnoc
++ },
++};
++
++static struct qcom_icc_bcm bcm_cn1 = {
++ .name = "CN1",
++ .keepalive = false,
++ .num_nodes = 6,
++ .nodes = { &xm_emmc,
++ &xm_sdc2,
++ &qhs_ahb2phy2,
++ &qhs_emmc_cfg,
++ &qhs_pdm,
++ &qhs_sdc2
++ },
++};
++
++static struct qcom_icc_bcm bcm_co0 = {
++ .name = "CO0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_cdsp_gemnoc },
++};
++
++static struct qcom_icc_bcm bcm_co2 = {
++ .name = "CO2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_npu },
++};
++
++static struct qcom_icc_bcm bcm_co3 = {
++ .name = "CO3",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxm_npu_dsp },
++};
++
++static struct qcom_icc_bcm bcm_mc0 = {
++ .name = "MC0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &ebi },
++};
++
++static struct qcom_icc_bcm bcm_mm0 = {
++ .name = "MM0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_mem_noc_hf },
++};
++
++static struct qcom_icc_bcm bcm_mm1 = {
++ .name = "MM1",
++ .keepalive = true,
++ .num_nodes = 5,
++ .nodes = { &qxm_camnoc_hf0_uncomp,
++ &qxm_camnoc_icp_uncomp,
++ &qxm_camnoc_sf_uncomp,
++ &qxm_camnoc_hf,
++ &qxm_mdp0
++ },
++};
++
++static struct qcom_icc_bcm bcm_mm2 = {
++ .name = "MM2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_mem_noc_sf },
++};
++
++static struct qcom_icc_bcm bcm_mm3 = {
++ .name = "MM3",
++ .keepalive = false,
++ .num_nodes = 4,
++ .nodes = { &qhm_mnoc_cfg, &qnm_video0, &qnm_video_cvp, &qxm_camnoc_sf },
++};
++
++static struct qcom_icc_bcm bcm_qup0 = {
++ .name = "QUP0",
++ .keepalive = false,
++ .num_nodes = 4,
++ .nodes = { &qup0_core_master, &qup1_core_master, &qup0_core_slave, &qup1_core_slave },
++};
++
++static struct qcom_icc_bcm bcm_sh0 = {
++ .name = "SH0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_llcc },
++};
++
++static struct qcom_icc_bcm bcm_sh2 = {
++ .name = "SH2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &acm_sys_tcu },
++};
++
++static struct qcom_icc_bcm bcm_sh3 = {
++ .name = "SH3",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_cmpnoc },
++};
++
++static struct qcom_icc_bcm bcm_sh4 = {
++ .name = "SH4",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &acm_apps },
++};
++
++static struct qcom_icc_bcm bcm_sn0 = {
++ .name = "SN0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_gemnoc_sf },
++};
++
++static struct qcom_icc_bcm bcm_sn1 = {
++ .name = "SN1",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxs_imem },
++};
++
++static struct qcom_icc_bcm bcm_sn2 = {
++ .name = "SN2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_gemnoc_gc },
++};
++
++static struct qcom_icc_bcm bcm_sn3 = {
++ .name = "SN3",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxs_pimem },
++};
++
++static struct qcom_icc_bcm bcm_sn4 = {
++ .name = "SN4",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &xs_qdss_stm },
++};
++
++static struct qcom_icc_bcm bcm_sn5 = {
++ .name = "SN5",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_aggre1_noc },
++};
++
++static struct qcom_icc_bcm bcm_sn6 = {
++ .name = "SN6",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_aggre2_noc },
++};
++
++static struct qcom_icc_bcm bcm_sn10 = {
++ .name = "SN10",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_gemnoc },
++};
+
+ static struct qcom_icc_bcm * const aggre1_noc_bcms[] = {
+ &bcm_cn1,
+--
+2.42.0
+
--- /dev/null
+From 107119cd7af4a6989ac66bbb23db35ae4026bea1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 01:20:51 +0200
+Subject: interconnect: qcom: sm6350: Set ACV enable_mask
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit fe7a3abf4111992af3de51d22383a8e8a0affe1e ]
+
+ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
+
+Fixes: 6a6eff73a954 ("interconnect: qcom: Add SM6350 driver support")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230811-topic-acv-v2-8-765ad70e539a@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sm6350.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sm6350.c b/drivers/interconnect/qcom/sm6350.c
+index 8a33a39f13260..aae4b43b730c0 100644
+--- a/drivers/interconnect/qcom/sm6350.c
++++ b/drivers/interconnect/qcom/sm6350.c
+@@ -144,6 +144,7 @@ DEFINE_QNODE(xs_sys_tcu_cfg, SM6350_SLAVE_TCU, 1, 8);
+
+ static struct qcom_icc_bcm bcm_acv = {
+ .name = "ACV",
++ .enable_mask = BIT(3),
+ .keepalive = false,
+ .num_nodes = 1,
+ .nodes = { &ebi },
+--
+2.42.0
+
--- /dev/null
+From 4c875d109a4b075c22f0d0cdb425df60a8424cc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 02:29:27 +0200
+Subject: interconnect: qcom: sm8150: Drop IP0 interconnects
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a532439199369b86cf7323f84d1946b7d0634c53 ]
+
+Similar to the sdx55 and sc7180, let's drop the MASTER_IPA_CORE and
+SLAVE_IPA_CORE interconnects for this platform. There are no actual users
+of this interconnect. The IP0 resource will be handled by clk-rpmh
+driver.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230109002935.244320-5-dmitry.baryshkov@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Stable-dep-of: 7ed42176406e ("interconnect: qcom: sm8150: Set ACV enable_mask")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/core.c | 1 +
+ drivers/interconnect/qcom/sm8150.c | 21 ---------------------
+ drivers/interconnect/qcom/sm8150.h | 4 ++--
+ 3 files changed, 3 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c
+index e970ee0fcb0a3..0c6fc954e7296 100644
+--- a/drivers/interconnect/core.c
++++ b/drivers/interconnect/core.c
+@@ -1103,6 +1103,7 @@ EXPORT_SYMBOL_GPL(icc_provider_del);
+ static const struct of_device_id __maybe_unused ignore_list[] = {
+ { .compatible = "qcom,sc7180-ipa-virt" },
+ { .compatible = "qcom,sdx55-ipa-virt" },
++ { .compatible = "qcom,sm8150-ipa-virt" },
+ {}
+ };
+
+diff --git a/drivers/interconnect/qcom/sm8150.c b/drivers/interconnect/qcom/sm8150.c
+index 1d04a4bfea800..c5ab29322164a 100644
+--- a/drivers/interconnect/qcom/sm8150.c
++++ b/drivers/interconnect/qcom/sm8150.c
+@@ -56,7 +56,6 @@ DEFINE_QNODE(qnm_pcie, SM8150_MASTER_GEM_NOC_PCIE_SNOC, 1, 16, SM8150_SLAVE_LLCC
+ DEFINE_QNODE(qnm_snoc_gc, SM8150_MASTER_SNOC_GC_MEM_NOC, 1, 8, SM8150_SLAVE_LLCC);
+ DEFINE_QNODE(qnm_snoc_sf, SM8150_MASTER_SNOC_SF_MEM_NOC, 1, 16, SM8150_SLAVE_LLCC);
+ DEFINE_QNODE(qxm_ecc, SM8150_MASTER_ECC, 2, 32, SM8150_SLAVE_LLCC);
+-DEFINE_QNODE(ipa_core_master, SM8150_MASTER_IPA_CORE, 1, 8, SM8150_SLAVE_IPA_CORE);
+ DEFINE_QNODE(llcc_mc, SM8150_MASTER_LLCC, 4, 4, SM8150_SLAVE_EBI_CH0);
+ DEFINE_QNODE(qhm_mnoc_cfg, SM8150_MASTER_CNOC_MNOC_CFG, 1, 4, SM8150_SLAVE_SERVICE_MNOC);
+ DEFINE_QNODE(qxm_camnoc_hf0, SM8150_MASTER_CAMNOC_HF0, 1, 32, SM8150_SLAVE_MNOC_HF_MEM_NOC);
+@@ -139,7 +138,6 @@ DEFINE_QNODE(qns_ecc, SM8150_SLAVE_ECC, 1, 32);
+ DEFINE_QNODE(qns_gem_noc_snoc, SM8150_SLAVE_GEM_NOC_SNOC, 1, 8, SM8150_MASTER_GEM_NOC_SNOC);
+ DEFINE_QNODE(qns_llcc, SM8150_SLAVE_LLCC, 4, 16, SM8150_MASTER_LLCC);
+ DEFINE_QNODE(srvc_gemnoc, SM8150_SLAVE_SERVICE_GEM_NOC, 1, 4);
+-DEFINE_QNODE(ipa_core_slave, SM8150_SLAVE_IPA_CORE, 1, 8);
+ DEFINE_QNODE(ebi, SM8150_SLAVE_EBI_CH0, 4, 4);
+ DEFINE_QNODE(qns2_mem_noc, SM8150_SLAVE_MNOC_SF_MEM_NOC, 1, 32, SM8150_MASTER_MNOC_SF_MEM_NOC);
+ DEFINE_QNODE(qns_mem_noc_hf, SM8150_SLAVE_MNOC_HF_MEM_NOC, 2, 32, SM8150_MASTER_MNOC_HF_MEM_NOC);
+@@ -172,7 +170,6 @@ DEFINE_QBCM(bcm_co0, "CO0", false, &qns_cdsp_mem_noc);
+ DEFINE_QBCM(bcm_ce0, "CE0", false, &qxm_crypto);
+ DEFINE_QBCM(bcm_sn1, "SN1", false, &qxs_imem);
+ DEFINE_QBCM(bcm_co1, "CO1", false, &qnm_npu);
+-DEFINE_QBCM(bcm_ip0, "IP0", false, &ipa_core_slave);
+ DEFINE_QBCM(bcm_cn0, "CN0", true, &qhm_spdm, &qnm_snoc, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_ahb2phy_south, &qhs_aop, &qhs_aoss, &qhs_camera_cfg, &qhs_clk_ctl, &qhs_compute_dsp, &qhs_cpr_cx, &qhs_cpr_mmcx, &qhs_cpr_mx, &qhs_crypto0_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_emac_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_npu_cfg, &qhs_pcie0_cfg, &qhs_pcie1_cfg, &qhs_phy_refgen_north, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qspi, &qhs_qupv3_east, &qhs_qupv3_north, &qhs_qupv3_south, &qhs_sdc2, &qhs_sdc4, &qhs_snoc_cfg, &qhs_spdm, &qhs_spss_cfg, &qhs_ssc_cfg, &qhs_tcsr, &qhs_tlmm_east, &qhs_tlmm_north, &qhs_tlmm_south, &qhs_tlmm_west, &qhs_tsif, &qhs_ufs_card_cfg, &qhs_ufs_mem_cfg, &qhs_usb3_0, &qhs_usb3_1, &qhs_venus_cfg, &qhs_vsense_ctrl_cfg, &qns_cnoc_a2noc, &srvc_cnoc);
+ DEFINE_QBCM(bcm_qup0, "QUP0", false, &qhm_qup0, &qhm_qup1, &qhm_qup2);
+ DEFINE_QBCM(bcm_sn2, "SN2", false, &qns_gemnoc_gc);
+@@ -398,22 +395,6 @@ static const struct qcom_icc_desc sm8150_gem_noc = {
+ .num_bcms = ARRAY_SIZE(gem_noc_bcms),
+ };
+
+-static struct qcom_icc_bcm * const ipa_virt_bcms[] = {
+- &bcm_ip0,
+-};
+-
+-static struct qcom_icc_node * const ipa_virt_nodes[] = {
+- [MASTER_IPA_CORE] = &ipa_core_master,
+- [SLAVE_IPA_CORE] = &ipa_core_slave,
+-};
+-
+-static const struct qcom_icc_desc sm8150_ipa_virt = {
+- .nodes = ipa_virt_nodes,
+- .num_nodes = ARRAY_SIZE(ipa_virt_nodes),
+- .bcms = ipa_virt_bcms,
+- .num_bcms = ARRAY_SIZE(ipa_virt_bcms),
+-};
+-
+ static struct qcom_icc_bcm * const mc_virt_bcms[] = {
+ &bcm_acv,
+ &bcm_mc0,
+@@ -517,8 +498,6 @@ static const struct of_device_id qnoc_of_match[] = {
+ .data = &sm8150_dc_noc},
+ { .compatible = "qcom,sm8150-gem-noc",
+ .data = &sm8150_gem_noc},
+- { .compatible = "qcom,sm8150-ipa-virt",
+- .data = &sm8150_ipa_virt},
+ { .compatible = "qcom,sm8150-mc-virt",
+ .data = &sm8150_mc_virt},
+ { .compatible = "qcom,sm8150-mmss-noc",
+diff --git a/drivers/interconnect/qcom/sm8150.h b/drivers/interconnect/qcom/sm8150.h
+index 97996f64d799c..023161681fb87 100644
+--- a/drivers/interconnect/qcom/sm8150.h
++++ b/drivers/interconnect/qcom/sm8150.h
+@@ -35,7 +35,7 @@
+ #define SM8150_MASTER_GPU_TCU 24
+ #define SM8150_MASTER_GRAPHICS_3D 25
+ #define SM8150_MASTER_IPA 26
+-#define SM8150_MASTER_IPA_CORE 27
++/* 27 was used by SLAVE_IPA_CORE, now represented as RPMh clock */
+ #define SM8150_MASTER_LLCC 28
+ #define SM8150_MASTER_MDP_PORT0 29
+ #define SM8150_MASTER_MDP_PORT1 30
+@@ -94,7 +94,7 @@
+ #define SM8150_SLAVE_GRAPHICS_3D_CFG 83
+ #define SM8150_SLAVE_IMEM_CFG 84
+ #define SM8150_SLAVE_IPA_CFG 85
+-#define SM8150_SLAVE_IPA_CORE 86
++/* 86 was used by SLAVE_IPA_CORE, now represented as RPMh clock */
+ #define SM8150_SLAVE_LLCC 87
+ #define SM8150_SLAVE_LLCC_CFG 88
+ #define SM8150_SLAVE_MNOC_HF_MEM_NOC 89
+--
+2.42.0
+
--- /dev/null
+From 86e79d7b209e3c62bc6aa1707aa433e25bb83f6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Aug 2023 14:15:28 +0200
+Subject: interconnect: qcom: sm8150: Retire DEFINE_QBCM
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 670699a4225b8cba6962f965b227e0175d09ecda ]
+
+The struct definition macros are hard to read and compare, expand them.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Link: https://lore.kernel.org/r/20230811-topic-icc_retire_macrosd-v1-17-c03aaeffc769@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Stable-dep-of: 7ed42176406e ("interconnect: qcom: sm8150: Set ACV enable_mask")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sm8150.c | 283 ++++++++++++++++++++++++++---
+ 1 file changed, 255 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/sm8150.c b/drivers/interconnect/qcom/sm8150.c
+index c5ab29322164a..640fd4c4a6886 100644
+--- a/drivers/interconnect/qcom/sm8150.c
++++ b/drivers/interconnect/qcom/sm8150.c
+@@ -154,34 +154,261 @@ DEFINE_QNODE(xs_pcie_1, SM8150_SLAVE_PCIE_1, 1, 8);
+ DEFINE_QNODE(xs_qdss_stm, SM8150_SLAVE_QDSS_STM, 1, 4);
+ DEFINE_QNODE(xs_sys_tcu_cfg, SM8150_SLAVE_TCU, 1, 8);
+
+-DEFINE_QBCM(bcm_acv, "ACV", false, &ebi);
+-DEFINE_QBCM(bcm_mc0, "MC0", true, &ebi);
+-DEFINE_QBCM(bcm_sh0, "SH0", true, &qns_llcc);
+-DEFINE_QBCM(bcm_mm0, "MM0", true, &qns_mem_noc_hf);
+-DEFINE_QBCM(bcm_mm1, "MM1", false, &qxm_camnoc_hf0_uncomp, &qxm_camnoc_hf1_uncomp, &qxm_camnoc_sf_uncomp, &qxm_camnoc_hf0, &qxm_camnoc_hf1, &qxm_mdp0, &qxm_mdp1);
+-DEFINE_QBCM(bcm_sh2, "SH2", false, &qns_gem_noc_snoc);
+-DEFINE_QBCM(bcm_mm2, "MM2", false, &qxm_camnoc_sf, &qns2_mem_noc);
+-DEFINE_QBCM(bcm_sh3, "SH3", false, &acm_gpu_tcu, &acm_sys_tcu);
+-DEFINE_QBCM(bcm_mm3, "MM3", false, &qxm_rot, &qxm_venus0, &qxm_venus1, &qxm_venus_arm9);
+-DEFINE_QBCM(bcm_sh4, "SH4", false, &qnm_cmpnoc);
+-DEFINE_QBCM(bcm_sh5, "SH5", false, &acm_apps);
+-DEFINE_QBCM(bcm_sn0, "SN0", true, &qns_gemnoc_sf);
+-DEFINE_QBCM(bcm_co0, "CO0", false, &qns_cdsp_mem_noc);
+-DEFINE_QBCM(bcm_ce0, "CE0", false, &qxm_crypto);
+-DEFINE_QBCM(bcm_sn1, "SN1", false, &qxs_imem);
+-DEFINE_QBCM(bcm_co1, "CO1", false, &qnm_npu);
+-DEFINE_QBCM(bcm_cn0, "CN0", true, &qhm_spdm, &qnm_snoc, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_ahb2phy_south, &qhs_aop, &qhs_aoss, &qhs_camera_cfg, &qhs_clk_ctl, &qhs_compute_dsp, &qhs_cpr_cx, &qhs_cpr_mmcx, &qhs_cpr_mx, &qhs_crypto0_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_emac_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_npu_cfg, &qhs_pcie0_cfg, &qhs_pcie1_cfg, &qhs_phy_refgen_north, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qspi, &qhs_qupv3_east, &qhs_qupv3_north, &qhs_qupv3_south, &qhs_sdc2, &qhs_sdc4, &qhs_snoc_cfg, &qhs_spdm, &qhs_spss_cfg, &qhs_ssc_cfg, &qhs_tcsr, &qhs_tlmm_east, &qhs_tlmm_north, &qhs_tlmm_south, &qhs_tlmm_west, &qhs_tsif, &qhs_ufs_card_cfg, &qhs_ufs_mem_cfg, &qhs_usb3_0, &qhs_usb3_1, &qhs_venus_cfg, &qhs_vsense_ctrl_cfg, &qns_cnoc_a2noc, &srvc_cnoc);
+-DEFINE_QBCM(bcm_qup0, "QUP0", false, &qhm_qup0, &qhm_qup1, &qhm_qup2);
+-DEFINE_QBCM(bcm_sn2, "SN2", false, &qns_gemnoc_gc);
+-DEFINE_QBCM(bcm_sn3, "SN3", false, &srvc_aggre1_noc, &srvc_aggre2_noc, &qns_cnoc);
+-DEFINE_QBCM(bcm_sn4, "SN4", false, &qxs_pimem);
+-DEFINE_QBCM(bcm_sn5, "SN5", false, &xs_qdss_stm);
+-DEFINE_QBCM(bcm_sn8, "SN8", false, &xs_pcie_0, &xs_pcie_1);
+-DEFINE_QBCM(bcm_sn9, "SN9", false, &qnm_aggre1_noc);
+-DEFINE_QBCM(bcm_sn11, "SN11", false, &qnm_aggre2_noc);
+-DEFINE_QBCM(bcm_sn12, "SN12", false, &qxm_pimem, &xm_gic);
+-DEFINE_QBCM(bcm_sn14, "SN14", false, &qns_pcie_mem_noc);
+-DEFINE_QBCM(bcm_sn15, "SN15", false, &qnm_gemnoc);
++static struct qcom_icc_bcm bcm_acv = {
++ .name = "ACV",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &ebi },
++};
++
++static struct qcom_icc_bcm bcm_mc0 = {
++ .name = "MC0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &ebi },
++};
++
++static struct qcom_icc_bcm bcm_sh0 = {
++ .name = "SH0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_llcc },
++};
++
++static struct qcom_icc_bcm bcm_mm0 = {
++ .name = "MM0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_mem_noc_hf },
++};
++
++static struct qcom_icc_bcm bcm_mm1 = {
++ .name = "MM1",
++ .keepalive = false,
++ .num_nodes = 7,
++ .nodes = { &qxm_camnoc_hf0_uncomp,
++ &qxm_camnoc_hf1_uncomp,
++ &qxm_camnoc_sf_uncomp,
++ &qxm_camnoc_hf0,
++ &qxm_camnoc_hf1,
++ &qxm_mdp0,
++ &qxm_mdp1
++ },
++};
++
++static struct qcom_icc_bcm bcm_sh2 = {
++ .name = "SH2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_gem_noc_snoc },
++};
++
++static struct qcom_icc_bcm bcm_mm2 = {
++ .name = "MM2",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &qxm_camnoc_sf, &qns2_mem_noc },
++};
++
++static struct qcom_icc_bcm bcm_sh3 = {
++ .name = "SH3",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &acm_gpu_tcu, &acm_sys_tcu },
++};
++
++static struct qcom_icc_bcm bcm_mm3 = {
++ .name = "MM3",
++ .keepalive = false,
++ .num_nodes = 4,
++ .nodes = { &qxm_rot, &qxm_venus0, &qxm_venus1, &qxm_venus_arm9 },
++};
++
++static struct qcom_icc_bcm bcm_sh4 = {
++ .name = "SH4",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_cmpnoc },
++};
++
++static struct qcom_icc_bcm bcm_sh5 = {
++ .name = "SH5",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &acm_apps },
++};
++
++static struct qcom_icc_bcm bcm_sn0 = {
++ .name = "SN0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_gemnoc_sf },
++};
++
++static struct qcom_icc_bcm bcm_co0 = {
++ .name = "CO0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_cdsp_mem_noc },
++};
++
++static struct qcom_icc_bcm bcm_ce0 = {
++ .name = "CE0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxm_crypto },
++};
++
++static struct qcom_icc_bcm bcm_sn1 = {
++ .name = "SN1",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxs_imem },
++};
++
++static struct qcom_icc_bcm bcm_co1 = {
++ .name = "CO1",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_npu },
++};
++
++static struct qcom_icc_bcm bcm_cn0 = {
++ .name = "CN0",
++ .keepalive = true,
++ .num_nodes = 53,
++ .nodes = { &qhm_spdm,
++ &qnm_snoc,
++ &qhs_a1_noc_cfg,
++ &qhs_a2_noc_cfg,
++ &qhs_ahb2phy_south,
++ &qhs_aop,
++ &qhs_aoss,
++ &qhs_camera_cfg,
++ &qhs_clk_ctl,
++ &qhs_compute_dsp,
++ &qhs_cpr_cx,
++ &qhs_cpr_mmcx,
++ &qhs_cpr_mx,
++ &qhs_crypto0_cfg,
++ &qhs_ddrss_cfg,
++ &qhs_display_cfg,
++ &qhs_emac_cfg,
++ &qhs_glm,
++ &qhs_gpuss_cfg,
++ &qhs_imem_cfg,
++ &qhs_ipa,
++ &qhs_mnoc_cfg,
++ &qhs_npu_cfg,
++ &qhs_pcie0_cfg,
++ &qhs_pcie1_cfg,
++ &qhs_phy_refgen_north,
++ &qhs_pimem_cfg,
++ &qhs_prng,
++ &qhs_qdss_cfg,
++ &qhs_qspi,
++ &qhs_qupv3_east,
++ &qhs_qupv3_north,
++ &qhs_qupv3_south,
++ &qhs_sdc2,
++ &qhs_sdc4,
++ &qhs_snoc_cfg,
++ &qhs_spdm,
++ &qhs_spss_cfg,
++ &qhs_ssc_cfg,
++ &qhs_tcsr,
++ &qhs_tlmm_east,
++ &qhs_tlmm_north,
++ &qhs_tlmm_south,
++ &qhs_tlmm_west,
++ &qhs_tsif,
++ &qhs_ufs_card_cfg,
++ &qhs_ufs_mem_cfg,
++ &qhs_usb3_0,
++ &qhs_usb3_1,
++ &qhs_venus_cfg,
++ &qhs_vsense_ctrl_cfg,
++ &qns_cnoc_a2noc,
++ &srvc_cnoc
++ },
++};
++
++static struct qcom_icc_bcm bcm_qup0 = {
++ .name = "QUP0",
++ .keepalive = false,
++ .num_nodes = 3,
++ .nodes = { &qhm_qup0, &qhm_qup1, &qhm_qup2 },
++};
++
++static struct qcom_icc_bcm bcm_sn2 = {
++ .name = "SN2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_gemnoc_gc },
++};
++
++static struct qcom_icc_bcm bcm_sn3 = {
++ .name = "SN3",
++ .keepalive = false,
++ .num_nodes = 3,
++ .nodes = { &srvc_aggre1_noc, &srvc_aggre2_noc, &qns_cnoc },
++};
++
++static struct qcom_icc_bcm bcm_sn4 = {
++ .name = "SN4",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxs_pimem },
++};
++
++static struct qcom_icc_bcm bcm_sn5 = {
++ .name = "SN5",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &xs_qdss_stm },
++};
++
++static struct qcom_icc_bcm bcm_sn8 = {
++ .name = "SN8",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &xs_pcie_0, &xs_pcie_1 },
++};
++
++static struct qcom_icc_bcm bcm_sn9 = {
++ .name = "SN9",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_aggre1_noc },
++};
++
++static struct qcom_icc_bcm bcm_sn11 = {
++ .name = "SN11",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_aggre2_noc },
++};
++
++static struct qcom_icc_bcm bcm_sn12 = {
++ .name = "SN12",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &qxm_pimem, &xm_gic },
++};
++
++static struct qcom_icc_bcm bcm_sn14 = {
++ .name = "SN14",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_pcie_mem_noc },
++};
++
++static struct qcom_icc_bcm bcm_sn15 = {
++ .name = "SN15",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_gemnoc },
++};
+
+ static struct qcom_icc_bcm * const aggre1_noc_bcms[] = {
+ &bcm_qup0,
+--
+2.42.0
+
--- /dev/null
+From da439397c2d810f28f6cf74e70e9fdcfbbf6695f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 01:20:52 +0200
+Subject: interconnect: qcom: sm8150: Set ACV enable_mask
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 7ed42176406e5a2c9a5767d0d75690c7d1588027 ]
+
+ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
+
+Fixes: a09b817c8bad ("interconnect: qcom: Add SM8150 interconnect provider driver")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230811-topic-acv-v2-9-765ad70e539a@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sm8150.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sm8150.c b/drivers/interconnect/qcom/sm8150.c
+index 640fd4c4a6886..685f35bbf5a7c 100644
+--- a/drivers/interconnect/qcom/sm8150.c
++++ b/drivers/interconnect/qcom/sm8150.c
+@@ -156,6 +156,7 @@ DEFINE_QNODE(xs_sys_tcu_cfg, SM8150_SLAVE_TCU, 1, 8);
+
+ static struct qcom_icc_bcm bcm_acv = {
+ .name = "ACV",
++ .enable_mask = BIT(3),
+ .keepalive = false,
+ .num_nodes = 1,
+ .nodes = { &ebi },
+--
+2.42.0
+
--- /dev/null
+From 09021f6ff29101b8d0d23b002263991a426f463e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Aug 2023 14:15:30 +0200
+Subject: interconnect: qcom: sm8350: Retire DEFINE_QBCM
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit edd13c04ff0d90ed152902a88f01f466c77a0cf9 ]
+
+The struct definition macros are hard to read and compare, expand them.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Link: https://lore.kernel.org/r/20230811-topic-icc_retire_macrosd-v1-19-c03aaeffc769@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Stable-dep-of: df1b8356a80a ("interconnect: qcom: sm8350: Set ACV enable_mask")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sm8350.c | 308 ++++++++++++++++++++++++++---
+ 1 file changed, 276 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/sm8350.c b/drivers/interconnect/qcom/sm8350.c
+index 5398e7c8d826b..1959208409396 100644
+--- a/drivers/interconnect/qcom/sm8350.c
++++ b/drivers/interconnect/qcom/sm8350.c
+@@ -165,38 +165,282 @@ DEFINE_QNODE(ebi_disp, SM8350_SLAVE_EBI1_DISP, 4, 4);
+ DEFINE_QNODE(qns_mem_noc_hf_disp, SM8350_SLAVE_MNOC_HF_MEM_NOC_DISP, 2, 32, SM8350_MASTER_MNOC_HF_MEM_NOC_DISP);
+ DEFINE_QNODE(qns_mem_noc_sf_disp, SM8350_SLAVE_MNOC_SF_MEM_NOC_DISP, 2, 32, SM8350_MASTER_MNOC_SF_MEM_NOC_DISP);
+
+-DEFINE_QBCM(bcm_acv, "ACV", false, &ebi);
+-DEFINE_QBCM(bcm_ce0, "CE0", false, &qxm_crypto);
+-DEFINE_QBCM(bcm_cn0, "CN0", true, &qnm_gemnoc_cnoc, &qnm_gemnoc_pcie);
+-DEFINE_QBCM(bcm_cn1, "CN1", false, &xm_qdss_dap, &qhs_ahb2phy0, &qhs_ahb2phy1, &qhs_aoss, &qhs_apss, &qhs_camera_cfg, &qhs_clk_ctl, &qhs_compute_cfg, &qhs_cpr_cx, &qhs_cpr_mmcx, &qhs_cpr_mx, &qhs_crypto0_cfg, &qhs_cx_rdpm, &qhs_dcc_cfg, &qhs_display_cfg, &qhs_gpuss_cfg, &qhs_hwkm, &qhs_imem_cfg, &qhs_ipa, &qhs_ipc_router, &qhs_mss_cfg, &qhs_mx_rdpm, &qhs_pcie0_cfg, &qhs_pcie1_cfg, &qhs_pimem_cfg, &qhs_pka_wrapper_cfg, &qhs_pmu_wrapper_cfg, &qhs_qdss_cfg, &qhs_qup0, &qhs_qup1, &qhs_qup2, &qhs_security, &qhs_spss_cfg, &qhs_tcsr, &qhs_tlmm, &qhs_ufs_card_cfg, &qhs_ufs_mem_cfg, &qhs_usb3_0, &qhs_usb3_1, &qhs_venus_cfg, &qhs_vsense_ctrl_cfg, &qns_a1_noc_cfg, &qns_a2_noc_cfg, &qns_ddrss_cfg, &qns_mnoc_cfg, &qns_snoc_cfg, &srvc_cnoc);
+-DEFINE_QBCM(bcm_cn2, "CN2", false, &qhs_lpass_cfg, &qhs_pdm, &qhs_qspi, &qhs_sdc2, &qhs_sdc4);
+-DEFINE_QBCM(bcm_co0, "CO0", false, &qns_nsp_gemnoc);
+-DEFINE_QBCM(bcm_co3, "CO3", false, &qxm_nsp);
+-DEFINE_QBCM(bcm_mc0, "MC0", true, &ebi);
+-DEFINE_QBCM(bcm_mm0, "MM0", true, &qns_mem_noc_hf);
+-DEFINE_QBCM(bcm_mm1, "MM1", false, &qnm_camnoc_hf, &qxm_mdp0, &qxm_mdp1);
+-DEFINE_QBCM(bcm_mm4, "MM4", false, &qns_mem_noc_sf);
+-DEFINE_QBCM(bcm_mm5, "MM5", false, &qnm_camnoc_icp, &qnm_camnoc_sf, &qnm_video0, &qnm_video1, &qnm_video_cvp, &qxm_rot);
+-DEFINE_QBCM(bcm_sh0, "SH0", true, &qns_llcc);
+-DEFINE_QBCM(bcm_sh2, "SH2", false, &alm_gpu_tcu, &alm_sys_tcu);
+-DEFINE_QBCM(bcm_sh3, "SH3", false, &qnm_cmpnoc);
+-DEFINE_QBCM(bcm_sh4, "SH4", false, &chm_apps);
+-DEFINE_QBCM(bcm_sn0, "SN0", true, &qns_gemnoc_sf);
+-DEFINE_QBCM(bcm_sn2, "SN2", false, &qns_gemnoc_gc);
+-DEFINE_QBCM(bcm_sn3, "SN3", false, &qxs_pimem);
+-DEFINE_QBCM(bcm_sn4, "SN4", false, &xs_qdss_stm);
+-DEFINE_QBCM(bcm_sn5, "SN5", false, &xm_pcie3_0);
+-DEFINE_QBCM(bcm_sn6, "SN6", false, &xm_pcie3_1);
+-DEFINE_QBCM(bcm_sn7, "SN7", false, &qnm_aggre1_noc);
+-DEFINE_QBCM(bcm_sn8, "SN8", false, &qnm_aggre2_noc);
+-DEFINE_QBCM(bcm_sn14, "SN14", false, &qns_pcie_mem_noc);
+-DEFINE_QBCM(bcm_acv_disp, "ACV", false, &ebi_disp);
+-DEFINE_QBCM(bcm_mc0_disp, "MC0", false, &ebi_disp);
+-DEFINE_QBCM(bcm_mm0_disp, "MM0", false, &qns_mem_noc_hf_disp);
+-DEFINE_QBCM(bcm_mm1_disp, "MM1", false, &qxm_mdp0_disp, &qxm_mdp1_disp);
+-DEFINE_QBCM(bcm_mm4_disp, "MM4", false, &qns_mem_noc_sf_disp);
+-DEFINE_QBCM(bcm_mm5_disp, "MM5", false, &qxm_rot_disp);
+-DEFINE_QBCM(bcm_sh0_disp, "SH0", false, &qns_llcc_disp);
++static struct qcom_icc_bcm bcm_acv = {
++ .name = "ACV",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &ebi },
++};
++
++static struct qcom_icc_bcm bcm_ce0 = {
++ .name = "CE0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxm_crypto },
++};
++
++static struct qcom_icc_bcm bcm_cn0 = {
++ .name = "CN0",
++ .keepalive = true,
++ .num_nodes = 2,
++ .nodes = { &qnm_gemnoc_cnoc, &qnm_gemnoc_pcie },
++};
++
++static struct qcom_icc_bcm bcm_cn1 = {
++ .name = "CN1",
++ .keepalive = false,
++ .num_nodes = 47,
++ .nodes = { &xm_qdss_dap,
++ &qhs_ahb2phy0,
++ &qhs_ahb2phy1,
++ &qhs_aoss,
++ &qhs_apss,
++ &qhs_camera_cfg,
++ &qhs_clk_ctl,
++ &qhs_compute_cfg,
++ &qhs_cpr_cx,
++ &qhs_cpr_mmcx,
++ &qhs_cpr_mx,
++ &qhs_crypto0_cfg,
++ &qhs_cx_rdpm,
++ &qhs_dcc_cfg,
++ &qhs_display_cfg,
++ &qhs_gpuss_cfg,
++ &qhs_hwkm,
++ &qhs_imem_cfg,
++ &qhs_ipa,
++ &qhs_ipc_router,
++ &qhs_mss_cfg,
++ &qhs_mx_rdpm,
++ &qhs_pcie0_cfg,
++ &qhs_pcie1_cfg,
++ &qhs_pimem_cfg,
++ &qhs_pka_wrapper_cfg,
++ &qhs_pmu_wrapper_cfg,
++ &qhs_qdss_cfg,
++ &qhs_qup0,
++ &qhs_qup1,
++ &qhs_qup2,
++ &qhs_security,
++ &qhs_spss_cfg,
++ &qhs_tcsr,
++ &qhs_tlmm,
++ &qhs_ufs_card_cfg,
++ &qhs_ufs_mem_cfg,
++ &qhs_usb3_0,
++ &qhs_usb3_1,
++ &qhs_venus_cfg,
++ &qhs_vsense_ctrl_cfg,
++ &qns_a1_noc_cfg,
++ &qns_a2_noc_cfg,
++ &qns_ddrss_cfg,
++ &qns_mnoc_cfg,
++ &qns_snoc_cfg,
++ &srvc_cnoc
++ },
++};
++
++static struct qcom_icc_bcm bcm_cn2 = {
++ .name = "CN2",
++ .keepalive = false,
++ .num_nodes = 5,
++ .nodes = { &qhs_lpass_cfg, &qhs_pdm, &qhs_qspi, &qhs_sdc2, &qhs_sdc4 },
++};
++
++static struct qcom_icc_bcm bcm_co0 = {
++ .name = "CO0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_nsp_gemnoc },
++};
++
++static struct qcom_icc_bcm bcm_co3 = {
++ .name = "CO3",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxm_nsp },
++};
++
++static struct qcom_icc_bcm bcm_mc0 = {
++ .name = "MC0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &ebi },
++};
++
++static struct qcom_icc_bcm bcm_mm0 = {
++ .name = "MM0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_mem_noc_hf },
++};
++
++static struct qcom_icc_bcm bcm_mm1 = {
++ .name = "MM1",
++ .keepalive = false,
++ .num_nodes = 3,
++ .nodes = { &qnm_camnoc_hf, &qxm_mdp0, &qxm_mdp1 },
++};
++
++static struct qcom_icc_bcm bcm_mm4 = {
++ .name = "MM4",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_mem_noc_sf },
++};
++
++static struct qcom_icc_bcm bcm_mm5 = {
++ .name = "MM5",
++ .keepalive = false,
++ .num_nodes = 6,
++ .nodes = { &qnm_camnoc_icp,
++ &qnm_camnoc_sf,
++ &qnm_video0,
++ &qnm_video1,
++ &qnm_video_cvp,
++ &qxm_rot
++ },
++};
++
++static struct qcom_icc_bcm bcm_sh0 = {
++ .name = "SH0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_llcc },
++};
++
++static struct qcom_icc_bcm bcm_sh2 = {
++ .name = "SH2",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &alm_gpu_tcu, &alm_sys_tcu },
++};
++
++static struct qcom_icc_bcm bcm_sh3 = {
++ .name = "SH3",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_cmpnoc },
++};
++
++static struct qcom_icc_bcm bcm_sh4 = {
++ .name = "SH4",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &chm_apps },
++};
++
++static struct qcom_icc_bcm bcm_sn0 = {
++ .name = "SN0",
++ .keepalive = true,
++ .num_nodes = 1,
++ .nodes = { &qns_gemnoc_sf },
++};
++
++static struct qcom_icc_bcm bcm_sn2 = {
++ .name = "SN2",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_gemnoc_gc },
++};
++
++static struct qcom_icc_bcm bcm_sn3 = {
++ .name = "SN3",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxs_pimem },
++};
++
++static struct qcom_icc_bcm bcm_sn4 = {
++ .name = "SN4",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &xs_qdss_stm },
++};
++
++static struct qcom_icc_bcm bcm_sn5 = {
++ .name = "SN5",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &xm_pcie3_0 },
++};
++
++static struct qcom_icc_bcm bcm_sn6 = {
++ .name = "SN6",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &xm_pcie3_1 },
++};
++
++static struct qcom_icc_bcm bcm_sn7 = {
++ .name = "SN7",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_aggre1_noc },
++};
++
++static struct qcom_icc_bcm bcm_sn8 = {
++ .name = "SN8",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qnm_aggre2_noc },
++};
++
++static struct qcom_icc_bcm bcm_sn14 = {
++ .name = "SN14",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_pcie_mem_noc },
++};
++
++static struct qcom_icc_bcm bcm_acv_disp = {
++ .name = "ACV",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &ebi_disp },
++};
++
++static struct qcom_icc_bcm bcm_mc0_disp = {
++ .name = "MC0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &ebi_disp },
++};
++
++static struct qcom_icc_bcm bcm_mm0_disp = {
++ .name = "MM0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_mem_noc_hf_disp },
++};
++
++static struct qcom_icc_bcm bcm_mm1_disp = {
++ .name = "MM1",
++ .keepalive = false,
++ .num_nodes = 2,
++ .nodes = { &qxm_mdp0_disp, &qxm_mdp1_disp },
++};
++
++static struct qcom_icc_bcm bcm_mm4_disp = {
++ .name = "MM4",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_mem_noc_sf_disp },
++};
++
++static struct qcom_icc_bcm bcm_mm5_disp = {
++ .name = "MM5",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qxm_rot_disp },
++};
++
++static struct qcom_icc_bcm bcm_sh0_disp = {
++ .name = "SH0",
++ .keepalive = false,
++ .num_nodes = 1,
++ .nodes = { &qns_llcc_disp },
++};
+
+ static struct qcom_icc_bcm * const aggre1_noc_bcms[] = {
+ };
+--
+2.42.0
+
--- /dev/null
+From 44551a976af4541dbb974b7fa73b3d78123b7a9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 01:20:54 +0200
+Subject: interconnect: qcom: sm8350: Set ACV enable_mask
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit df1b8356a80ab47a7623e08facf36fe434ea9722 ]
+
+ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
+
+Fixes: d26a56674497 ("interconnect: qcom: Add SM8350 interconnect provider driver")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230811-topic-acv-v2-11-765ad70e539a@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sm8350.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sm8350.c b/drivers/interconnect/qcom/sm8350.c
+index 1959208409396..e6e2dcf4574d8 100644
+--- a/drivers/interconnect/qcom/sm8350.c
++++ b/drivers/interconnect/qcom/sm8350.c
+@@ -167,6 +167,7 @@ DEFINE_QNODE(qns_mem_noc_sf_disp, SM8350_SLAVE_MNOC_SF_MEM_NOC_DISP, 2, 32, SM83
+
+ static struct qcom_icc_bcm bcm_acv = {
+ .name = "ACV",
++ .enable_mask = BIT(3),
+ .keepalive = false,
+ .num_nodes = 1,
+ .nodes = { &ebi },
+--
+2.42.0
+
--- /dev/null
+From 6d404c1fc52ef6d2c16ef3637834d91860267792 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 20:05:30 -0400
+Subject: io_uring/kbuf: Allow the full buffer id space for provided buffers
+
+From: Gabriel Krisman Bertazi <krisman@suse.de>
+
+[ Upstream commit f74c746e476b9dad51448b9a9421aae72b60e25f ]
+
+nbufs tracks the number of buffers and not the last bgid. In 16-bit, we
+have 2^16 valid buffers, but the check mistakenly rejects the last
+bid. Let's fix it to make the interface consistent with the
+documentation.
+
+Fixes: ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS")
+Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
+Link: https://lore.kernel.org/r/20231005000531.30800-3-krisman@suse.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/kbuf.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
+index e45602b02a9f1..57ef6850c6a87 100644
+--- a/io_uring/kbuf.c
++++ b/io_uring/kbuf.c
+@@ -19,12 +19,15 @@
+
+ #define BGID_ARRAY 64
+
++/* BIDs are addressed by a 16-bit field in a CQE */
++#define MAX_BIDS_PER_BGID (1 << 16)
++
+ struct io_provide_buf {
+ struct file *file;
+ __u64 addr;
+ __u32 len;
+ __u32 bgid;
+- __u16 nbufs;
++ __u32 nbufs;
+ __u16 bid;
+ };
+
+@@ -281,7 +284,7 @@ int io_remove_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
+ return -EINVAL;
+
+ tmp = READ_ONCE(sqe->fd);
+- if (!tmp || tmp > USHRT_MAX)
++ if (!tmp || tmp > MAX_BIDS_PER_BGID)
+ return -EINVAL;
+
+ memset(p, 0, sizeof(*p));
+@@ -327,7 +330,7 @@ int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe
+ return -EINVAL;
+
+ tmp = READ_ONCE(sqe->fd);
+- if (!tmp || tmp > USHRT_MAX)
++ if (!tmp || tmp > MAX_BIDS_PER_BGID)
+ return -E2BIG;
+ p->nbufs = tmp;
+ p->addr = READ_ONCE(sqe->addr);
+@@ -347,7 +350,7 @@ int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe
+ tmp = READ_ONCE(sqe->off);
+ if (tmp > USHRT_MAX)
+ return -E2BIG;
+- if (tmp + p->nbufs > USHRT_MAX)
++ if (tmp + p->nbufs > MAX_BIDS_PER_BGID)
+ return -EINVAL;
+ p->bid = tmp;
+ return 0;
+--
+2.42.0
+
--- /dev/null
+From df6ffa25520964f6a58f3a0461bc9aeec73f8e63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 20:05:29 -0400
+Subject: io_uring/kbuf: Fix check of BID wrapping in provided buffers
+
+From: Gabriel Krisman Bertazi <krisman@suse.de>
+
+[ Upstream commit ab69838e7c75b0edb699c1a8f42752b30333c46f ]
+
+Commit 3851d25c75ed0 ("io_uring: check for rollover of buffer ID when
+providing buffers") introduced a check to prevent wrapping the BID
+counter when sqe->off is provided, but it's off-by-one too
+restrictive, rejecting the last possible BID (65534).
+
+i.e., the following fails with -EINVAL.
+
+ io_uring_prep_provide_buffers(sqe, addr, size, 0xFFFF, 0, 0);
+
+Fixes: 3851d25c75ed ("io_uring: check for rollover of buffer ID when providing buffers")
+Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
+Link: https://lore.kernel.org/r/20231005000531.30800-2-krisman@suse.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/kbuf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
+index acc37e5a6d4e1..e45602b02a9f1 100644
+--- a/io_uring/kbuf.c
++++ b/io_uring/kbuf.c
+@@ -347,7 +347,7 @@ int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe
+ tmp = READ_ONCE(sqe->off);
+ if (tmp > USHRT_MAX)
+ return -E2BIG;
+- if (tmp + p->nbufs >= USHRT_MAX)
++ if (tmp + p->nbufs > USHRT_MAX)
+ return -EINVAL;
+ p->bid = tmp;
+ return 0;
+--
+2.42.0
+
--- /dev/null
+From ffee750e4ae95be45177d5bb54fec7ff5da86266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 13:02:59 +0100
+Subject: iov_iter, x86: Be consistent about the __user tag on
+ copy_mc_to_user()
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 066baf92bed934c9fb4bcee97a193f47aa63431c ]
+
+copy_mc_to_user() has the destination marked __user on powerpc, but not on
+x86; the latter results in a sparse warning in lib/iov_iter.c.
+
+Fix this by applying the tag on x86 too.
+
+Fixes: ec6347bb4339 ("x86, powerpc: Rename memcpy_mcsafe() to copy_mc_to_{user, kernel}()")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/20230925120309.1731676-3-dhowells@redhat.com
+cc: Dan Williams <dan.j.williams@intel.com>
+cc: Thomas Gleixner <tglx@linutronix.de>
+cc: Ingo Molnar <mingo@redhat.com>
+cc: Borislav Petkov <bp@alien8.de>
+cc: Dave Hansen <dave.hansen@linux.intel.com>
+cc: "H. Peter Anvin" <hpa@zytor.com>
+cc: Alexander Viro <viro@zeniv.linux.org.uk>
+cc: Jens Axboe <axboe@kernel.dk>
+cc: Christoph Hellwig <hch@lst.de>
+cc: Christian Brauner <christian@brauner.io>
+cc: Matthew Wilcox <willy@infradead.org>
+cc: Linus Torvalds <torvalds@linux-foundation.org>
+cc: David Laight <David.Laight@ACULAB.COM>
+cc: x86@kernel.org
+cc: linux-block@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+cc: linux-mm@kvack.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/uaccess.h | 2 +-
+ arch/x86/lib/copy_mc.c | 8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
+index 1cc756eafa447..6ca0c661cb637 100644
+--- a/arch/x86/include/asm/uaccess.h
++++ b/arch/x86/include/asm/uaccess.h
+@@ -518,7 +518,7 @@ copy_mc_to_kernel(void *to, const void *from, unsigned len);
+ #define copy_mc_to_kernel copy_mc_to_kernel
+
+ unsigned long __must_check
+-copy_mc_to_user(void *to, const void *from, unsigned len);
++copy_mc_to_user(void __user *to, const void *from, unsigned len);
+ #endif
+
+ /*
+diff --git a/arch/x86/lib/copy_mc.c b/arch/x86/lib/copy_mc.c
+index 80efd45a77617..6e8b7e600def5 100644
+--- a/arch/x86/lib/copy_mc.c
++++ b/arch/x86/lib/copy_mc.c
+@@ -70,23 +70,23 @@ unsigned long __must_check copy_mc_to_kernel(void *dst, const void *src, unsigne
+ }
+ EXPORT_SYMBOL_GPL(copy_mc_to_kernel);
+
+-unsigned long __must_check copy_mc_to_user(void *dst, const void *src, unsigned len)
++unsigned long __must_check copy_mc_to_user(void __user *dst, const void *src, unsigned len)
+ {
+ unsigned long ret;
+
+ if (copy_mc_fragile_enabled) {
+ __uaccess_begin();
+- ret = copy_mc_fragile(dst, src, len);
++ ret = copy_mc_fragile((__force void *)dst, src, len);
+ __uaccess_end();
+ return ret;
+ }
+
+ if (static_cpu_has(X86_FEATURE_ERMS)) {
+ __uaccess_begin();
+- ret = copy_mc_enhanced_fast_string(dst, src, len);
++ ret = copy_mc_enhanced_fast_string((__force void *)dst, src, len);
+ __uaccess_end();
+ return ret;
+ }
+
+- return copy_user_generic(dst, src, len);
++ return copy_user_generic((__force void *)dst, src, len);
+ }
+--
+2.42.0
+
--- /dev/null
+From 29217349ab547d0bf119a85eaaefcb6881cf11ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 07:26:40 -0700
+Subject: ipv6: avoid atomic fragment on GSO packets
+
+From: Yan Zhai <yan@cloudflare.com>
+
+[ Upstream commit 03d6c848bfb406e9ef6d9846d759e97beaeea113 ]
+
+When the ipv6 stack output a GSO packet, if its gso_size is larger than
+dst MTU, then all segments would be fragmented. However, it is possible
+for a GSO packet to have a trailing segment with smaller actual size
+than both gso_size as well as the MTU, which leads to an "atomic
+fragment". Atomic fragments are considered harmful in RFC-8021. An
+Existing report from APNIC also shows that atomic fragments are more
+likely to be dropped even it is equivalent to a no-op [1].
+
+Add an extra check in the GSO slow output path. For each segment from
+the original over-sized packet, if it fits with the path MTU, then avoid
+generating an atomic fragment.
+
+Link: https://www.potaroo.net/presentations/2022-03-01-ipv6-frag.pdf [1]
+Fixes: b210de4f8c97 ("net: ipv6: Validate GSO SKB before finish IPv6 processing")
+Reported-by: David Wragg <dwragg@cloudflare.com>
+Signed-off-by: Yan Zhai <yan@cloudflare.com>
+Link: https://lore.kernel.org/r/90912e3503a242dca0bc36958b11ed03a2696e5e.1698156966.git.yan@cloudflare.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_output.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index ce2c5e728745f..3c2b2a85de367 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -161,7 +161,13 @@ ip6_finish_output_gso_slowpath_drop(struct net *net, struct sock *sk,
+ int err;
+
+ skb_mark_not_on_list(segs);
+- err = ip6_fragment(net, sk, segs, ip6_finish_output2);
++ /* Last GSO segment can be smaller than gso_size (and MTU).
++ * Adding a fragment header would produce an "atomic fragment",
++ * which is considered harmful (RFC-8021). Avoid that.
++ */
++ err = segs->len > mtu ?
++ ip6_fragment(net, sk, segs, ip6_finish_output2) :
++ ip6_finish_output2(net, sk, segs);
+ if (err && ret == 0)
+ ret = err;
+ }
+--
+2.42.0
+
--- /dev/null
+From 776bafeadb005d151f25f6617b63d1f71a8392da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Oct 2023 13:14:46 +0000
+Subject: ipvlan: properly track tx_errors
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ff672b9ffeb3f82135488ac16c5c5eb4b992999b ]
+
+Both ipvlan_process_v4_outbound() and ipvlan_process_v6_outbound()
+increment dev->stats.tx_errors in case of errors.
+
+Unfortunately there are two issues :
+
+1) ipvlan_get_stats64() does not propagate dev->stats.tx_errors to user.
+
+2) Increments are not atomic. KCSAN would complain eventually.
+
+Use DEV_STATS_INC() to not miss an update, and change ipvlan_get_stats64()
+to copy the value back to user.
+
+Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Mahesh Bandewar <maheshb@google.com>
+Link: https://lore.kernel.org/r/20231026131446.3933175-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipvlan/ipvlan_core.c | 8 ++++----
+ drivers/net/ipvlan/ipvlan_main.c | 1 +
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
+index 59e29e08398a0..b29b7d97b7739 100644
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -441,12 +441,12 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb)
+
+ err = ip_local_out(net, skb->sk, skb);
+ if (unlikely(net_xmit_eval(err)))
+- dev->stats.tx_errors++;
++ DEV_STATS_INC(dev, tx_errors);
+ else
+ ret = NET_XMIT_SUCCESS;
+ goto out;
+ err:
+- dev->stats.tx_errors++;
++ DEV_STATS_INC(dev, tx_errors);
+ kfree_skb(skb);
+ out:
+ return ret;
+@@ -482,12 +482,12 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
+
+ err = ip6_local_out(net, skb->sk, skb);
+ if (unlikely(net_xmit_eval(err)))
+- dev->stats.tx_errors++;
++ DEV_STATS_INC(dev, tx_errors);
+ else
+ ret = NET_XMIT_SUCCESS;
+ goto out;
+ err:
+- dev->stats.tx_errors++;
++ DEV_STATS_INC(dev, tx_errors);
+ kfree_skb(skb);
+ out:
+ return ret;
+diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
+index cd16bc8bf154c..fbf2d5b67aafa 100644
+--- a/drivers/net/ipvlan/ipvlan_main.c
++++ b/drivers/net/ipvlan/ipvlan_main.c
+@@ -324,6 +324,7 @@ static void ipvlan_get_stats64(struct net_device *dev,
+ s->rx_dropped = rx_errs;
+ s->tx_dropped = tx_drps;
+ }
++ s->tx_errors = DEV_STATS_READ(dev, tx_errors);
+ }
+
+ static int ipvlan_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
+--
+2.42.0
+
--- /dev/null
+From 105620feb85f6567fe05846a562110d9826c4370 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Aug 2023 16:36:41 +0800
+Subject: KEYS: Include linux/errno.h in linux/verification.h
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 0a596b0682a7ce37e26c36629816f105c6459d06 ]
+
+Add inclusion of linux/errno.h as otherwise the reference to EINVAL
+may be invalid.
+
+Fixes: f3cf4134c5c6 ("bpf: Add bpf_lookup_*_key() and bpf_key_put() kfuncs")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202308261414.HKw1Mrip-lkp@intel.com/
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/verification.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/verification.h b/include/linux/verification.h
+index f34e50ebcf60a..cb2d47f280910 100644
+--- a/include/linux/verification.h
++++ b/include/linux/verification.h
+@@ -8,6 +8,7 @@
+ #ifndef _LINUX_VERIFICATION_H
+ #define _LINUX_VERIFICATION_H
+
++#include <linux/errno.h>
+ #include <linux/types.h>
+
+ /*
+--
+2.42.0
+
--- /dev/null
+From afccb3fddbf869696a2e3c3068370f02f7073dec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 01:40:23 +0000
+Subject: kunit: add macro to allow conditionally exposing static symbols to
+ tests
+
+From: Rae Moar <rmoar@google.com>
+
+[ Upstream commit 9c988fae6f6ae3224a568ab985881b66bb50c9ec ]
+
+Create two macros:
+
+VISIBLE_IF_KUNIT - A macro that sets symbols to be static if CONFIG_KUNIT
+is not enabled. Otherwise if CONFIG_KUNIT is enabled there is no change to
+the symbol definition.
+
+EXPORT_SYMBOL_IF_KUNIT(symbol) - Exports symbol into
+EXPORTED_FOR_KUNIT_TESTING namespace only if CONFIG_KUNIT is enabled. Must
+use MODULE_IMPORT_NS(EXPORTED_FOR_KUNIT_TESTING) in test file in order to
+use symbols.
+
+Signed-off-by: Rae Moar <rmoar@google.com>
+Reviewed-by: John Johansen <john.johansen@canonical.com>
+Reviewed-by: David Gow <davidgow@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Stable-dep-of: 8884ba07786c ("apparmor: fix invalid reference on profile->disconnected")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/kunit/visibility.h | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+ create mode 100644 include/kunit/visibility.h
+
+diff --git a/include/kunit/visibility.h b/include/kunit/visibility.h
+new file mode 100644
+index 0000000000000..0dfe35feeec60
+--- /dev/null
++++ b/include/kunit/visibility.h
+@@ -0,0 +1,33 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * KUnit API to allow symbols to be conditionally visible during KUnit
++ * testing
++ *
++ * Copyright (C) 2022, Google LLC.
++ * Author: Rae Moar <rmoar@google.com>
++ */
++
++#ifndef _KUNIT_VISIBILITY_H
++#define _KUNIT_VISIBILITY_H
++
++#if IS_ENABLED(CONFIG_KUNIT)
++ /**
++ * VISIBLE_IF_KUNIT - A macro that sets symbols to be static if
++ * CONFIG_KUNIT is not enabled. Otherwise if CONFIG_KUNIT is enabled
++ * there is no change to the symbol definition.
++ */
++ #define VISIBLE_IF_KUNIT
++ /**
++ * EXPORT_SYMBOL_IF_KUNIT(symbol) - Exports symbol into
++ * EXPORTED_FOR_KUNIT_TESTING namespace only if CONFIG_KUNIT is
++ * enabled. Must use MODULE_IMPORT_NS(EXPORTED_FOR_KUNIT_TESTING)
++ * in test file in order to use symbols.
++ */
++ #define EXPORT_SYMBOL_IF_KUNIT(symbol) EXPORT_SYMBOL_NS(symbol, \
++ EXPORTED_FOR_KUNIT_TESTING)
++#else
++ #define VISIBLE_IF_KUNIT static
++ #define EXPORT_SYMBOL_IF_KUNIT(symbol)
++#endif
++
++#endif /* _KUNIT_VISIBILITY_H */
+--
+2.42.0
+
--- /dev/null
+From cb79ccbcedd62db2ceb414598bd79b693f4d9e4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Sep 2023 17:03:47 +0800
+Subject: kunit: Fix missed memory release in kunit_free_suite_set()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit a6074cf0126b0bee51ab77a15930dc24a4d5db90 ]
+
+modprobe cpumask_kunit and rmmod cpumask_kunit, kmemleak detect
+a suspected memory leak as below.
+
+If kunit_filter_suites() in kunit_module_init() succeeds, the
+suite_set.start will not be NULL and the kunit_free_suite_set() in
+kunit_module_exit() should free all the memory which has not
+been freed. However the test_cases in suites is left out.
+
+unreferenced object 0xffff54ac47e83200 (size 512):
+ comm "modprobe", pid 592, jiffies 4294913238 (age 1367.612s)
+ hex dump (first 32 bytes):
+ 84 13 1a f0 d3 b6 ff ff 30 68 1a f0 d3 b6 ff ff ........0h......
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<000000008dec63a2>] slab_post_alloc_hook+0xb8/0x368
+ [<00000000ec280d8e>] __kmem_cache_alloc_node+0x174/0x290
+ [<00000000896c7740>] __kmalloc+0x60/0x2c0
+ [<000000007a50fa06>] kunit_filter_suites+0x254/0x5b8
+ [<0000000078cc98e2>] kunit_module_notify+0xf4/0x240
+ [<0000000033cea952>] notifier_call_chain+0x98/0x17c
+ [<00000000973d05cc>] notifier_call_chain_robust+0x4c/0xa4
+ [<000000005f95895f>] blocking_notifier_call_chain_robust+0x4c/0x74
+ [<0000000048e36fa7>] load_module+0x1a2c/0x1c40
+ [<0000000004eb8a91>] init_module_from_file+0x94/0xcc
+ [<0000000037dbba28>] idempotent_init_module+0x184/0x278
+ [<00000000161b75cb>] __arm64_sys_finit_module+0x68/0xa8
+ [<000000006dc1669b>] invoke_syscall+0x44/0x100
+ [<00000000fa87e304>] el0_svc_common.constprop.1+0x68/0xe0
+ [<000000009d8ad866>] do_el0_svc+0x1c/0x28
+ [<000000005b83c607>] el0_svc+0x3c/0xc4
+
+Fixes: a127b154a8f2 ("kunit: tool: allow filtering test cases via glob")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Reviewed-by: Rae Moar <rmoar@google.com>
+Reviewed-by: David Gow <davidgow@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kunit/executor.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c
+index 74982b83707ca..05ac4cdb6806a 100644
+--- a/lib/kunit/executor.c
++++ b/lib/kunit/executor.c
+@@ -102,8 +102,10 @@ static void kunit_free_suite_set(struct suite_set suite_set)
+ {
+ struct kunit_suite * const *suites;
+
+- for (suites = suite_set.start; suites < suite_set.end; suites++)
++ for (suites = suite_set.start; suites < suite_set.end; suites++) {
++ kfree((*suites)->test_cases);
+ kfree(*suites);
++ }
+ kfree(suite_set.start);
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 71d9dd73e8ec140cb7dee1d2ade64c3bc2888da3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 21:28:34 +0200
+Subject: leds: pwm: Don't disable the PWM when the LED should be off
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 76fe464c8e64e71b2e4af11edeef0e5d85eeb6aa ]
+
+Disabling a PWM (i.e. calling pwm_apply_state with .enabled = false)
+gives no guarantees what the PWM output does. It might freeze where it
+currently is, or go in a High-Z state or drive the active or inactive
+state, it might even continue to toggle.
+
+To ensure that the LED gets really disabled, don't disable the PWM even
+when .duty_cycle is zero.
+
+This fixes disabling a leds-pwm LED on i.MX28. The PWM on this SoC is
+one of those that freezes its output on disable, so if you disable an
+LED that is full on, it stays on. If you disable a LED with half
+brightness it goes off in 50% of the cases and full on in the other 50%.
+
+Fixes: 41c42ff5dbe2 ("leds: simple driver for pwm driven LEDs")
+Reported-by: Rogan Dawes <rogan@dawes.za.net>
+Reported-by: Fabio Estevam <festevam@denx.de>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Fabio Estevam <festevam@denx.de>
+Link: https://lore.kernel.org/r/20230922192834.1695727-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-pwm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
+index cc892ecd52408..6d3e33e8b5f91 100644
+--- a/drivers/leds/leds-pwm.c
++++ b/drivers/leds/leds-pwm.c
+@@ -53,7 +53,7 @@ static int led_pwm_set(struct led_classdev *led_cdev,
+ duty = led_dat->pwmstate.period - duty;
+
+ led_dat->pwmstate.duty_cycle = duty;
+- led_dat->pwmstate.enabled = duty > 0;
++ led_dat->pwmstate.enabled = true;
+ return pwm_apply_state(led_dat->pwm, &led_dat->pwmstate);
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 72ff35162fb691626873b3b7721c3207573b1030 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Sep 2023 09:15:38 +0200
+Subject: leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for
+ 'cpu'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ff50f53276131a3059e8307d11293af388ed2bcd ]
+
+In order to teach the compiler that 'trig->name' will never be truncated,
+we need to tell it that 'cpu' is not negative.
+
+When building with W=1, this fixes the following warnings:
+
+ drivers/leds/trigger/ledtrig-cpu.c: In function ‘ledtrig_cpu_init’:
+ drivers/leds/trigger/ledtrig-cpu.c:155:56: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 5 [-Werror=format-truncation=]
+ 155 | snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu);
+ | ^~
+ drivers/leds/trigger/ledtrig-cpu.c:155:52: note: directive argument in the range [-2147483648, 7]
+ 155 | snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu);
+ | ^~~~~~~
+ drivers/leds/trigger/ledtrig-cpu.c:155:17: note: ‘snprintf’ output between 5 and 15 bytes into a destination of size 8
+ 155 | snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fixes: 8f88731d052d ("led-triggers: create a trigger for CPU activity")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/3f4be7a99933cf8566e630da54f6ab913caac432.1695453322.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/trigger/ledtrig-cpu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/leds/trigger/ledtrig-cpu.c b/drivers/leds/trigger/ledtrig-cpu.c
+index 8af4f9bb9cde8..05848a2fecff6 100644
+--- a/drivers/leds/trigger/ledtrig-cpu.c
++++ b/drivers/leds/trigger/ledtrig-cpu.c
+@@ -130,7 +130,7 @@ static int ledtrig_prepare_down_cpu(unsigned int cpu)
+
+ static int __init ledtrig_cpu_init(void)
+ {
+- int cpu;
++ unsigned int cpu;
+ int ret;
+
+ /* Supports up to 9999 cpu cores */
+@@ -152,7 +152,7 @@ static int __init ledtrig_cpu_init(void)
+ if (cpu >= 8)
+ continue;
+
+- snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu);
++ snprintf(trig->name, MAX_NAME_LEN, "cpu%u", cpu);
+
+ led_trigger_register_simple(trig->name, &trig->_trig);
+ }
+--
+2.42.0
+
--- /dev/null
+From 70aabd164d02ae8d87bde1c92e0f45ff60137e24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Sep 2023 18:11:01 +0200
+Subject: leds: turris-omnia: Do not use SMBUS calls
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 6de283b96b31b4890e3ee8c86caca2a3a30d1011 ]
+
+The leds-turris-omnia driver uses three function for I2C access:
+- i2c_smbus_write_byte_data() and i2c_smbus_read_byte_data(), which
+ cause an emulated SMBUS transfer,
+- i2c_master_send(), which causes an ordinary I2C transfer.
+
+The Turris Omnia MCU LED controller is not semantically SMBUS, it
+operates as a simple I2C bus. It does not implement any of the SMBUS
+specific features, like PEC, or procedure calls, or anything. Moreover
+the I2C controller driver also does not implement SMBUS, and so the
+emulated SMBUS procedure from drivers/i2c/i2c-core-smbus.c is used for
+the SMBUS calls, which gives an unnecessary overhead.
+
+When I first wrote the driver, I was unaware of these facts, and I
+simply used the first function that worked.
+
+Drop the I2C SMBUS calls and instead use simple I2C transfers.
+
+Fixes: 089381b27abe ("leds: initial support for Turris Omnia LEDs")
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Link: https://lore.kernel.org/r/20230918161104.20860-2-kabel@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-turris-omnia.c | 54 +++++++++++++++++++++++++-------
+ 1 file changed, 42 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/leds/leds-turris-omnia.c b/drivers/leds/leds-turris-omnia.c
+index b86ddab33eece..179eb243da2f6 100644
+--- a/drivers/leds/leds-turris-omnia.c
++++ b/drivers/leds/leds-turris-omnia.c
+@@ -2,7 +2,7 @@
+ /*
+ * CZ.NIC's Turris Omnia LEDs driver
+ *
+- * 2020 by Marek Behún <kabel@kernel.org>
++ * 2020, 2023 by Marek Behún <kabel@kernel.org>
+ */
+
+ #include <linux/i2c.h>
+@@ -41,6 +41,37 @@ struct omnia_leds {
+ struct omnia_led leds[];
+ };
+
++static int omnia_cmd_write_u8(const struct i2c_client *client, u8 cmd, u8 val)
++{
++ u8 buf[2] = { cmd, val };
++
++ return i2c_master_send(client, buf, sizeof(buf));
++}
++
++static int omnia_cmd_read_u8(const struct i2c_client *client, u8 cmd)
++{
++ struct i2c_msg msgs[2];
++ u8 reply;
++ int ret;
++
++ msgs[0].addr = client->addr;
++ msgs[0].flags = 0;
++ msgs[0].len = 1;
++ msgs[0].buf = &cmd;
++ msgs[1].addr = client->addr;
++ msgs[1].flags = I2C_M_RD;
++ msgs[1].len = 1;
++ msgs[1].buf = &reply;
++
++ ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++ if (likely(ret == ARRAY_SIZE(msgs)))
++ return reply;
++ else if (ret < 0)
++ return ret;
++ else
++ return -EIO;
++}
++
+ static int omnia_led_brightness_set_blocking(struct led_classdev *cdev,
+ enum led_brightness brightness)
+ {
+@@ -64,7 +95,7 @@ static int omnia_led_brightness_set_blocking(struct led_classdev *cdev,
+ if (buf[2] || buf[3] || buf[4])
+ state |= CMD_LED_STATE_ON;
+
+- ret = i2c_smbus_write_byte_data(leds->client, CMD_LED_STATE, state);
++ ret = omnia_cmd_write_u8(leds->client, CMD_LED_STATE, state);
+ if (ret >= 0 && (state & CMD_LED_STATE_ON))
+ ret = i2c_master_send(leds->client, buf, 5);
+
+@@ -114,9 +145,9 @@ static int omnia_led_register(struct i2c_client *client, struct omnia_led *led,
+ cdev->brightness_set_blocking = omnia_led_brightness_set_blocking;
+
+ /* put the LED into software mode */
+- ret = i2c_smbus_write_byte_data(client, CMD_LED_MODE,
+- CMD_LED_MODE_LED(led->reg) |
+- CMD_LED_MODE_USER);
++ ret = omnia_cmd_write_u8(client, CMD_LED_MODE,
++ CMD_LED_MODE_LED(led->reg) |
++ CMD_LED_MODE_USER);
+ if (ret < 0) {
+ dev_err(dev, "Cannot set LED %pOF to software mode: %i\n", np,
+ ret);
+@@ -124,8 +155,8 @@ static int omnia_led_register(struct i2c_client *client, struct omnia_led *led,
+ }
+
+ /* disable the LED */
+- ret = i2c_smbus_write_byte_data(client, CMD_LED_STATE,
+- CMD_LED_STATE_LED(led->reg));
++ ret = omnia_cmd_write_u8(client, CMD_LED_STATE,
++ CMD_LED_STATE_LED(led->reg));
+ if (ret < 0) {
+ dev_err(dev, "Cannot set LED %pOF brightness: %i\n", np, ret);
+ return ret;
+@@ -158,7 +189,7 @@ static ssize_t brightness_show(struct device *dev, struct device_attribute *a,
+ struct i2c_client *client = to_i2c_client(dev);
+ int ret;
+
+- ret = i2c_smbus_read_byte_data(client, CMD_LED_GET_BRIGHTNESS);
++ ret = omnia_cmd_read_u8(client, CMD_LED_GET_BRIGHTNESS);
+
+ if (ret < 0)
+ return ret;
+@@ -179,8 +210,7 @@ static ssize_t brightness_store(struct device *dev, struct device_attribute *a,
+ if (brightness > 100)
+ return -EINVAL;
+
+- ret = i2c_smbus_write_byte_data(client, CMD_LED_SET_BRIGHTNESS,
+- (u8)brightness);
++ ret = omnia_cmd_write_u8(client, CMD_LED_SET_BRIGHTNESS, brightness);
+
+ return ret < 0 ? ret : count;
+ }
+@@ -238,8 +268,8 @@ static void omnia_leds_remove(struct i2c_client *client)
+ u8 buf[5];
+
+ /* put all LEDs into default (HW triggered) mode */
+- i2c_smbus_write_byte_data(client, CMD_LED_MODE,
+- CMD_LED_MODE_LED(OMNIA_BOARD_LEDS));
++ omnia_cmd_write_u8(client, CMD_LED_MODE,
++ CMD_LED_MODE_LED(OMNIA_BOARD_LEDS));
+
+ /* set all LEDs color to [255, 255, 255] */
+ buf[0] = CMD_LED_COLOR;
+--
+2.42.0
+
--- /dev/null
+From 426d9c5cd7aad9c8918a47aea1f5be15bb7ceecc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Aug 2023 18:07:43 +0200
+Subject: leds: turris-omnia: Drop unnecessary mutex locking
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 760b6b7925bf09491aafa4727eef74fc6bf738b0 ]
+
+Do not lock driver mutex in the global LED panel brightness sysfs
+accessors brightness_show() and brightness_store().
+
+The mutex locking is unnecessary here. The I2C transfers are guarded by
+I2C core locking mechanism, and the LED commands itself do not interfere
+with other commands.
+
+Fixes: 089381b27abe ("leds: initial support for Turris Omnia LEDs")
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Reviewed-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230802160748.11208-2-kabel@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Stable-dep-of: 6de283b96b31 ("leds: turris-omnia: Do not use SMBUS calls")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-turris-omnia.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+diff --git a/drivers/leds/leds-turris-omnia.c b/drivers/leds/leds-turris-omnia.c
+index c7c9851c894a9..b86ddab33eece 100644
+--- a/drivers/leds/leds-turris-omnia.c
++++ b/drivers/leds/leds-turris-omnia.c
+@@ -156,12 +156,9 @@ static ssize_t brightness_show(struct device *dev, struct device_attribute *a,
+ char *buf)
+ {
+ struct i2c_client *client = to_i2c_client(dev);
+- struct omnia_leds *leds = i2c_get_clientdata(client);
+ int ret;
+
+- mutex_lock(&leds->lock);
+ ret = i2c_smbus_read_byte_data(client, CMD_LED_GET_BRIGHTNESS);
+- mutex_unlock(&leds->lock);
+
+ if (ret < 0)
+ return ret;
+@@ -173,7 +170,6 @@ static ssize_t brightness_store(struct device *dev, struct device_attribute *a,
+ const char *buf, size_t count)
+ {
+ struct i2c_client *client = to_i2c_client(dev);
+- struct omnia_leds *leds = i2c_get_clientdata(client);
+ unsigned long brightness;
+ int ret;
+
+@@ -183,15 +179,10 @@ static ssize_t brightness_store(struct device *dev, struct device_attribute *a,
+ if (brightness > 100)
+ return -EINVAL;
+
+- mutex_lock(&leds->lock);
+ ret = i2c_smbus_write_byte_data(client, CMD_LED_SET_BRIGHTNESS,
+ (u8)brightness);
+- mutex_unlock(&leds->lock);
+-
+- if (ret < 0)
+- return ret;
+
+- return count;
++ return ret < 0 ? ret : count;
+ }
+ static DEVICE_ATTR_RW(brightness);
+
+--
+2.42.0
+
--- /dev/null
+From 476e42e37481861d81c05427c8b8e78271818f32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 07:03:27 +0000
+Subject: libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its
+ return value
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 6fd4ebfc4d61e3097b595ab2725d513e3bbd6739 ]
+
+Use devm_kstrdup() instead of kstrdup() and check its return value to
+avoid memory leak.
+
+Fixes: 49bddc73d15c ("libnvdimm/of_pmem: Provide a unique name for bus provider")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/of_pmem.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvdimm/of_pmem.c b/drivers/nvdimm/of_pmem.c
+index 10dbdcdfb9ce9..0243789ba914b 100644
+--- a/drivers/nvdimm/of_pmem.c
++++ b/drivers/nvdimm/of_pmem.c
+@@ -30,7 +30,13 @@ static int of_pmem_region_probe(struct platform_device *pdev)
+ if (!priv)
+ return -ENOMEM;
+
+- priv->bus_desc.provider_name = kstrdup(pdev->name, GFP_KERNEL);
++ priv->bus_desc.provider_name = devm_kstrdup(&pdev->dev, pdev->name,
++ GFP_KERNEL);
++ if (!priv->bus_desc.provider_name) {
++ kfree(priv);
++ return -ENOMEM;
++ }
++
+ priv->bus_desc.module = THIS_MODULE;
+ priv->bus_desc.of_node = np;
+
+--
+2.42.0
+
--- /dev/null
+From 07dc19506ab04b834c210524ab85c93bfd6a4dab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 15:26:44 +0800
+Subject: livepatch: Fix missing newline character in klp_resolve_symbols()
+
+From: Zheng Yejian <zhengyejian1@huawei.com>
+
+[ Upstream commit 67e18e132f0fd738f8c8cac3aa1420312073f795 ]
+
+Without the newline character, the log may not be printed immediately
+after the error occurs.
+
+Fixes: ca376a937486 ("livepatch: Prevent module-specific KLP rela sections from referencing vmlinux symbols")
+Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20230914072644.4098857-1-zhengyejian1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/livepatch/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
+index 9ada0bc5247be..0e651fd4cc9fc 100644
+--- a/kernel/livepatch/core.c
++++ b/kernel/livepatch/core.c
+@@ -244,7 +244,7 @@ static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab,
+ * symbols are exported and normal relas can be used instead.
+ */
+ if (!sec_vmlinux && sym_vmlinux) {
+- pr_err("invalid access to vmlinux symbol '%s' from module-specific livepatch relocation section",
++ pr_err("invalid access to vmlinux symbol '%s' from module-specific livepatch relocation section\n",
+ sym_name);
+ return -EINVAL;
+ }
+--
+2.42.0
+
--- /dev/null
+From 0216b255b27f88f9e384d16e542bc108eb2f0078 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 09:51:00 +0800
+Subject: media: amphion: handle firmware debug message
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit 6496617b2b06d7004a5cbd53d48f19567d6b018c ]
+
+decoder firmware may notify host some debug message,
+it can help analyze the state of the firmware in case of error
+
+Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_defs.h | 1 +
+ drivers/media/platform/amphion/vpu_helpers.c | 1 +
+ drivers/media/platform/amphion/vpu_malone.c | 1 +
+ drivers/media/platform/amphion/vpu_msgs.c | 31 ++++++++++++++++----
+ 4 files changed, 29 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/platform/amphion/vpu_defs.h b/drivers/media/platform/amphion/vpu_defs.h
+index 667637eedb5d4..7320852668d64 100644
+--- a/drivers/media/platform/amphion/vpu_defs.h
++++ b/drivers/media/platform/amphion/vpu_defs.h
+@@ -71,6 +71,7 @@ enum {
+ VPU_MSG_ID_TIMESTAMP_INFO,
+ VPU_MSG_ID_FIRMWARE_XCPT,
+ VPU_MSG_ID_PIC_SKIPPED,
++ VPU_MSG_ID_DBG_MSG,
+ };
+
+ enum VPU_ENC_MEMORY_RESOURSE {
+diff --git a/drivers/media/platform/amphion/vpu_helpers.c b/drivers/media/platform/amphion/vpu_helpers.c
+index 2e78666322f02..66fdb0baea746 100644
+--- a/drivers/media/platform/amphion/vpu_helpers.c
++++ b/drivers/media/platform/amphion/vpu_helpers.c
+@@ -454,6 +454,7 @@ const char *vpu_id_name(u32 id)
+ case VPU_MSG_ID_UNSUPPORTED: return "unsupported";
+ case VPU_MSG_ID_FIRMWARE_XCPT: return "exception";
+ case VPU_MSG_ID_PIC_SKIPPED: return "skipped";
++ case VPU_MSG_ID_DBG_MSG: return "debug msg";
+ }
+ return "<unknown>";
+ }
+diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c
+index c2f4fb12c3b64..6b37453eef76c 100644
+--- a/drivers/media/platform/amphion/vpu_malone.c
++++ b/drivers/media/platform/amphion/vpu_malone.c
+@@ -726,6 +726,7 @@ static struct vpu_pair malone_msgs[] = {
+ {VPU_MSG_ID_UNSUPPORTED, VID_API_EVENT_UNSUPPORTED_STREAM},
+ {VPU_MSG_ID_FIRMWARE_XCPT, VID_API_EVENT_FIRMWARE_XCPT},
+ {VPU_MSG_ID_PIC_SKIPPED, VID_API_EVENT_PIC_SKIPPED},
++ {VPU_MSG_ID_DBG_MSG, VID_API_EVENT_DBG_MSG_DEC},
+ };
+
+ static void vpu_malone_pack_fs_alloc(struct vpu_rpc_event *pkt,
+diff --git a/drivers/media/platform/amphion/vpu_msgs.c b/drivers/media/platform/amphion/vpu_msgs.c
+index d0ead051f7d18..b74a407a19f22 100644
+--- a/drivers/media/platform/amphion/vpu_msgs.c
++++ b/drivers/media/platform/amphion/vpu_msgs.c
+@@ -23,6 +23,7 @@
+ struct vpu_msg_handler {
+ u32 id;
+ void (*done)(struct vpu_inst *inst, struct vpu_rpc_event *pkt);
++ u32 is_str;
+ };
+
+ static void vpu_session_handle_start_done(struct vpu_inst *inst, struct vpu_rpc_event *pkt)
+@@ -154,7 +155,7 @@ static void vpu_session_handle_error(struct vpu_inst *inst, struct vpu_rpc_event
+ {
+ char *str = (char *)pkt->data;
+
+- if (strlen(str))
++ if (*str)
+ dev_err(inst->dev, "instance %d firmware error : %s\n", inst->id, str);
+ else
+ dev_err(inst->dev, "instance %d is unsupported stream\n", inst->id);
+@@ -180,6 +181,21 @@ static void vpu_session_handle_pic_skipped(struct vpu_inst *inst, struct vpu_rpc
+ vpu_inst_unlock(inst);
+ }
+
++static void vpu_session_handle_dbg_msg(struct vpu_inst *inst, struct vpu_rpc_event *pkt)
++{
++ char *str = (char *)pkt->data;
++
++ if (*str)
++ dev_info(inst->dev, "instance %d firmware dbg msg : %s\n", inst->id, str);
++}
++
++static void vpu_terminate_string_msg(struct vpu_rpc_event *pkt)
++{
++ if (pkt->hdr.num == ARRAY_SIZE(pkt->data))
++ pkt->hdr.num--;
++ pkt->data[pkt->hdr.num] = 0;
++}
++
+ static struct vpu_msg_handler handlers[] = {
+ {VPU_MSG_ID_START_DONE, vpu_session_handle_start_done},
+ {VPU_MSG_ID_STOP_DONE, vpu_session_handle_stop_done},
+@@ -193,9 +209,10 @@ static struct vpu_msg_handler handlers[] = {
+ {VPU_MSG_ID_PIC_DECODED, vpu_session_handle_pic_decoded},
+ {VPU_MSG_ID_DEC_DONE, vpu_session_handle_pic_done},
+ {VPU_MSG_ID_PIC_EOS, vpu_session_handle_eos},
+- {VPU_MSG_ID_UNSUPPORTED, vpu_session_handle_error},
+- {VPU_MSG_ID_FIRMWARE_XCPT, vpu_session_handle_firmware_xcpt},
++ {VPU_MSG_ID_UNSUPPORTED, vpu_session_handle_error, true},
++ {VPU_MSG_ID_FIRMWARE_XCPT, vpu_session_handle_firmware_xcpt, true},
+ {VPU_MSG_ID_PIC_SKIPPED, vpu_session_handle_pic_skipped},
++ {VPU_MSG_ID_DBG_MSG, vpu_session_handle_dbg_msg, true},
+ };
+
+ static int vpu_session_handle_msg(struct vpu_inst *inst, struct vpu_rpc_event *msg)
+@@ -219,8 +236,12 @@ static int vpu_session_handle_msg(struct vpu_inst *inst, struct vpu_rpc_event *m
+ }
+ }
+
+- if (handler && handler->done)
+- handler->done(inst, msg);
++ if (handler) {
++ if (handler->is_str)
++ vpu_terminate_string_msg(msg);
++ if (handler->done)
++ handler->done(inst, msg);
++ }
+
+ vpu_response_cmd(inst, msg_id, 1);
+
+--
+2.42.0
+
--- /dev/null
+From e9a9e984ce839a03ee2ab60323c39b9335b49026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 11:49:42 +0800
+Subject: media: bttv: fix use after free error due to btv->timeout timer
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit bd5b50b329e850d467e7bcc07b2b6bde3752fbda ]
+
+There may be some a race condition between timer function
+bttv_irq_timeout and bttv_remove. The timer is setup in
+probe and there is no timer_delete operation in remove
+function. When it hit kfree btv, the function might still be
+invoked, which will cause use after free bug.
+
+This bug is found by static analysis, it may be false positive.
+
+Fix it by adding del_timer_sync invoking to the remove function.
+
+cpu0 cpu1
+ bttv_probe
+ ->timer_setup
+ ->bttv_set_dma
+ ->mod_timer;
+bttv_remove
+ ->kfree(btv);
+ ->bttv_irq_timeout
+ ->USE btv
+
+Fixes: 162e6376ac58 ("media: pci: Convert timers to use timer_setup()")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/bt8xx/bttv-driver.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
+index d40b537f4e98b..24ba5729969dc 100644
+--- a/drivers/media/pci/bt8xx/bttv-driver.c
++++ b/drivers/media/pci/bt8xx/bttv-driver.c
+@@ -4248,6 +4248,7 @@ static void bttv_remove(struct pci_dev *pci_dev)
+
+ /* free resources */
+ free_irq(btv->c.pci->irq,btv);
++ del_timer_sync(&btv->timeout);
+ iounmap(btv->bt848_mmio);
+ release_mem_region(pci_resource_start(btv->c.pci,0),
+ pci_resource_len(btv->c.pci,0));
+--
+2.42.0
+
--- /dev/null
+From 3e1d172c0ef247e37c7d1961738f1642f1da5b4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2023 18:39:29 +0530
+Subject: media: cadence: csi2rx: Unregister v4l2 async notifier
+
+From: Pratyush Yadav <p.yadav@ti.com>
+
+[ Upstream commit b2701715301a49b53d05c7d43f3fedc3b8743bfc ]
+
+The notifier is added to the global notifier list when registered. When
+the module is removed, the struct csi2rx_priv in which the notifier is
+embedded, is destroyed. As a result the notifier list has a reference to
+a notifier that no longer exists. This causes invalid memory accesses
+when the list is iterated over. Similar for when the probe fails.
+Unregister and clean up the notifier to avoid this.
+
+Fixes: 1fc3b37f34f6 ("media: v4l: cadence: Add Cadence MIPI-CSI2 RX driver")
+
+Signed-off-by: Pratyush Yadav <p.yadav@ti.com>
+Tested-by: Julien Massot <julien.massot@collabora.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Jai Luthra <j-luthra@ti.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/cadence/cdns-csi2rx.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/cadence/cdns-csi2rx.c b/drivers/media/platform/cadence/cdns-csi2rx.c
+index cc3ebb0d96f66..2a23da6a0b8ee 100644
+--- a/drivers/media/platform/cadence/cdns-csi2rx.c
++++ b/drivers/media/platform/cadence/cdns-csi2rx.c
+@@ -404,8 +404,10 @@ static int csi2rx_parse_dt(struct csi2rx_priv *csi2rx)
+ asd = v4l2_async_nf_add_fwnode_remote(&csi2rx->notifier, fwh,
+ struct v4l2_async_subdev);
+ of_node_put(ep);
+- if (IS_ERR(asd))
++ if (IS_ERR(asd)) {
++ v4l2_async_nf_cleanup(&csi2rx->notifier);
+ return PTR_ERR(asd);
++ }
+
+ csi2rx->notifier.ops = &csi2rx_notifier_ops;
+
+@@ -467,6 +469,7 @@ static int csi2rx_probe(struct platform_device *pdev)
+ return 0;
+
+ err_cleanup:
++ v4l2_async_nf_unregister(&csi2rx->notifier);
+ v4l2_async_nf_cleanup(&csi2rx->notifier);
+ err_free_priv:
+ kfree(csi2rx);
+@@ -477,6 +480,8 @@ static int csi2rx_remove(struct platform_device *pdev)
+ {
+ struct csi2rx_priv *csi2rx = platform_get_drvdata(pdev);
+
++ v4l2_async_nf_unregister(&csi2rx->notifier);
++ v4l2_async_nf_cleanup(&csi2rx->notifier);
+ v4l2_async_unregister_subdev(&csi2rx->subdev);
+ kfree(csi2rx);
+
+--
+2.42.0
+
--- /dev/null
+From 904097094049a151074bdcc4c78bf2806f32d7fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 12:35:25 +0200
+Subject: media: cec: meson: always include meson sub-directory in Makefile
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 94e27fbeca27d8c772fc2bc807730aaee5886055 ]
+
+'meson' directory contains two separate drivers, so it should be added
+to Makefile compilation hierarchy unconditionally, because otherwise the
+meson-ao-cec-g12a won't be compiled if meson-ao-cec is not selected.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Fixes: 4be5e8648b0c ("media: move CEC platform drivers to a separate directory")
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/platform/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/cec/platform/Makefile b/drivers/media/cec/platform/Makefile
+index 26d2bc7783944..a51e98ab4958d 100644
+--- a/drivers/media/cec/platform/Makefile
++++ b/drivers/media/cec/platform/Makefile
+@@ -6,7 +6,7 @@
+ # Please keep it in alphabetic order
+ obj-$(CONFIG_CEC_CROS_EC) += cros-ec/
+ obj-$(CONFIG_CEC_GPIO) += cec-gpio/
+-obj-$(CONFIG_CEC_MESON_AO) += meson/
++obj-y += meson/
+ obj-$(CONFIG_CEC_SAMSUNG_S5P) += s5p/
+ obj-$(CONFIG_CEC_SECO) += seco/
+ obj-$(CONFIG_CEC_STI) += sti/
+--
+2.42.0
+
--- /dev/null
+From 800d11837bbdc93fe1b4860bbb1d5f4557b5d566 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 20:46:12 +0200
+Subject: media: cedrus: Fix clock/reset sequence
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit 36fe515c1a3cd5eac148e8a591a82108d92d5522 ]
+
+According to H6 user manual, resets should always be de-asserted before
+clocks are enabled. This is also consistent with vendor driver.
+
+Fixes: d5aecd289bab ("media: cedrus: Implement runtime PM")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Acked-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/media/sunxi/cedrus/cedrus_hw.c | 24 +++++++++----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_hw.c b/drivers/staging/media/sunxi/cedrus/cedrus_hw.c
+index a6470a89851e3..fe5fbf6cf6314 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_hw.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_hw.c
+@@ -172,12 +172,12 @@ int cedrus_hw_suspend(struct device *device)
+ {
+ struct cedrus_dev *dev = dev_get_drvdata(device);
+
+- reset_control_assert(dev->rstc);
+-
+ clk_disable_unprepare(dev->ram_clk);
+ clk_disable_unprepare(dev->mod_clk);
+ clk_disable_unprepare(dev->ahb_clk);
+
++ reset_control_assert(dev->rstc);
++
+ return 0;
+ }
+
+@@ -186,11 +186,18 @@ int cedrus_hw_resume(struct device *device)
+ struct cedrus_dev *dev = dev_get_drvdata(device);
+ int ret;
+
++ ret = reset_control_reset(dev->rstc);
++ if (ret) {
++ dev_err(dev->dev, "Failed to apply reset\n");
++
++ return ret;
++ }
++
+ ret = clk_prepare_enable(dev->ahb_clk);
+ if (ret) {
+ dev_err(dev->dev, "Failed to enable AHB clock\n");
+
+- return ret;
++ goto err_rst;
+ }
+
+ ret = clk_prepare_enable(dev->mod_clk);
+@@ -207,21 +214,14 @@ int cedrus_hw_resume(struct device *device)
+ goto err_mod_clk;
+ }
+
+- ret = reset_control_reset(dev->rstc);
+- if (ret) {
+- dev_err(dev->dev, "Failed to apply reset\n");
+-
+- goto err_ram_clk;
+- }
+-
+ return 0;
+
+-err_ram_clk:
+- clk_disable_unprepare(dev->ram_clk);
+ err_mod_clk:
+ clk_disable_unprepare(dev->mod_clk);
+ err_ahb_clk:
+ clk_disable_unprepare(dev->ahb_clk);
++err_rst:
++ reset_control_assert(dev->rstc);
+
+ return ret;
+ }
+--
+2.42.0
+
--- /dev/null
+From 6ba61a2ab11808a9881eb77727c33b6dcadee313 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Oct 2023 12:08:45 +0200
+Subject: media: dvb-usb-v2: af9035: fix missing unlock
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit f31b2cb85f0ee165d78e1c43f6d69f82cc3b2145 ]
+
+Instead of returning an error, goto the mutex unlock at
+the end of the function.
+
+Fixes smatch warning:
+
+drivers/media/usb/dvb-usb-v2/af9035.c:467 af9035_i2c_master_xfer() warn: inconsistent returns '&d->i2c_mutex'.
+ Locked on : 326,387
+ Unlocked on: 465,467
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Fixes: 7bf744f2de0a ("media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer")
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb-v2/af9035.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
+index cd6f5374414d4..5f9dec71ff6e0 100644
+--- a/drivers/media/usb/dvb-usb-v2/af9035.c
++++ b/drivers/media/usb/dvb-usb-v2/af9035.c
+@@ -323,8 +323,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
+ ret = -EOPNOTSUPP;
+ } else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
+ (msg[0].addr == state->af9033_i2c_addr[1])) {
+- if (msg[0].len < 3 || msg[1].len < 1)
+- return -EOPNOTSUPP;
++ if (msg[0].len < 3 || msg[1].len < 1) {
++ ret = -EOPNOTSUPP;
++ goto unlock;
++ }
+ /* demod access via firmware interface */
+ reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
+ msg[0].buf[2];
+@@ -384,8 +386,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
+ ret = -EOPNOTSUPP;
+ } else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
+ (msg[0].addr == state->af9033_i2c_addr[1])) {
+- if (msg[0].len < 3)
+- return -EOPNOTSUPP;
++ if (msg[0].len < 3) {
++ ret = -EOPNOTSUPP;
++ goto unlock;
++ }
+ /* demod access via firmware interface */
+ reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
+ msg[0].buf[2];
+@@ -460,6 +464,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
+ ret = -EOPNOTSUPP;
+ }
+
++unlock:
+ mutex_unlock(&d->i2c_mutex);
+
+ if (ret < 0)
+--
+2.42.0
+
--- /dev/null
+From 3bf344e2d9419d1e29c6de3919bf245479b7dd37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Aug 2023 03:38:58 +0200
+Subject: media: hantro: Check whether reset op is defined before use
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 88d4b23a629ebd34f682f770cb6c2116c851f7b8 ]
+
+The i.MX8MM/N/P does not define the .reset op since reset of the VPU is
+done by genpd. Check whether the .reset op is defined before calling it
+to avoid NULL pointer dereference.
+
+Note that the Fixes tag is set to the commit which removed the reset op
+from i.MX8M Hantro G2 implementation, this is because before this commit
+all the implementations did define the .reset op.
+
+Fixes: 6971efb70ac3 ("media: hantro: Allow i.MX8MQ G1 and G2 to run independently")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/verisilicon/hantro_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
+index 8cb4a68c9119e..08840ba313e7a 100644
+--- a/drivers/media/platform/verisilicon/hantro_drv.c
++++ b/drivers/media/platform/verisilicon/hantro_drv.c
+@@ -125,7 +125,8 @@ void hantro_watchdog(struct work_struct *work)
+ ctx = v4l2_m2m_get_curr_priv(vpu->m2m_dev);
+ if (ctx) {
+ vpu_err("frame processing timed out!\n");
+- ctx->codec_ops->reset(ctx);
++ if (ctx->codec_ops->reset)
++ ctx->codec_ops->reset(ctx);
+ hantro_job_finish(vpu, ctx, VB2_BUF_STATE_ERROR);
+ }
+ }
+--
+2.42.0
+
--- /dev/null
+From dad0fce87c08408ba3cf08958c1bc7cd49d1baab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Aug 2023 00:13:40 +0200
+Subject: media: i2c: max9286: Fix some redundant of_node_put() calls
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 0822315e46b400f611cba1193456ee6a5dc3e41d ]
+
+This is odd to have a of_node_put() just after a for_each_child_of_node()
+or a for_each_endpoint_of_node() loop. It should already be called
+during the last iteration.
+
+Remove these calls.
+
+Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/max9286.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
+index 892cd97b7cab7..e8c28902d97e9 100644
+--- a/drivers/media/i2c/max9286.c
++++ b/drivers/media/i2c/max9286.c
+@@ -1234,7 +1234,6 @@ static int max9286_parse_dt(struct max9286_priv *priv)
+
+ i2c_mux_mask |= BIT(id);
+ }
+- of_node_put(node);
+ of_node_put(i2c_mux);
+
+ /* Parse the endpoints */
+@@ -1298,7 +1297,6 @@ static int max9286_parse_dt(struct max9286_priv *priv)
+ priv->source_mask |= BIT(ep.port);
+ priv->nsources++;
+ }
+- of_node_put(node);
+
+ /*
+ * Parse the initial value of the reverse channel amplitude from
+--
+2.42.0
+
--- /dev/null
+From e401b0bc69a5d187a460a86b1478473729ddef20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Sep 2023 21:28:04 +0800
+Subject: media: mtk-jpegenc: Fix bug in JPEG encode quality selection
+
+From: Fei Shao <fshao@chromium.org>
+
+[ Upstream commit 0aeccc63f3bc4cfd49dc4893da1409402ee6b295 ]
+
+The driver uses the upper-bound approach to decide the target JPEG
+encode quality, but there's a logic bug that if the desired quality is
+higher than what the driver can support, the driver falls back to using
+the worst quality.
+
+Fix the bug by assuming using the best quality in the beginning, and
+with trivial refactor to avoid long lines.
+
+Fixes: 45f13a57d813 ("media: platform: Add jpeg enc feature")
+Signed-off-by: Fei Shao <fshao@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c
+index 1cf037bf72dda..8c271c38caf73 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c
+@@ -98,6 +98,7 @@ void mtk_jpeg_set_enc_params(struct mtk_jpeg_ctx *ctx, void __iomem *base)
+ u32 img_stride;
+ u32 mem_stride;
+ u32 i, enc_quality;
++ u32 nr_enc_quality = ARRAY_SIZE(mtk_jpeg_enc_quality);
+
+ value = width << 16 | height;
+ writel(value, base + JPEG_ENC_IMG_SIZE);
+@@ -128,8 +129,8 @@ void mtk_jpeg_set_enc_params(struct mtk_jpeg_ctx *ctx, void __iomem *base)
+ writel(img_stride, base + JPEG_ENC_IMG_STRIDE);
+ writel(mem_stride, base + JPEG_ENC_STRIDE);
+
+- enc_quality = mtk_jpeg_enc_quality[0].hardware_value;
+- for (i = 0; i < ARRAY_SIZE(mtk_jpeg_enc_quality); i++) {
++ enc_quality = mtk_jpeg_enc_quality[nr_enc_quality - 1].hardware_value;
++ for (i = 0; i < nr_enc_quality; i++) {
+ if (ctx->enc_quality <= mtk_jpeg_enc_quality[i].quality_param) {
+ enc_quality = mtk_jpeg_enc_quality[i].hardware_value;
+ break;
+--
+2.42.0
+
--- /dev/null
+From e5481add6ac8ce96147219c3ac330c10178f6b73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 09:16:19 +0200
+Subject: media: ov5640: Drop dead code using frame_interval
+
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+
+[ Upstream commit eeaa47d182fedfe68b8fd40ef3798761c8904791 ]
+
+The ov5640_update_pixel_rate() function handles the parallel and MIPI
+CSI-2 cases separately.
+
+When running on a parallel setup the V4L2_CID_PIXEL_RATE value is
+calculated at the beginning of the function using the values configured
+with the frame_interval operations, and then the function immediately
+returns.
+
+The remaining of the function handles the MIPI CSI-2 configuration and
+should not use the 'current_fr' and 'def_fps' fields as those are only
+relevant for parallel mode.
+
+Drop a small section of dead code that updates vblank using
+frame_interval on a MIPI CSI-2 setup.
+
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Stable-dep-of: 8fc29e3c9f68 ("media: ov5640: fix vblank unchange issue when work at dvp mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5640.c | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 2ee832426736d..505dd7c10235e 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -2912,19 +2912,6 @@ static int ov5640_update_pixel_rate(struct ov5640_dev *sensor)
+ hblank, hblank, 1, hblank);
+
+ vblank = timings->vblank_def;
+-
+- if (sensor->current_fr != mode->def_fps) {
+- /*
+- * Compute the vertical blanking according to the framerate
+- * configured with s_frame_interval.
+- */
+- int fie_num = sensor->frame_interval.numerator;
+- int fie_denom = sensor->frame_interval.denominator;
+-
+- vblank = ((fie_num * pixel_rate / fie_denom) / timings->htot) -
+- mode->height;
+- }
+-
+ __v4l2_ctrl_modify_range(sensor->ctrls.vblank, OV5640_MIN_VBLANK,
+ OV5640_MAX_VTS - mode->height, 1, vblank);
+ __v4l2_ctrl_s_ctrl(sensor->ctrls.vblank, vblank);
+--
+2.42.0
+
--- /dev/null
+From 3e1789720fc6e570689249b891db9fd64c3e339c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Aug 2023 17:05:35 +0800
+Subject: media: ov5640: Fix a memory leak when ov5640_probe fails
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+[ Upstream commit 20290feaaeb76cc719921aad275ccb18662a7c3a ]
+
+sensor->ctrls.handler is initialized in ov5640_init_controls(),
+so when the sensor is not connected and ov5640_sensor_resume()
+fails, sensor->ctrls.handler should be released, otherwise a
+memory leak will be detected:
+
+unreferenced object 0xc674ca80 (size 64):
+ comm "swapper/0", pid 1, jiffies 4294938337 (age 204.880s)
+ hex dump (first 32 bytes):
+ 80 55 75 c6 80 54 75 c6 00 55 75 c6 80 52 75 c6 .Uu..Tu..Uu..Ru.
+ 00 53 75 c6 00 00 00 00 00 00 00 00 00 00 00 00 .Su..........
+
+Fixes: 85644a9b37ec ("media: ov5640: Use runtime PM")
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5640.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index aa9e5a99fc536..e0019668a8f86 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -3909,7 +3909,7 @@ static int ov5640_probe(struct i2c_client *client)
+ ret = ov5640_sensor_resume(dev);
+ if (ret) {
+ dev_err(dev, "failed to power on\n");
+- goto entity_cleanup;
++ goto free_ctrls;
+ }
+
+ pm_runtime_set_active(dev);
+@@ -3933,8 +3933,9 @@ static int ov5640_probe(struct i2c_client *client)
+ err_pm_runtime:
+ pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+- v4l2_ctrl_handler_free(&sensor->ctrls.handler);
+ ov5640_sensor_suspend(dev);
++free_ctrls:
++ v4l2_ctrl_handler_free(&sensor->ctrls.handler);
+ entity_cleanup:
+ media_entity_cleanup(&sensor->sd.entity);
+ mutex_destroy(&sensor->lock);
+--
+2.42.0
+
--- /dev/null
+From da56108cdb3c561d56d32b62024702db1b593193 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jul 2023 15:30:12 +0800
+Subject: media: ov5640: fix vblank unchange issue when work at dvp mode
+
+From: Guoniu.zhou <guoniu.zhou@nxp.com>
+
+[ Upstream commit 8fc29e3c9f682d4ad9b0764d44ecc6c19b000051 ]
+
+The value of V4L2_CID_VBLANK control is initialized to default vblank
+value of 640x480 when driver probe. When OV5640 work at DVP mode, the
+control value won't update and lead to sensor can't output data if the
+resolution remain the same as last time since incorrect total vertical
+size. So update it when there is a new value applied.
+
+Fixes: bce93b827de6 ("media: ov5640: Add VBLANK control")
+Signed-off-by: Guoniu.zhou <guoniu.zhou@nxp.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5640.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 505dd7c10235e..aa9e5a99fc536 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -2840,12 +2840,22 @@ static int ov5640_try_fmt_internal(struct v4l2_subdev *sd,
+ return 0;
+ }
+
++static void __v4l2_ctrl_vblank_update(struct ov5640_dev *sensor, u32 vblank)
++{
++ const struct ov5640_mode_info *mode = sensor->current_mode;
++
++ __v4l2_ctrl_modify_range(sensor->ctrls.vblank, OV5640_MIN_VBLANK,
++ OV5640_MAX_VTS - mode->height, 1, vblank);
++
++ __v4l2_ctrl_s_ctrl(sensor->ctrls.vblank, vblank);
++}
++
+ static int ov5640_update_pixel_rate(struct ov5640_dev *sensor)
+ {
+ const struct ov5640_mode_info *mode = sensor->current_mode;
+ enum ov5640_pixel_rate_id pixel_rate_id = mode->pixel_rate;
+ struct v4l2_mbus_framefmt *fmt = &sensor->fmt;
+- const struct ov5640_timings *timings;
++ const struct ov5640_timings *timings = ov5640_timings(sensor, mode);
+ s32 exposure_val, exposure_max;
+ unsigned int hblank;
+ unsigned int i = 0;
+@@ -2864,6 +2874,8 @@ static int ov5640_update_pixel_rate(struct ov5640_dev *sensor)
+ __v4l2_ctrl_s_ctrl_int64(sensor->ctrls.pixel_rate,
+ ov5640_calc_pixel_rate(sensor));
+
++ __v4l2_ctrl_vblank_update(sensor, timings->vblank_def);
++
+ return 0;
+ }
+
+@@ -2906,15 +2918,12 @@ static int ov5640_update_pixel_rate(struct ov5640_dev *sensor)
+ __v4l2_ctrl_s_ctrl_int64(sensor->ctrls.pixel_rate, pixel_rate);
+ __v4l2_ctrl_s_ctrl(sensor->ctrls.link_freq, i);
+
+- timings = ov5640_timings(sensor, mode);
+ hblank = timings->htot - mode->width;
+ __v4l2_ctrl_modify_range(sensor->ctrls.hblank,
+ hblank, hblank, 1, hblank);
+
+ vblank = timings->vblank_def;
+- __v4l2_ctrl_modify_range(sensor->ctrls.vblank, OV5640_MIN_VBLANK,
+- OV5640_MAX_VTS - mode->height, 1, vblank);
+- __v4l2_ctrl_s_ctrl(sensor->ctrls.vblank, vblank);
++ __v4l2_ctrl_vblank_update(sensor, vblank);
+
+ exposure_max = timings->crop.height + vblank - 4;
+ exposure_val = clamp_t(s32, sensor->ctrls.exposure->val,
+--
+2.42.0
+
--- /dev/null
+From c57db8bcfb285ab9b52273676990e837ac87d61a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 14:55:06 +0300
+Subject: media: s3c-camif: Avoid inappropriate kfree()
+
+From: Katya Orlova <e.orlova@ispras.ru>
+
+[ Upstream commit 61334819aca018c3416ee6c330a08a49c1524fc3 ]
+
+s3c_camif_register_video_node() works with video_device structure stored
+as a field of camif_vp, so it should not be kfreed.
+But there is video_device_release() on error path that do it.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface")
+Signed-off-by: Katya Orlova <e.orlova@ispras.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/samsung/s3c-camif/camif-capture.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/samsung/s3c-camif/camif-capture.c b/drivers/media/platform/samsung/s3c-camif/camif-capture.c
+index db106ebdf870a..bca3cae4dd8bb 100644
+--- a/drivers/media/platform/samsung/s3c-camif/camif-capture.c
++++ b/drivers/media/platform/samsung/s3c-camif/camif-capture.c
+@@ -1132,12 +1132,12 @@ int s3c_camif_register_video_node(struct camif_dev *camif, int idx)
+
+ ret = vb2_queue_init(q);
+ if (ret)
+- goto err_vd_rel;
++ return ret;
+
+ vp->pad.flags = MEDIA_PAD_FL_SINK;
+ ret = media_entity_pads_init(&vfd->entity, 1, &vp->pad);
+ if (ret)
+- goto err_vd_rel;
++ return ret;
+
+ video_set_drvdata(vfd, vp);
+
+@@ -1170,8 +1170,6 @@ int s3c_camif_register_video_node(struct camif_dev *camif, int idx)
+ v4l2_ctrl_handler_free(&vp->ctrl_handler);
+ err_me_cleanup:
+ media_entity_cleanup(&vfd->entity);
+-err_vd_rel:
+- video_device_release(vfd);
+ return ret;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 84ba6455d32924c459565765f13ce47494493e36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Aug 2023 03:39:35 +0200
+Subject: media: verisilicon: Do not enable G2 postproc downscale if source is
+ narrower than destination
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 6e481d52d363218a3e6feb31694da74b38b30fad ]
+
+In case of encoded input VP9 data width that is not multiple of macroblock
+size, which is 16 (e.g. 1080x1920 frames, where 1080 is multiple of 8), the
+width is padded to be a multiple of macroblock size (for 1080x1920 frames,
+that is 1088x1920).
+
+The hantro_postproc_g2_enable() checks whether the encoded data width is
+equal to decoded frame width, and if not, enables down-scale mode. For a
+frame where input is 1080x1920 and output is 1088x1920, this is incorrect
+as no down-scale happens, the frame is only padded. Enabling the down-scale
+mode in this case results in corrupted frames.
+
+Fix this by adjusting the check to test whether encoded data width is
+greater than decoded frame width, and only in that case enable the
+down-scale mode.
+
+To generate input test data to trigger this bug, use e.g.:
+$ gst-launch-1.0 videotestsrc ! video/x-raw,width=272,height=256,format=I420 ! \
+ vp9enc ! matroskamux ! filesink location=/tmp/test.vp9
+To trigger the bug upon decoding (note that the NV12 must be forced, as
+that assures the output data would pass the G2 postproc):
+$ gst-launch-1.0 filesrc location=/tmp/test.vp9 ! matroskademux ! vp9parse ! \
+ v4l2slvp9dec ! video/x-raw,format=NV12 ! videoconvert ! fbdevsink
+
+Fixes: 79c987de8b35 ("media: hantro: Use post processor scaling capacities")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/verisilicon/hantro_postproc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/verisilicon/hantro_postproc.c b/drivers/media/platform/verisilicon/hantro_postproc.c
+index 09d8cf9426895..708095cf09fe2 100644
+--- a/drivers/media/platform/verisilicon/hantro_postproc.c
++++ b/drivers/media/platform/verisilicon/hantro_postproc.c
+@@ -103,7 +103,7 @@ static void hantro_postproc_g1_enable(struct hantro_ctx *ctx)
+
+ static int down_scale_factor(struct hantro_ctx *ctx)
+ {
+- if (ctx->src_fmt.width == ctx->dst_fmt.width)
++ if (ctx->src_fmt.width <= ctx->dst_fmt.width)
+ return 0;
+
+ return DIV_ROUND_CLOSEST(ctx->src_fmt.width, ctx->dst_fmt.width);
+--
+2.42.0
+
--- /dev/null
+From 6077e94860caf130d9035344475976f9543d5192 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jun 2023 16:12:02 +0800
+Subject: media: vidtv: mux: Add check and kfree for kstrdup
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 1fd6eb12642e0c32692924ff359c07de4b781d78 ]
+
+Add check for the return value of kstrdup() and return the error
+if it fails in order to avoid NULL pointer dereference.
+Moreover, use kfree() in the later error handling in order to avoid
+memory leak.
+
+Fixes: c2f78f0cb294 ("media: vidtv: psi: add a Network Information Table (NIT)")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/test-drivers/vidtv/vidtv_mux.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/test-drivers/vidtv/vidtv_mux.c b/drivers/media/test-drivers/vidtv/vidtv_mux.c
+index b51e6a3b8cbeb..f99878eff7ace 100644
+--- a/drivers/media/test-drivers/vidtv/vidtv_mux.c
++++ b/drivers/media/test-drivers/vidtv/vidtv_mux.c
+@@ -504,13 +504,16 @@ struct vidtv_mux *vidtv_mux_init(struct dvb_frontend *fe,
+ m->priv = args->priv;
+ m->network_id = args->network_id;
+ m->network_name = kstrdup(args->network_name, GFP_KERNEL);
++ if (!m->network_name)
++ goto free_mux_buf;
++
+ m->timing.current_jiffies = get_jiffies_64();
+
+ if (args->channels)
+ m->channels = args->channels;
+ else
+ if (vidtv_channels_init(m) < 0)
+- goto free_mux_buf;
++ goto free_mux_network_name;
+
+ /* will alloc data for pmt_sections after initializing pat */
+ if (vidtv_channel_si_init(m) < 0)
+@@ -527,6 +530,8 @@ struct vidtv_mux *vidtv_mux_init(struct dvb_frontend *fe,
+ vidtv_channel_si_destroy(m);
+ free_channels:
+ vidtv_channels_destroy(m);
++free_mux_network_name:
++ kfree(m->network_name);
+ free_mux_buf:
+ vfree(m->mux_buf);
+ free_mux:
+--
+2.42.0
+
--- /dev/null
+From 251df2f67f22f6596bc44e9b03c6c5c12c0e8153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jun 2023 16:12:01 +0800
+Subject: media: vidtv: psi: Add check for kstrdup
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 76a2c5df6ca8bd8ada45e953b8c72b746f42918d ]
+
+Add check for the return value of kstrdup() and return the error
+if it fails in order to avoid NULL pointer dereference.
+
+Fixes: 7a7899f6f58e ("media: vidtv: psi: Implement an Event Information Table (EIT)")
+Fixes: c2f78f0cb294 ("media: vidtv: psi: add a Network Information Table (NIT)")
+Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/test-drivers/vidtv/vidtv_psi.c | 45 +++++++++++++++++---
+ 1 file changed, 40 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/test-drivers/vidtv/vidtv_psi.c b/drivers/media/test-drivers/vidtv/vidtv_psi.c
+index a5875380ef407..c45828bc5b278 100644
+--- a/drivers/media/test-drivers/vidtv/vidtv_psi.c
++++ b/drivers/media/test-drivers/vidtv/vidtv_psi.c
+@@ -301,16 +301,29 @@ struct vidtv_psi_desc_service *vidtv_psi_service_desc_init(struct vidtv_psi_desc
+
+ desc->service_name_len = service_name_len;
+
+- if (service_name && service_name_len)
++ if (service_name && service_name_len) {
+ desc->service_name = kstrdup(service_name, GFP_KERNEL);
++ if (!desc->service_name)
++ goto free_desc;
++ }
+
+ desc->provider_name_len = provider_name_len;
+
+- if (provider_name && provider_name_len)
++ if (provider_name && provider_name_len) {
+ desc->provider_name = kstrdup(provider_name, GFP_KERNEL);
++ if (!desc->provider_name)
++ goto free_desc_service_name;
++ }
+
+ vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);
+ return desc;
++
++free_desc_service_name:
++ if (service_name && service_name_len)
++ kfree(desc->service_name);
++free_desc:
++ kfree(desc);
++ return NULL;
+ }
+
+ struct vidtv_psi_desc_registration
+@@ -355,8 +368,13 @@ struct vidtv_psi_desc_network_name
+
+ desc->length = network_name_len;
+
+- if (network_name && network_name_len)
++ if (network_name && network_name_len) {
+ desc->network_name = kstrdup(network_name, GFP_KERNEL);
++ if (!desc->network_name) {
++ kfree(desc);
++ return NULL;
++ }
++ }
+
+ vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);
+ return desc;
+@@ -442,15 +460,32 @@ struct vidtv_psi_desc_short_event
+ iso_language_code = "eng";
+
+ desc->iso_language_code = kstrdup(iso_language_code, GFP_KERNEL);
++ if (!desc->iso_language_code)
++ goto free_desc;
+
+- if (event_name && event_name_len)
++ if (event_name && event_name_len) {
+ desc->event_name = kstrdup(event_name, GFP_KERNEL);
++ if (!desc->event_name)
++ goto free_desc_language_code;
++ }
+
+- if (text && text_len)
++ if (text && text_len) {
+ desc->text = kstrdup(text, GFP_KERNEL);
++ if (!desc->text)
++ goto free_desc_event_name;
++ }
+
+ vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);
+ return desc;
++
++free_desc_event_name:
++ if (event_name && event_name_len)
++ kfree(desc->event_name);
++free_desc_language_code:
++ kfree(desc->iso_language_code);
++free_desc:
++ kfree(desc);
++ return NULL;
+ }
+
+ struct vidtv_psi_desc *vidtv_psi_desc_clone(struct vidtv_psi_desc *desc)
+--
+2.42.0
+
--- /dev/null
+From aff479b76ba1279385b3343b3344a9f8f7d5e552 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Oct 2023 22:54:14 +0200
+Subject: mfd: arizona-spi: Set pdata.hpdet_channel for ACPI enumerated devs
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 831d1af85133e1763d41e20414912d9a1058ea72 ]
+
+Commit 9e86b2ad4c11 changed the channel used for HPDET detection
+(headphones vs lineout detection) from being hardcoded to
+ARIZONA_ACCDET_MODE_HPL (HP left channel) to it being configurable
+through arizona_pdata.hpdet_channel the DT/OF parsing added for
+filling arizona_pdata on devicetree platforms ensures that
+arizona_pdata.hpdet_channel gets set to ARIZONA_ACCDET_MODE_HPL
+when not specified in the devicetree-node.
+
+But on ACPI platforms where arizona_pdata is filled by
+arizona_spi_acpi_probe() arizona_pdata.hpdet_channel was not
+getting set, causing it to default to 0 aka ARIZONA_ACCDET_MODE_MIC.
+
+This causes headphones to get misdetected as line-out on some models.
+Fix this by setting hpdet_channel = ARIZONA_ACCDET_MODE_HPL.
+
+Fixes: e933836744a2 ("mfd: arizona: Add support for ACPI enumeration of WM5102 connected over SPI")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20231014205414.59415-1-hdegoede@redhat.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/arizona-spi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/arizona-spi.c b/drivers/mfd/arizona-spi.c
+index 5c4af05ed0440..3f83a77ce69e7 100644
+--- a/drivers/mfd/arizona-spi.c
++++ b/drivers/mfd/arizona-spi.c
+@@ -159,6 +159,9 @@ static int arizona_spi_acpi_probe(struct arizona *arizona)
+ arizona->pdata.micd_ranges = arizona_micd_aosp_ranges;
+ arizona->pdata.num_micd_ranges = ARRAY_SIZE(arizona_micd_aosp_ranges);
+
++ /* Use left headphone speaker for HP vs line-out detection */
++ arizona->pdata.hpdet_channel = ARIZONA_ACCDET_MODE_HPL;
++
+ return 0;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 23a49e2f98b63f8daab5adbe047326ef78394209 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Aug 2023 18:39:17 +0200
+Subject: mfd: core: Ensure disabled devices are skipped without aborting
+
+From: Herve Codina <herve.codina@bootlin.com>
+
+[ Upstream commit 7ba7bdef4d14e3722e2842da3b48cbadb73e52d6 ]
+
+The loop searching for a matching device based on its compatible
+string is aborted when a matching disabled device is found.
+This abort prevents to add devices as soon as one disabled device
+is found.
+
+Continue searching for an other device instead of aborting on the
+first disabled one fixes the issue.
+
+Fixes: 22380b65dc70 ("mfd: mfd-core: Ensure disabled devices are ignored without error")
+Signed-off-by: Herve Codina <herve.codina@bootlin.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://lore.kernel.org/r/528425d6472176bb1d02d79596b51f8c28a551cc.1692376361.git.christophe.leroy@csgroup.eu
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mfd-core.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
+index 16d1861e96823..97909e3e2c303 100644
+--- a/drivers/mfd/mfd-core.c
++++ b/drivers/mfd/mfd-core.c
+@@ -176,6 +176,7 @@ static int mfd_add_device(struct device *parent, int id,
+ struct platform_device *pdev;
+ struct device_node *np = NULL;
+ struct mfd_of_node_entry *of_entry, *tmp;
++ bool disabled = false;
+ int ret = -ENOMEM;
+ int platform_id;
+ int r;
+@@ -213,11 +214,10 @@ static int mfd_add_device(struct device *parent, int id,
+ if (IS_ENABLED(CONFIG_OF) && parent->of_node && cell->of_compatible) {
+ for_each_child_of_node(parent->of_node, np) {
+ if (of_device_is_compatible(np, cell->of_compatible)) {
+- /* Ignore 'disabled' devices error free */
++ /* Skip 'disabled' devices */
+ if (!of_device_is_available(np)) {
+- of_node_put(np);
+- ret = 0;
+- goto fail_alias;
++ disabled = true;
++ continue;
+ }
+
+ ret = mfd_match_of_node_to_dev(pdev, np, cell);
+@@ -227,10 +227,17 @@ static int mfd_add_device(struct device *parent, int id,
+ if (ret)
+ goto fail_alias;
+
+- break;
++ goto match;
+ }
+ }
+
++ if (disabled) {
++ /* Ignore 'disabled' devices error free */
++ ret = 0;
++ goto fail_alias;
++ }
++
++match:
+ if (!pdev->dev.of_node)
+ pr_warn("%s: Failed to locate of_node [id: %d]\n",
+ cell->name, platform_id);
+--
+2.42.0
+
--- /dev/null
+From 540a77e513fda300f4b975d4fe3de749328e7210 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 22:16:11 +0200
+Subject: mfd: core: Un-constify mfd_cell.of_reg
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+[ Upstream commit 3c70342f1f0045dc827bb2f02d814ce31e0e0d05 ]
+
+Enable dynamically filling in the whole mfd_cell structure. All other
+fields already allow that.
+
+Fixes: 466a62d7642f ("mfd: core: Make a best effort attempt to match devices with the correct of_nodes")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Link: https://lore.kernel.org/r/b73fe4bc4bd6ba1af90940a640ed65fe254c0408.1693253717.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mfd/core.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/mfd/core.h b/include/linux/mfd/core.h
+index 0bc7cba798a34..b449765b5cac1 100644
+--- a/include/linux/mfd/core.h
++++ b/include/linux/mfd/core.h
+@@ -92,7 +92,7 @@ struct mfd_cell {
+ * (above) when matching OF nodes with devices that have identical
+ * compatible strings
+ */
+- const u64 of_reg;
++ u64 of_reg;
+
+ /* Set to 'true' to use 'of_reg' (above) - allows for of_reg=0 */
+ bool use_of_reg;
+--
+2.42.0
+
--- /dev/null
+From c5514a995559daf1896db3ccb1e4c881c4ae953f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 10:41:33 +0800
+Subject: mfd: dln2: Fix double put in dln2_probe
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 759c409bc5fc496cbc22cd0b392d3cbb0c0e23eb ]
+
+The dln2_free() already contains usb_put_dev(). Therefore,
+the redundant usb_put_dev() before dln2_free() may lead to
+a double free.
+
+Fixes: 96da8f148396 ("mfd: dln2: Fix memory leak in dln2_probe()")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Link: https://lore.kernel.org/r/20230925024134.9683-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/dln2.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
+index c3149729cec2e..6cd0b0c752d6e 100644
+--- a/drivers/mfd/dln2.c
++++ b/drivers/mfd/dln2.c
+@@ -827,7 +827,6 @@ static int dln2_probe(struct usb_interface *interface,
+ dln2_stop_rx_urbs(dln2);
+
+ out_free:
+- usb_put_dev(dln2->usb_dev);
+ dln2_free(dln2);
+
+ return ret;
+--
+2.42.0
+
--- /dev/null
+From 3034f9d8d4518b6cbc95622dd29c3f3286c54382 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Aug 2023 11:50:20 +0800
+Subject: misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 4d08c3d12b61022501989f9f071514d2d6f77c47 ]
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with hardware interrupts being disabled.
+So replace kfree_skb() with dev_kfree_skb_irq() under
+spin_lock_irqsave(). Compile tested only.
+
+Fixes: 53618cc1e51e ("Staging: sources for ST core")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://lore.kernel.org/r/20230823035020.1281892-1-ruanjinjie@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/ti-st/st_core.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
+index 7f6976a9f508b..48e0f8377e659 100644
+--- a/drivers/misc/ti-st/st_core.c
++++ b/drivers/misc/ti-st/st_core.c
+@@ -15,6 +15,7 @@
+ #include <linux/skbuff.h>
+
+ #include <linux/ti_wilink_st.h>
++#include <linux/netdevice.h>
+
+ extern void st_kim_recv(void *, const unsigned char *, long);
+ void st_int_recv(void *, const unsigned char *, long);
+@@ -435,7 +436,7 @@ static void st_int_enqueue(struct st_data_s *st_gdata, struct sk_buff *skb)
+ case ST_LL_AWAKE_TO_ASLEEP:
+ pr_err("ST LL is illegal state(%ld),"
+ "purging received skb.", st_ll_getstate(st_gdata));
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ break;
+ case ST_LL_ASLEEP:
+ skb_queue_tail(&st_gdata->tx_waitq, skb);
+@@ -444,7 +445,7 @@ static void st_int_enqueue(struct st_data_s *st_gdata, struct sk_buff *skb)
+ default:
+ pr_err("ST LL is illegal state(%ld),"
+ "purging received skb.", st_ll_getstate(st_gdata));
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ break;
+ }
+
+@@ -498,7 +499,7 @@ void st_tx_wakeup(struct st_data_s *st_data)
+ spin_unlock_irqrestore(&st_data->lock, flags);
+ break;
+ }
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ spin_unlock_irqrestore(&st_data->lock, flags);
+ }
+ /* if wake-up is set in another context- restart sending */
+--
+2.42.0
+
--- /dev/null
+From 0fd5249b475df72a56f77980978d5157c64e0658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 13:01:23 -0600
+Subject: mlxsw: Use size_mul() in call to struct_size()
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit e22c6ea025013ae447fe269269753ffec763dde5 ]
+
+If, for any reason, the open-coded arithmetic causes a wraparound, the
+protection that `struct_size()` adds against potential integer overflows
+is defeated. Fix this by hardening call to `struct_size()` with `size_mul()`.
+
+Fixes: 2285ec872d9d ("mlxsw: spectrum_acl_bloom_filter: use struct_size() in kzalloc()")
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
+index e2aced7ab4547..95f63fcf4ba1f 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
+@@ -496,7 +496,7 @@ mlxsw_sp_acl_bf_init(struct mlxsw_sp *mlxsw_sp, unsigned int num_erp_banks)
+ * is 2^ACL_MAX_BF_LOG
+ */
+ bf_bank_size = 1 << MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_BF_LOG);
+- bf = kzalloc(struct_size(bf, refcnt, bf_bank_size * num_erp_banks),
++ bf = kzalloc(struct_size(bf, refcnt, size_mul(bf_bank_size, num_erp_banks)),
+ GFP_KERNEL);
+ if (!bf)
+ return ERR_PTR(-ENOMEM);
+--
+2.42.0
+
--- /dev/null
+From 0d64e02d16cfac965d52f33ae1ffe28d7be39b07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Oct 2023 02:04:45 +0900
+Subject: modpost: fix ishtp MODULE_DEVICE_TABLE built on big-endian host
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit ac96a15a0f0c8812a3aaa587b871cd5527f6d736 ]
+
+When MODULE_DEVICE_TABLE(ishtp, ) is built on a host with a different
+endianness from the target architecture, it results in an incorrect
+MODULE_ALIAS().
+
+For example, see a case where drivers/platform/x86/intel/ishtp_eclite.c
+is built as a module for x86.
+
+If you build it on a little-endian host, you will get the correct
+MODULE_ALIAS:
+
+ $ grep MODULE_ALIAS drivers/platform/x86/intel/ishtp_eclite.mod.c
+ MODULE_ALIAS("ishtp:{6A19CC4B-D760-4DE3-B14D-F25EBD0FBCD9}");
+
+However, if you build it on a big-endian host, you will get a wrong
+MODULE_ALIAS:
+
+ $ grep MODULE_ALIAS drivers/platform/x86/intel/ishtp_eclite.mod.c
+ MODULE_ALIAS("ishtp:{BD0FBCD9-F25E-B14D-4DE3-D7606A19CC4B}");
+
+This issue has been unnoticed because the x86 kernel is most likely built
+natively on an x86 host.
+
+The guid field must not be reversed because guid_t is an array of __u8.
+
+Fixes: fa443bc3c1e4 ("HID: intel-ish-hid: add support for MODULE_DEVICE_TABLE()")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>
+Tested-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/file2alias.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index ebc3e5a8f797e..39e2c8883ddd4 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -1401,10 +1401,10 @@ static int do_mhi_ep_entry(const char *filename, void *symval, char *alias)
+ /* Looks like: ishtp:{guid} */
+ static int do_ishtp_entry(const char *filename, void *symval, char *alias)
+ {
+- DEF_FIELD(symval, ishtp_device_id, guid);
++ DEF_FIELD_ADDR(symval, ishtp_device_id, guid);
+
+ strcpy(alias, ISHTP_MODULE_PREFIX "{");
+- add_guid(alias, guid);
++ add_guid(alias, *guid);
+ strcat(alias, "}");
+
+ return 1;
+--
+2.42.0
+
--- /dev/null
+From 6e2c8652f487556b23c8c34b36c71d3c314b0230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Oct 2023 02:04:44 +0900
+Subject: modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 7f54e00e5842663c2cea501bbbdfa572c94348a3 ]
+
+When MODULE_DEVICE_TABLE(tee, ) is built on a host with a different
+endianness from the target architecture, it results in an incorrect
+MODULE_ALIAS().
+
+For example, see a case where drivers/char/hw_random/optee-rng.c
+is built as a module for ARM little-endian.
+
+If you build it on a little-endian host, you will get the correct
+MODULE_ALIAS:
+
+ $ grep MODULE_ALIAS drivers/char/hw_random/optee-rng.mod.c
+ MODULE_ALIAS("tee:ab7a617c-b8e7-4d8f-8301-d09b61036b64*");
+
+However, if you build it on a big-endian host, you will get a wrong
+MODULE_ALIAS:
+
+ $ grep MODULE_ALIAS drivers/char/hw_random/optee-rng.mod.c
+ MODULE_ALIAS("tee:646b0361-9bd0-0183-8f4d-e7b87c617aab*");
+
+The same problem also occurs when you enable CONFIG_CPU_BIG_ENDIAN,
+and build it on a little-endian host.
+
+This issue has been unnoticed because the ARM kernel is configured for
+little-endian by default, and most likely built on a little-endian host
+(cross-build on x86 or native-build on ARM).
+
+The uuid field must not be reversed because uuid_t is an array of __u8.
+
+Fixes: 0fc1db9d1059 ("tee: add bus driver framework for TEE based devices")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/file2alias.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index 111d5464c12df..ebc3e5a8f797e 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -1348,13 +1348,13 @@ static int do_typec_entry(const char *filename, void *symval, char *alias)
+ /* Looks like: tee:uuid */
+ static int do_tee_entry(const char *filename, void *symval, char *alias)
+ {
+- DEF_FIELD(symval, tee_client_device_id, uuid);
++ DEF_FIELD_ADDR(symval, tee_client_device_id, uuid);
+
+ sprintf(alias, "tee:%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
+- uuid.b[0], uuid.b[1], uuid.b[2], uuid.b[3], uuid.b[4],
+- uuid.b[5], uuid.b[6], uuid.b[7], uuid.b[8], uuid.b[9],
+- uuid.b[10], uuid.b[11], uuid.b[12], uuid.b[13], uuid.b[14],
+- uuid.b[15]);
++ uuid->b[0], uuid->b[1], uuid->b[2], uuid->b[3], uuid->b[4],
++ uuid->b[5], uuid->b[6], uuid->b[7], uuid->b[8], uuid->b[9],
++ uuid->b[10], uuid->b[11], uuid->b[12], uuid->b[13], uuid->b[14],
++ uuid->b[15]);
+
+ add_wildcard(alias);
+ return 1;
+--
+2.42.0
+
--- /dev/null
+From e57d278b30eef0f8243fdc08d66e060067fdd3c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Aug 2023 17:58:20 +0200
+Subject: module/decompress: use vmalloc() for gzip decompression workspace
+
+From: Andrea Righi <andrea.righi@canonical.com>
+
+[ Upstream commit 3737df782c740b944912ed93420c57344b1cf864 ]
+
+Use a similar approach as commit a419beac4a07 ("module/decompress: use
+vmalloc() for zstd decompression workspace") and replace kmalloc() with
+vmalloc() also for the gzip module decompression workspace.
+
+In this case the workspace is represented by struct inflate_workspace
+that can be fairly large for kmalloc() and it can potentially lead to
+allocation errors on certain systems:
+
+$ pahole inflate_workspace
+struct inflate_workspace {
+ struct inflate_state inflate_state; /* 0 9544 */
+ /* --- cacheline 149 boundary (9536 bytes) was 8 bytes ago --- */
+ unsigned char working_window[32768]; /* 9544 32768 */
+
+ /* size: 42312, cachelines: 662, members: 2 */
+ /* last cacheline: 8 bytes */
+};
+
+Considering that there is no need to use continuous physical memory,
+simply switch to vmalloc() to provide a more reliable in-kernel module
+decompression.
+
+Fixes: b1ae6dc41eaa ("module: add in-kernel support for decompressing")
+Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module/decompress.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/module/decompress.c b/kernel/module/decompress.c
+index 720e719253cd1..e1e9f69c5dd16 100644
+--- a/kernel/module/decompress.c
++++ b/kernel/module/decompress.c
+@@ -100,7 +100,7 @@ static ssize_t module_gzip_decompress(struct load_info *info,
+ s.next_in = buf + gzip_hdr_len;
+ s.avail_in = size - gzip_hdr_len;
+
+- s.workspace = kmalloc(zlib_inflate_workspacesize(), GFP_KERNEL);
++ s.workspace = vmalloc(zlib_inflate_workspacesize());
+ if (!s.workspace)
+ return -ENOMEM;
+
+@@ -138,7 +138,7 @@ static ssize_t module_gzip_decompress(struct load_info *info,
+ out_inflate_end:
+ zlib_inflateEnd(&s);
+ out:
+- kfree(s.workspace);
++ vfree(s.workspace);
+ return retval;
+ }
+ #elif CONFIG_MODULE_COMPRESS_XZ
+--
+2.42.0
+
--- /dev/null
+From 1efb5806d4d491b8598da9e6148ffc6a882953c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Sep 2023 07:37:12 +0200
+Subject: nd_btt: Make BTT lanes preemptible
+
+From: Tomas Glozar <tglozar@redhat.com>
+
+[ Upstream commit 36c75ce3bd299878fd9b238e9803d3817ddafbf3 ]
+
+nd_region_acquire_lane uses get_cpu, which disables preemption. This is
+an issue on PREEMPT_RT kernels, since btt_write_pg and also
+nd_region_acquire_lane itself take a spin lock, resulting in BUG:
+sleeping function called from invalid context.
+
+Fix the issue by replacing get_cpu with smp_process_id and
+migrate_disable when needed. This makes BTT operations preemptible, thus
+permitting the use of spin_lock.
+
+BUG example occurring when running ndctl tests on PREEMPT_RT kernel:
+
+BUG: sleeping function called from invalid context at
+kernel/locking/spinlock_rt.c:48
+in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4903, name:
+libndctl
+preempt_count: 1, expected: 0
+RCU nest depth: 0, expected: 0
+Preemption disabled at:
+[<ffffffffc1313db5>] nd_region_acquire_lane+0x15/0x90 [libnvdimm]
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x8e/0xb0
+ __might_resched+0x19b/0x250
+ rt_spin_lock+0x4c/0x100
+ ? btt_write_pg+0x2d7/0x500 [nd_btt]
+ btt_write_pg+0x2d7/0x500 [nd_btt]
+ ? local_clock_noinstr+0x9/0xc0
+ btt_submit_bio+0x16d/0x270 [nd_btt]
+ __submit_bio+0x48/0x80
+ __submit_bio_noacct+0x7e/0x1e0
+ submit_bio_wait+0x58/0xb0
+ __blkdev_direct_IO_simple+0x107/0x240
+ ? inode_set_ctime_current+0x51/0x110
+ ? __pfx_submit_bio_wait_endio+0x10/0x10
+ blkdev_write_iter+0x1d8/0x290
+ vfs_write+0x237/0x330
+ ...
+ </TASK>
+
+Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
+Signed-off-by: Tomas Glozar <tglozar@redhat.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/region_devs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
+index e0875d3697624..7995f93db2a82 100644
+--- a/drivers/nvdimm/region_devs.c
++++ b/drivers/nvdimm/region_devs.c
+@@ -892,7 +892,8 @@ unsigned int nd_region_acquire_lane(struct nd_region *nd_region)
+ {
+ unsigned int cpu, lane;
+
+- cpu = get_cpu();
++ migrate_disable();
++ cpu = smp_processor_id();
+ if (nd_region->num_lanes < nr_cpu_ids) {
+ struct nd_percpu_lane *ndl_lock, *ndl_count;
+
+@@ -911,16 +912,15 @@ EXPORT_SYMBOL(nd_region_acquire_lane);
+ void nd_region_release_lane(struct nd_region *nd_region, unsigned int lane)
+ {
+ if (nd_region->num_lanes < nr_cpu_ids) {
+- unsigned int cpu = get_cpu();
++ unsigned int cpu = smp_processor_id();
+ struct nd_percpu_lane *ndl_lock, *ndl_count;
+
+ ndl_count = per_cpu_ptr(nd_region->lane, cpu);
+ ndl_lock = per_cpu_ptr(nd_region->lane, lane);
+ if (--ndl_count->count == 0)
+ spin_unlock(&ndl_lock->lock);
+- put_cpu();
+ }
+- put_cpu();
++ migrate_enable();
+ }
+ EXPORT_SYMBOL(nd_region_release_lane);
+
+--
+2.42.0
+
--- /dev/null
+From 5fc1d360ee19f95fc5b051702acd536c368020d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 08:52:16 +0000
+Subject: net: add DEV_STATS_READ() helper
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 0b068c714ca9479d2783cc333fff5bc2d4a6d45c ]
+
+Companion of DEV_STATS_INC() & DEV_STATS_ADD().
+
+This is going to be used in the series.
+
+Use it in macsec_get_stats64().
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: ff672b9ffeb3 ("ipvlan: properly track tx_errors")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/macsec.c | 6 +++---
+ include/linux/netdevice.h | 1 +
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 81453e84b6413..209ee9f352754 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -3664,9 +3664,9 @@ static void macsec_get_stats64(struct net_device *dev,
+
+ dev_fetch_sw_netstats(s, dev->tstats);
+
+- s->rx_dropped = atomic_long_read(&dev->stats.__rx_dropped);
+- s->tx_dropped = atomic_long_read(&dev->stats.__tx_dropped);
+- s->rx_errors = atomic_long_read(&dev->stats.__rx_errors);
++ s->rx_dropped = DEV_STATS_READ(dev, rx_dropped);
++ s->tx_dropped = DEV_STATS_READ(dev, tx_dropped);
++ s->rx_errors = DEV_STATS_READ(dev, rx_errors);
+ }
+
+ static int macsec_get_iflink(const struct net_device *dev)
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 5a04fbf724768..0373e09359905 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -5190,5 +5190,6 @@ extern struct net_device *blackhole_netdev;
+ #define DEV_STATS_INC(DEV, FIELD) atomic_long_inc(&(DEV)->stats.__##FIELD)
+ #define DEV_STATS_ADD(DEV, FIELD, VAL) \
+ atomic_long_add((VAL), &(DEV)->stats.__##FIELD)
++#define DEV_STATS_READ(DEV, FIELD) atomic_long_read(&(DEV)->stats.__##FIELD)
+
+ #endif /* _LINUX_NETDEVICE_H */
+--
+2.42.0
+
--- /dev/null
+From 355dd4daff23676d0d3ca599a721ec2ddbda15f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Sep 2023 12:29:11 +0200
+Subject: net: ethernet: mtk_wed: fix EXT_INT_STATUS_RX_FBUF definitions for
+ MT7986 SoC
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit c80471ba74b7f332ac19b985ccb76d852d507acf ]
+
+Fix MTK_WED_EXT_INT_STATUS_RX_FBUF_LO_TH and
+MTK_WED_EXT_INT_STATUS_RX_FBUF_HI_TH definitions for MT7986 (MT7986 is
+the only SoC to use them).
+
+Fixes: de84a090d99a ("net: ethernet: mtk_eth_wed: add wed support for mt7986 chipset")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed_regs.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_wed_regs.h b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+index e270fb3361432..14cd44f8191ba 100644
+--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+@@ -51,8 +51,8 @@ struct mtk_wdma_desc {
+ #define MTK_WED_EXT_INT_STATUS_TKID_TITO_INVALID BIT(4)
+ #define MTK_WED_EXT_INT_STATUS_TX_FBUF_LO_TH BIT(8)
+ #define MTK_WED_EXT_INT_STATUS_TX_FBUF_HI_TH BIT(9)
+-#define MTK_WED_EXT_INT_STATUS_RX_FBUF_LO_TH BIT(12)
+-#define MTK_WED_EXT_INT_STATUS_RX_FBUF_HI_TH BIT(13)
++#define MTK_WED_EXT_INT_STATUS_RX_FBUF_LO_TH BIT(10) /* wed v2 */
++#define MTK_WED_EXT_INT_STATUS_RX_FBUF_HI_TH BIT(11) /* wed v2 */
+ #define MTK_WED_EXT_INT_STATUS_RX_DRV_R_RESP_ERR BIT(16)
+ #define MTK_WED_EXT_INT_STATUS_RX_DRV_W_RESP_ERR BIT(17)
+ #define MTK_WED_EXT_INT_STATUS_RX_DRV_COHERENT BIT(18)
+--
+2.42.0
+
--- /dev/null
+From 526d2a04e55176861a1669aa9cd567b650dd8185 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 11:39:06 +0200
+Subject: net: skb_find_text: Ignore patterns extending past 'to'
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit c4eee56e14fe001e1cff54f0b438a5e2d0dd7454 ]
+
+Assume that caller's 'to' offset really represents an upper boundary for
+the pattern search, so patterns extending past this offset are to be
+rejected.
+
+The old behaviour also was kind of inconsistent when it comes to
+fragmentation (or otherwise non-linear skbs): If the pattern started in
+between 'to' and 'from' offsets but extended to the next fragment, it
+was not found if 'to' offset was still within the current fragment.
+
+Test the new behaviour in a kselftest using iptables' string match.
+
+Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Fixes: f72b948dcbb8 ("[NET]: skb_find_text ignores to argument")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Reviewed-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 3 +-
+ tools/testing/selftests/netfilter/Makefile | 2 +-
+ .../testing/selftests/netfilter/xt_string.sh | 128 ++++++++++++++++++
+ 3 files changed, 131 insertions(+), 2 deletions(-)
+ create mode 100755 tools/testing/selftests/netfilter/xt_string.sh
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 8dca4a7ca4a1f..73b1e0e53534e 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3958,6 +3958,7 @@ static void skb_ts_finish(struct ts_config *conf, struct ts_state *state)
+ unsigned int skb_find_text(struct sk_buff *skb, unsigned int from,
+ unsigned int to, struct ts_config *config)
+ {
++ unsigned int patlen = config->ops->get_pattern_len(config);
+ struct ts_state state;
+ unsigned int ret;
+
+@@ -3969,7 +3970,7 @@ unsigned int skb_find_text(struct sk_buff *skb, unsigned int from,
+ skb_prepare_seq_read(skb, from, to, TS_SKB_CB(&state));
+
+ ret = textsearch_find(config, &state);
+- return (ret <= to - from ? ret : UINT_MAX);
++ return (ret + patlen <= to - from ? ret : UINT_MAX);
+ }
+ EXPORT_SYMBOL(skb_find_text);
+
+diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
+index ef90aca4cc96a..bced422b78f72 100644
+--- a/tools/testing/selftests/netfilter/Makefile
++++ b/tools/testing/selftests/netfilter/Makefile
+@@ -7,7 +7,7 @@ TEST_PROGS := nft_trans_stress.sh nft_fib.sh nft_nat.sh bridge_brouter.sh \
+ nft_queue.sh nft_meta.sh nf_nat_edemux.sh \
+ ipip-conntrack-mtu.sh conntrack_tcp_unreplied.sh \
+ conntrack_vrf.sh nft_synproxy.sh rpath.sh nft_audit.sh \
+- conntrack_sctp_collision.sh
++ conntrack_sctp_collision.sh xt_string.sh
+
+ HOSTPKG_CONFIG := pkg-config
+
+diff --git a/tools/testing/selftests/netfilter/xt_string.sh b/tools/testing/selftests/netfilter/xt_string.sh
+new file mode 100755
+index 0000000000000..1802653a47287
+--- /dev/null
++++ b/tools/testing/selftests/netfilter/xt_string.sh
+@@ -0,0 +1,128 @@
++#!/bin/bash
++# SPDX-License-Identifier: GPL-2.0
++
++# return code to signal skipped test
++ksft_skip=4
++rc=0
++
++if ! iptables --version >/dev/null 2>&1; then
++ echo "SKIP: Test needs iptables"
++ exit $ksft_skip
++fi
++if ! ip -V >/dev/null 2>&1; then
++ echo "SKIP: Test needs iproute2"
++ exit $ksft_skip
++fi
++if ! nc -h >/dev/null 2>&1; then
++ echo "SKIP: Test needs netcat"
++ exit $ksft_skip
++fi
++
++pattern="foo bar baz"
++patlen=11
++hdrlen=$((20 + 8)) # IPv4 + UDP
++ns="ns-$(mktemp -u XXXXXXXX)"
++trap 'ip netns del $ns' EXIT
++ip netns add "$ns"
++ip -net "$ns" link add d0 type dummy
++ip -net "$ns" link set d0 up
++ip -net "$ns" addr add 10.1.2.1/24 dev d0
++
++#ip netns exec "$ns" tcpdump -npXi d0 &
++#tcpdump_pid=$!
++#trap 'kill $tcpdump_pid; ip netns del $ns' EXIT
++
++add_rule() { # (alg, from, to)
++ ip netns exec "$ns" \
++ iptables -A OUTPUT -o d0 -m string \
++ --string "$pattern" --algo $1 --from $2 --to $3
++}
++showrules() { # ()
++ ip netns exec "$ns" iptables -v -S OUTPUT | grep '^-A'
++}
++zerorules() {
++ ip netns exec "$ns" iptables -Z OUTPUT
++}
++countrule() { # (pattern)
++ showrules | grep -c -- "$*"
++}
++send() { # (offset)
++ ( for ((i = 0; i < $1 - $hdrlen; i++)); do
++ printf " "
++ done
++ printf "$pattern"
++ ) | ip netns exec "$ns" nc -w 1 -u 10.1.2.2 27374
++}
++
++add_rule bm 1000 1500
++add_rule bm 1400 1600
++add_rule kmp 1000 1500
++add_rule kmp 1400 1600
++
++zerorules
++send 0
++send $((1000 - $patlen))
++if [ $(countrule -c 0 0) -ne 4 ]; then
++ echo "FAIL: rules match data before --from"
++ showrules
++ ((rc--))
++fi
++
++zerorules
++send 1000
++send $((1400 - $patlen))
++if [ $(countrule -c 2) -ne 2 ]; then
++ echo "FAIL: only two rules should match at low offset"
++ showrules
++ ((rc--))
++fi
++
++zerorules
++send $((1500 - $patlen))
++if [ $(countrule -c 1) -ne 4 ]; then
++ echo "FAIL: all rules should match at end of packet"
++ showrules
++ ((rc--))
++fi
++
++zerorules
++send 1495
++if [ $(countrule -c 1) -ne 1 ]; then
++ echo "FAIL: only kmp with proper --to should match pattern spanning fragments"
++ showrules
++ ((rc--))
++fi
++
++zerorules
++send 1500
++if [ $(countrule -c 1) -ne 2 ]; then
++ echo "FAIL: two rules should match pattern at start of second fragment"
++ showrules
++ ((rc--))
++fi
++
++zerorules
++send $((1600 - $patlen))
++if [ $(countrule -c 1) -ne 2 ]; then
++ echo "FAIL: two rules should match pattern at end of largest --to"
++ showrules
++ ((rc--))
++fi
++
++zerorules
++send $((1600 - $patlen + 1))
++if [ $(countrule -c 1) -ne 0 ]; then
++ echo "FAIL: no rules should match pattern extending largest --to"
++ showrules
++ ((rc--))
++fi
++
++zerorules
++send 1600
++if [ $(countrule -c 1) -ne 0 ]; then
++ echo "FAIL: no rule should match pattern past largest --to"
++ showrules
++ ((rc--))
++fi
++
++exit $rc
+--
+2.42.0
+
--- /dev/null
+From 94eb1ca7c3e2be20dc5d24d0f874d8ab4ca53909 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 13:25:36 -0600
+Subject: net: spider_net: Use size_add() in call to struct_size()
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit 0201409079b975e46cc40e8bdff4bd61329ee10f ]
+
+If, for any reason, the open-coded arithmetic causes a wraparound,
+the protection that `struct_size()` adds against potential integer
+overflows is defeated. Fix this by hardening call to `struct_size()`
+with `size_add()`.
+
+Fixes: 3f1071ec39f7 ("net: spider_net: Use struct_size() helper")
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Geoff Levand <geoff@infradead.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/toshiba/spider_net.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c
+index 50d7eacfec582..87e67121477cb 100644
+--- a/drivers/net/ethernet/toshiba/spider_net.c
++++ b/drivers/net/ethernet/toshiba/spider_net.c
+@@ -2332,7 +2332,7 @@ spider_net_alloc_card(void)
+ struct spider_net_card *card;
+
+ netdev = alloc_etherdev(struct_size(card, darray,
+- tx_descriptors + rx_descriptors));
++ size_add(tx_descriptors, rx_descriptors)));
+ if (!netdev)
+ return NULL;
+
+--
+2.42.0
+
--- /dev/null
+From a4b6df62013d92bacd282c935a4c31bbb54c4099 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 21:19:19 +0200
+Subject: netfilter: nf_tables: Drop pointless memset when dumping rules
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 30fa41a0f6df4c85790cc6499ddc4a926a113bfa ]
+
+None of the dump callbacks uses netlink_callback::args beyond the first
+element, no need to zero the data.
+
+Fixes: 96518518cc41 ("netfilter: add nftables")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 5c783199b4999..d6d59e36d17a7 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3279,10 +3279,6 @@ static int __nf_tables_dump_rules(struct sk_buff *skb,
+ goto cont_skip;
+ if (*idx < s_idx)
+ goto cont;
+- if (*idx > s_idx) {
+- memset(&cb->args[1], 0,
+- sizeof(cb->args) - sizeof(cb->args[0]));
+- }
+ if (prule)
+ handle = prule->handle;
+ else
+--
+2.42.0
+
--- /dev/null
+From 0530c150de6acd429c0b1ab2ef9842eee7c213ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 17:08:18 -0700
+Subject: objtool: Propagate early errors
+
+From: Aaron Plattner <aplattner@nvidia.com>
+
+[ Upstream commit e959c279d391c10b35ce300fb4b0fe3b98e86bd2 ]
+
+If objtool runs into a problem that causes it to exit early, the overall
+tool still returns a status code of 0, which causes the build to
+continue as if nothing went wrong.
+
+Note this only affects early errors, as later errors are still ignored
+by check().
+
+Fixes: b51277eb9775 ("objtool: Ditch subcommands")
+Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
+Link: https://lore.kernel.org/r/cb6a28832d24b2ebfafd26da9abb95f874c83045.1696355111.git.aplattner@nvidia.com
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/objtool.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/tools/objtool/objtool.c b/tools/objtool/objtool.c
+index a7ecc32e35125..cda649644e32d 100644
+--- a/tools/objtool/objtool.c
++++ b/tools/objtool/objtool.c
+@@ -146,7 +146,5 @@ int main(int argc, const char **argv)
+ exec_cmd_init("objtool", UNUSED, UNUSED, UNUSED);
+ pager_init(UNUSED);
+
+- objtool_run(argc, argv);
+-
+- return 0;
++ return objtool_run(argc, argv);
+ }
+--
+2.42.0
+
--- /dev/null
+From 50d17a5fb3731553af7eb5245e1a9cd30d2e54db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 09:15:21 +0800
+Subject: padata: Fix refcnt handling in padata_free_shell()
+
+From: WangJinchao <wangjinchao@xfusion.com>
+
+[ Upstream commit 7ddc21e317b360c3444de3023bcc83b85fabae2f ]
+
+In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead
+to system UAF (Use-After-Free) issues. Due to the lengthy analysis of
+the pcrypt_aead01 function call, I'll describe the problem scenario
+using a simplified model:
+
+Suppose there's a user of padata named `user_function` that adheres to
+the padata requirement of calling `padata_free_shell` after `serial()`
+has been invoked, as demonstrated in the following code:
+
+```c
+struct request {
+ struct padata_priv padata;
+ struct completion *done;
+};
+
+void parallel(struct padata_priv *padata) {
+ do_something();
+}
+
+void serial(struct padata_priv *padata) {
+ struct request *request = container_of(padata,
+ struct request,
+ padata);
+ complete(request->done);
+}
+
+void user_function() {
+ DECLARE_COMPLETION(done)
+ padata->parallel = parallel;
+ padata->serial = serial;
+ padata_do_parallel();
+ wait_for_completion(&done);
+ padata_free_shell();
+}
+```
+
+In the corresponding padata.c file, there's the following code:
+
+```c
+static void padata_serial_worker(struct work_struct *serial_work) {
+ ...
+ cnt = 0;
+
+ while (!list_empty(&local_list)) {
+ ...
+ padata->serial(padata);
+ cnt++;
+ }
+
+ local_bh_enable();
+
+ if (refcount_sub_and_test(cnt, &pd->refcnt))
+ padata_free_pd(pd);
+}
+```
+
+Because of the high system load and the accumulation of unexecuted
+softirq at this moment, `local_bh_enable()` in padata takes longer
+to execute than usual. Subsequently, when accessing `pd->refcnt`,
+`pd` has already been released by `padata_free_shell()`, resulting
+in a UAF issue with `pd->refcnt`.
+
+The fix is straightforward: add `refcount_dec_and_test` before calling
+`padata_free_pd` in `padata_free_shell`.
+
+Fixes: 07928d9bfc81 ("padata: Remove broken queue flushing")
+
+Signed-off-by: WangJinchao <wangjinchao@xfusion.com>
+Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/padata.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index de90af5fcbe6b..791d9cb07a501 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -1094,12 +1094,16 @@ EXPORT_SYMBOL(padata_alloc_shell);
+ */
+ void padata_free_shell(struct padata_shell *ps)
+ {
++ struct parallel_data *pd;
++
+ if (!ps)
+ return;
+
+ mutex_lock(&ps->pinst->lock);
+ list_del(&ps->list);
+- padata_free_pd(rcu_dereference_protected(ps->pd, 1));
++ pd = rcu_dereference_protected(ps->pd, 1);
++ if (refcount_dec_and_test(&pd->refcnt))
++ padata_free_pd(pd);
+ mutex_unlock(&ps->pinst->lock);
+
+ kfree(ps);
+--
+2.42.0
+
--- /dev/null
+From 707691d8c323b04414ff943caa41c948d2857461 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 15:52:58 +0300
+Subject: PCI: vmd: Correct PCI Header Type Register's multi-function check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 5827e17d0555b566c32044b0632b46f9f95054fa ]
+
+vmd_domain_reset() attempts to find whether the device may contain multiple
+functions by checking 0x80 (Multi-Function Device), however, the hdr_type
+variable has already been masked with PCI_HEADER_TYPE_MASK so the check can
+never true.
+
+To fix the issue, don't mask the read with PCI_HEADER_TYPE_MASK.
+
+Fixes: 6aab5622296b ("PCI: vmd: Clean up domain before enumeration")
+Link: https://lore.kernel.org/r/20231003125300.5541-2-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Nirmal Patel <nirmal.patel@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/vmd.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index d4c9b888a79d7..5c35884c226e6 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -510,8 +510,7 @@ static void vmd_domain_reset(struct vmd_dev *vmd)
+ base = vmd->cfgbar + PCIE_ECAM_OFFSET(bus,
+ PCI_DEVFN(dev, 0), 0);
+
+- hdr_type = readb(base + PCI_HEADER_TYPE) &
+- PCI_HEADER_TYPE_MASK;
++ hdr_type = readb(base + PCI_HEADER_TYPE);
+
+ functions = (hdr_type & 0x80) ? 8 : 1;
+ for (fn = 0; fn < functions; fn++) {
+--
+2.42.0
+
--- /dev/null
+From c4c1dc17a6e69faff858fa170afb99d4e4208833 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Nov 2022 17:25:41 +0800
+Subject: pcmcia: cs: fix possible hung task and memory leak pccardd()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit e3ea1b4847e49234e691c0d66bf030bd65bb7f2b ]
+
+If device_register() returns error in pccardd(), it leads two issues:
+
+1. The socket_released has never been completed, it will block
+ pcmcia_unregister_socket(), because of waiting for completion
+ of socket_released.
+2. The device name allocated by dev_set_name() is leaked.
+
+Fix this two issues by calling put_device() when device_register() fails.
+socket_released can be completed in pcmcia_release_socket(), the name can
+be freed in kobject_cleanup().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/cs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
+index f70197154a362..820cce7c8b400 100644
+--- a/drivers/pcmcia/cs.c
++++ b/drivers/pcmcia/cs.c
+@@ -605,6 +605,7 @@ static int pccardd(void *__skt)
+ dev_warn(&skt->dev, "PCMCIA: unable to register socket\n");
+ skt->thread = NULL;
+ complete(&skt->thread_done);
++ put_device(&skt->dev);
+ return 0;
+ }
+ ret = pccard_sysfs_add_socket(&skt->dev);
+--
+2.42.0
+
--- /dev/null
+From d11b8e3fb35ba23456753e7d68899abc59750a0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Nov 2022 17:29:24 +0800
+Subject: pcmcia: ds: fix possible name leak in error path in
+ pcmcia_device_add()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 99e1241049a92dd3e9a90a0f91e32ce390133278 ]
+
+Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's
+bus_id string array"), the name of device is allocated dynamically.
+Therefore, it needs to be freed, which is done by the driver core for
+us once all references to the device are gone. Therefore, move the
+dev_set_name() call immediately before the call device_register(), which
+either succeeds (then the freeing will be done upon subsequent remvoal),
+or puts the reference in the error call. Also, it is not unusual that the
+return value of dev_set_name is not checked.
+
+Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+[linux@dominikbrodowski.net: simplification, commit message modified]
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/ds.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
+index cce4c432d915e..2eb81d9484d27 100644
+--- a/drivers/pcmcia/ds.c
++++ b/drivers/pcmcia/ds.c
+@@ -513,9 +513,6 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s,
+ /* by default don't allow DMA */
+ p_dev->dma_mask = 0;
+ p_dev->dev.dma_mask = &p_dev->dma_mask;
+- dev_set_name(&p_dev->dev, "%d.%d", p_dev->socket->sock, p_dev->device_no);
+- if (!dev_name(&p_dev->dev))
+- goto err_free;
+ p_dev->devname = kasprintf(GFP_KERNEL, "pcmcia%s", dev_name(&p_dev->dev));
+ if (!p_dev->devname)
+ goto err_free;
+@@ -573,6 +570,7 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s,
+
+ pcmcia_device_query(p_dev);
+
++ dev_set_name(&p_dev->dev, "%d.%d", p_dev->socket->sock, p_dev->device_no);
+ if (device_register(&p_dev->dev)) {
+ mutex_lock(&s->ops_mutex);
+ list_del(&p_dev->socket_device_list);
+--
+2.42.0
+
--- /dev/null
+From 80ebfc0cd7555eb90b540c50c28ba4c999483409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Nov 2022 17:29:23 +0800
+Subject: pcmcia: ds: fix refcount leak in pcmcia_device_add()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 402ab979b29126068e0b596b641422ff7490214c ]
+
+As the comment of device_register() says, it should use put_device()
+to give up the reference in the error path. Then, insofar resources
+will be freed in pcmcia_release_dev(), the error path is no longer
+needed. In particular, this means that the (previously missing) dropping
+of the reference to &p_dev->function_config->ref is now handled by
+pcmcia_release_dev().
+
+Fixes: 360b65b95bae ("[PATCH] pcmcia: make config_t independent, add reference counting")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+[linux@dominikbrodowski.net: simplification, commit message rewrite]
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/ds.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
+index ace133b9f7d45..cce4c432d915e 100644
+--- a/drivers/pcmcia/ds.c
++++ b/drivers/pcmcia/ds.c
+@@ -573,8 +573,14 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s,
+
+ pcmcia_device_query(p_dev);
+
+- if (device_register(&p_dev->dev))
+- goto err_unreg;
++ if (device_register(&p_dev->dev)) {
++ mutex_lock(&s->ops_mutex);
++ list_del(&p_dev->socket_device_list);
++ s->device_count--;
++ mutex_unlock(&s->ops_mutex);
++ put_device(&p_dev->dev);
++ return NULL;
++ }
+
+ return p_dev;
+
+--
+2.42.0
+
--- /dev/null
+From 3778f834a422ec36e29f5e27ebbf1a0f3f0b1204 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 18:51:25 +0100
+Subject: perf/arm-cmn: Fix DTC domain detection
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit e3e73f511c49c741f6309862c2248958ad77bbaa ]
+
+It transpires that dtm_unit_info is another register which got shuffled
+in CMN-700 without me noticing. Fix that in a way which also proactively
+fixes the fragile laziness of its consumer, just in case any further
+fields ever get added alongside dtc_domain.
+
+Fixes: 23760a014417 ("perf/arm-cmn: Add CMN-700 support")
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Link: https://lore.kernel.org/r/3076ee83d0554f6939fbb6ee49ab2bdb28d8c7ee.1697824215.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 5e896218ac5f4..47e7c3206939f 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -110,7 +110,9 @@
+
+ #define CMN_DTM_PMEVCNTSR 0x240
+
+-#define CMN_DTM_UNIT_INFO 0x0910
++#define CMN650_DTM_UNIT_INFO 0x0910
++#define CMN_DTM_UNIT_INFO 0x0960
++#define CMN_DTM_UNIT_INFO_DTC_DOMAIN GENMASK_ULL(1, 0)
+
+ #define CMN_DTM_NUM_COUNTERS 4
+ /* Want more local counters? Why not replicate the whole DTM! Ugh... */
+@@ -1994,6 +1996,16 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn)
+ return 0;
+ }
+
++static unsigned int arm_cmn_dtc_domain(struct arm_cmn *cmn, void __iomem *xp_region)
++{
++ int offset = CMN_DTM_UNIT_INFO;
++
++ if (cmn->part == PART_CMN650 || cmn->part == PART_CI700)
++ offset = CMN650_DTM_UNIT_INFO;
++
++ return FIELD_GET(CMN_DTM_UNIT_INFO_DTC_DOMAIN, readl_relaxed(xp_region + offset));
++}
++
+ static void arm_cmn_init_node_info(struct arm_cmn *cmn, u32 offset, struct arm_cmn_node *node)
+ {
+ int level;
+@@ -2125,7 +2137,7 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ if (cmn->part == PART_CMN600)
+ xp->dtc = 0xf;
+ else
+- xp->dtc = 1 << readl_relaxed(xp_region + CMN_DTM_UNIT_INFO);
++ xp->dtc = 1 << arm_cmn_dtc_domain(cmn, xp_region);
+
+ xp->dtm = dtm - cmn->dtms;
+ arm_cmn_init_dtm(dtm++, xp, 0);
+--
+2.42.0
+
--- /dev/null
+From 72b6388de2b973bc7b2ab57f9af7b35433e17d29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jun 2023 18:16:32 +0100
+Subject: perf/arm-cmn: Revamp model detection
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 7819e05a0dceac20c5ff78ec9b252faf3b76b824 ]
+
+CMN implements a set of CoreSight-format peripheral ID registers which
+in principle we should be able to use to identify the hardware. However
+so far we have avoided trying to use the part number field since the
+TRMs have all described it as "configuration dependent". It turns out,
+though, that this is a quirk of the documentation generation process,
+and in fact the part number should always be a stable well-defined field
+which we can trust.
+
+To that end, revamp our model detection to rely less on ACPI/DT, and
+pave the way towards further using the hardware information as an
+identifier for userspace jevent metrics. This includes renaming the
+revision constants to maximise readability.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-and-tested-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Link: https://lore.kernel.org/r/3c791eaae814b0126f9adbd5419bfb4a600dade7.1686588640.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Stable-dep-of: e3e73f511c49 ("perf/arm-cmn: Fix DTC domain detection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 145 ++++++++++++++++++++++++++---------------
+ 1 file changed, 93 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index cfb36adf4eb80..5e896218ac5f4 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -44,8 +44,11 @@
+ #define CMN_MAX_DTMS (CMN_MAX_XPS + (CMN_MAX_DIMENSION - 1) * 4)
+
+ /* The CFG node has various info besides the discovery tree */
+-#define CMN_CFGM_PERIPH_ID_2 0x0010
+-#define CMN_CFGM_PID2_REVISION GENMASK(7, 4)
++#define CMN_CFGM_PERIPH_ID_01 0x0008
++#define CMN_CFGM_PID0_PART_0 GENMASK_ULL(7, 0)
++#define CMN_CFGM_PID1_PART_1 GENMASK_ULL(35, 32)
++#define CMN_CFGM_PERIPH_ID_23 0x0010
++#define CMN_CFGM_PID2_REVISION GENMASK_ULL(7, 4)
+
+ #define CMN_CFGM_INFO_GLOBAL 0x900
+ #define CMN_INFO_MULTIPLE_DTM_EN BIT_ULL(63)
+@@ -186,6 +189,7 @@
+ #define CMN_WP_DOWN 2
+
+
++/* Internal values for encoding event support */
+ enum cmn_model {
+ CMN600 = 1,
+ CMN650 = 2,
+@@ -197,26 +201,34 @@ enum cmn_model {
+ CMN_650ON = CMN650 | CMN700,
+ };
+
++/* Actual part numbers and revision IDs defined by the hardware */
++enum cmn_part {
++ PART_CMN600 = 0x434,
++ PART_CMN650 = 0x436,
++ PART_CMN700 = 0x43c,
++ PART_CI700 = 0x43a,
++};
++
+ /* CMN-600 r0px shouldn't exist in silicon, thankfully */
+ enum cmn_revision {
+- CMN600_R1P0,
+- CMN600_R1P1,
+- CMN600_R1P2,
+- CMN600_R1P3,
+- CMN600_R2P0,
+- CMN600_R3P0,
+- CMN600_R3P1,
+- CMN650_R0P0 = 0,
+- CMN650_R1P0,
+- CMN650_R1P1,
+- CMN650_R2P0,
+- CMN650_R1P2,
+- CMN700_R0P0 = 0,
+- CMN700_R1P0,
+- CMN700_R2P0,
+- CI700_R0P0 = 0,
+- CI700_R1P0,
+- CI700_R2P0,
++ REV_CMN600_R1P0,
++ REV_CMN600_R1P1,
++ REV_CMN600_R1P2,
++ REV_CMN600_R1P3,
++ REV_CMN600_R2P0,
++ REV_CMN600_R3P0,
++ REV_CMN600_R3P1,
++ REV_CMN650_R0P0 = 0,
++ REV_CMN650_R1P0,
++ REV_CMN650_R1P1,
++ REV_CMN650_R2P0,
++ REV_CMN650_R1P2,
++ REV_CMN700_R0P0 = 0,
++ REV_CMN700_R1P0,
++ REV_CMN700_R2P0,
++ REV_CI700_R0P0 = 0,
++ REV_CI700_R1P0,
++ REV_CI700_R2P0,
+ };
+
+ enum cmn_node_type {
+@@ -306,7 +318,7 @@ struct arm_cmn {
+ unsigned int state;
+
+ enum cmn_revision rev;
+- enum cmn_model model;
++ enum cmn_part part;
+ u8 mesh_x;
+ u8 mesh_y;
+ u16 num_xps;
+@@ -394,19 +406,35 @@ static struct arm_cmn_node *arm_cmn_node(const struct arm_cmn *cmn,
+ return NULL;
+ }
+
++static enum cmn_model arm_cmn_model(const struct arm_cmn *cmn)
++{
++ switch (cmn->part) {
++ case PART_CMN600:
++ return CMN600;
++ case PART_CMN650:
++ return CMN650;
++ case PART_CMN700:
++ return CMN700;
++ case PART_CI700:
++ return CI700;
++ default:
++ return 0;
++ };
++}
++
+ static u32 arm_cmn_device_connect_info(const struct arm_cmn *cmn,
+ const struct arm_cmn_node *xp, int port)
+ {
+ int offset = CMN_MXP__CONNECT_INFO(port);
+
+ if (port >= 2) {
+- if (cmn->model & (CMN600 | CMN650))
++ if (cmn->part == PART_CMN600 || cmn->part == PART_CMN650)
+ return 0;
+ /*
+ * CI-700 may have extra ports, but still has the
+ * mesh_port_connect_info registers in the way.
+ */
+- if (cmn->model == CI700)
++ if (cmn->part == PART_CI700)
+ offset += CI700_CONNECT_INFO_P2_5_OFFSET;
+ }
+
+@@ -640,7 +668,7 @@ static umode_t arm_cmn_event_attr_is_visible(struct kobject *kobj,
+
+ eattr = container_of(attr, typeof(*eattr), attr.attr);
+
+- if (!(eattr->model & cmn->model))
++ if (!(eattr->model & arm_cmn_model(cmn)))
+ return 0;
+
+ type = eattr->type;
+@@ -658,7 +686,7 @@ static umode_t arm_cmn_event_attr_is_visible(struct kobject *kobj,
+ if ((intf & 4) && !(cmn->ports_used & BIT(intf & 3)))
+ return 0;
+
+- if (chan == 4 && cmn->model == CMN600)
++ if (chan == 4 && cmn->part == PART_CMN600)
+ return 0;
+
+ if ((chan == 5 && cmn->rsp_vc_num < 2) ||
+@@ -669,19 +697,19 @@ static umode_t arm_cmn_event_attr_is_visible(struct kobject *kobj,
+ }
+
+ /* Revision-specific differences */
+- if (cmn->model == CMN600) {
+- if (cmn->rev < CMN600_R1P3) {
++ if (cmn->part == PART_CMN600) {
++ if (cmn->rev < REV_CMN600_R1P3) {
+ if (type == CMN_TYPE_CXRA && eventid > 0x10)
+ return 0;
+ }
+- if (cmn->rev < CMN600_R1P2) {
++ if (cmn->rev < REV_CMN600_R1P2) {
+ if (type == CMN_TYPE_HNF && eventid == 0x1b)
+ return 0;
+ if (type == CMN_TYPE_CXRA || type == CMN_TYPE_CXHA)
+ return 0;
+ }
+- } else if (cmn->model == CMN650) {
+- if (cmn->rev < CMN650_R2P0 || cmn->rev == CMN650_R1P2) {
++ } else if (cmn->part == PART_CMN650) {
++ if (cmn->rev < REV_CMN650_R2P0 || cmn->rev == REV_CMN650_R1P2) {
+ if (type == CMN_TYPE_HNF && eventid > 0x22)
+ return 0;
+ if (type == CMN_TYPE_SBSX && eventid == 0x17)
+@@ -689,8 +717,8 @@ static umode_t arm_cmn_event_attr_is_visible(struct kobject *kobj,
+ if (type == CMN_TYPE_RNI && eventid > 0x10)
+ return 0;
+ }
+- } else if (cmn->model == CMN700) {
+- if (cmn->rev < CMN700_R2P0) {
++ } else if (cmn->part == PART_CMN700) {
++ if (cmn->rev < REV_CMN700_R2P0) {
+ if (type == CMN_TYPE_HNF && eventid > 0x2c)
+ return 0;
+ if (type == CMN_TYPE_CCHA && eventid > 0x74)
+@@ -698,7 +726,7 @@ static umode_t arm_cmn_event_attr_is_visible(struct kobject *kobj,
+ if (type == CMN_TYPE_CCLA && eventid > 0x27)
+ return 0;
+ }
+- if (cmn->rev < CMN700_R1P0) {
++ if (cmn->rev < REV_CMN700_R1P0) {
+ if (type == CMN_TYPE_HNF && eventid > 0x2b)
+ return 0;
+ }
+@@ -1200,7 +1228,7 @@ static u32 arm_cmn_wp_config(struct perf_event *event)
+ u32 grp = CMN_EVENT_WP_GRP(event);
+ u32 exc = CMN_EVENT_WP_EXCLUSIVE(event);
+ u32 combine = CMN_EVENT_WP_COMBINE(event);
+- bool is_cmn600 = to_cmn(event->pmu)->model == CMN600;
++ bool is_cmn600 = to_cmn(event->pmu)->part == PART_CMN600;
+
+ config = FIELD_PREP(CMN_DTM_WPn_CONFIG_WP_DEV_SEL, dev) |
+ FIELD_PREP(CMN_DTM_WPn_CONFIG_WP_CHN_SEL, chn) |
+@@ -1520,14 +1548,14 @@ static int arm_cmn_validate_group(struct arm_cmn *cmn, struct perf_event *event)
+ return ret;
+ }
+
+-static enum cmn_filter_select arm_cmn_filter_sel(enum cmn_model model,
++static enum cmn_filter_select arm_cmn_filter_sel(const struct arm_cmn *cmn,
+ enum cmn_node_type type,
+ unsigned int eventid)
+ {
+ struct arm_cmn_event_attr *e;
+- int i;
++ enum cmn_model model = arm_cmn_model(cmn);
+
+- for (i = 0; i < ARRAY_SIZE(arm_cmn_event_attrs) - 1; i++) {
++ for (int i = 0; i < ARRAY_SIZE(arm_cmn_event_attrs) - 1; i++) {
+ e = container_of(arm_cmn_event_attrs[i], typeof(*e), attr.attr);
+ if (e->model & model && e->type == type && e->eventid == eventid)
+ return e->fsel;
+@@ -1570,12 +1598,12 @@ static int arm_cmn_event_init(struct perf_event *event)
+ /* ...but the DTM may depend on which port we're watching */
+ if (cmn->multi_dtm)
+ hw->dtm_offset = CMN_EVENT_WP_DEV_SEL(event) / 2;
+- } else if (type == CMN_TYPE_XP && cmn->model == CMN700) {
++ } else if (type == CMN_TYPE_XP && cmn->part == PART_CMN700) {
+ hw->wide_sel = true;
+ }
+
+ /* This is sufficiently annoying to recalculate, so cache it */
+- hw->filter_sel = arm_cmn_filter_sel(cmn->model, type, eventid);
++ hw->filter_sel = arm_cmn_filter_sel(cmn, type, eventid);
+
+ bynodeid = CMN_EVENT_BYNODEID(event);
+ nodeid = CMN_EVENT_NODEID(event);
+@@ -2006,6 +2034,7 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ void __iomem *cfg_region;
+ struct arm_cmn_node cfg, *dn;
+ struct arm_cmn_dtm *dtm;
++ enum cmn_part part;
+ u16 child_count, child_poff;
+ u32 xp_offset[CMN_MAX_XPS];
+ u64 reg;
+@@ -2017,7 +2046,19 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ return -ENODEV;
+
+ cfg_region = cmn->base + rgn_offset;
+- reg = readl_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_2);
++
++ reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01);
++ part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg);
++ part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8;
++ if (cmn->part && cmn->part != part)
++ dev_warn(cmn->dev,
++ "Firmware binding mismatch: expected part number 0x%x, found 0x%x\n",
++ cmn->part, part);
++ cmn->part = part;
++ if (!arm_cmn_model(cmn))
++ dev_warn(cmn->dev, "Unknown part number: 0x%x\n", part);
++
++ reg = readl_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_23);
+ cmn->rev = FIELD_GET(CMN_CFGM_PID2_REVISION, reg);
+
+ reg = readq_relaxed(cfg_region + CMN_CFGM_INFO_GLOBAL);
+@@ -2081,7 +2122,7 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ if (xp->id == (1 << 3))
+ cmn->mesh_x = xp->logid;
+
+- if (cmn->model == CMN600)
++ if (cmn->part == PART_CMN600)
+ xp->dtc = 0xf;
+ else
+ xp->dtc = 1 << readl_relaxed(xp_region + CMN_DTM_UNIT_INFO);
+@@ -2201,7 +2242,7 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ if (cmn->num_xps == 1)
+ dev_warn(cmn->dev, "1x1 config not fully supported, translate XP events manually\n");
+
+- dev_dbg(cmn->dev, "model %d, periph_id_2 revision %d\n", cmn->model, cmn->rev);
++ dev_dbg(cmn->dev, "periph_id part 0x%03x revision %d\n", cmn->part, cmn->rev);
+ reg = cmn->ports_used;
+ dev_dbg(cmn->dev, "mesh %dx%d, ID width %d, ports %6pbl%s\n",
+ cmn->mesh_x, cmn->mesh_y, arm_cmn_xyidbits(cmn), ®,
+@@ -2256,17 +2297,17 @@ static int arm_cmn_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ cmn->dev = &pdev->dev;
+- cmn->model = (unsigned long)device_get_match_data(cmn->dev);
++ cmn->part = (unsigned long)device_get_match_data(cmn->dev);
+ platform_set_drvdata(pdev, cmn);
+
+- if (cmn->model == CMN600 && has_acpi_companion(cmn->dev)) {
++ if (cmn->part == PART_CMN600 && has_acpi_companion(cmn->dev)) {
+ rootnode = arm_cmn600_acpi_probe(pdev, cmn);
+ } else {
+ rootnode = 0;
+ cmn->base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(cmn->base))
+ return PTR_ERR(cmn->base);
+- if (cmn->model == CMN600)
++ if (cmn->part == PART_CMN600)
+ rootnode = arm_cmn600_of_probe(pdev->dev.of_node);
+ }
+ if (rootnode < 0)
+@@ -2335,10 +2376,10 @@ static int arm_cmn_remove(struct platform_device *pdev)
+
+ #ifdef CONFIG_OF
+ static const struct of_device_id arm_cmn_of_match[] = {
+- { .compatible = "arm,cmn-600", .data = (void *)CMN600 },
+- { .compatible = "arm,cmn-650", .data = (void *)CMN650 },
+- { .compatible = "arm,cmn-700", .data = (void *)CMN700 },
+- { .compatible = "arm,ci-700", .data = (void *)CI700 },
++ { .compatible = "arm,cmn-600", .data = (void *)PART_CMN600 },
++ { .compatible = "arm,cmn-650" },
++ { .compatible = "arm,cmn-700" },
++ { .compatible = "arm,ci-700" },
+ {}
+ };
+ MODULE_DEVICE_TABLE(of, arm_cmn_of_match);
+@@ -2346,9 +2387,9 @@ MODULE_DEVICE_TABLE(of, arm_cmn_of_match);
+
+ #ifdef CONFIG_ACPI
+ static const struct acpi_device_id arm_cmn_acpi_match[] = {
+- { "ARMHC600", CMN600 },
+- { "ARMHC650", CMN650 },
+- { "ARMHC700", CMN700 },
++ { "ARMHC600", PART_CMN600 },
++ { "ARMHC650" },
++ { "ARMHC700" },
+ {}
+ };
+ MODULE_DEVICE_TABLE(acpi, arm_cmn_acpi_match);
+--
+2.42.0
+
--- /dev/null
+From 9bc0e2608e004304c6dc54d26aa6552566c14aa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 19:36:30 +0800
+Subject: perf: hisi: Fix use-after-free when register pmu fails
+
+From: Junhao He <hejunhao3@huawei.com>
+
+[ Upstream commit b805cafc604bfdb671fae7347a57f51154afa735 ]
+
+When we fail to register the uncore pmu, the pmu context may not been
+allocated. The error handing will call cpuhp_state_remove_instance()
+to call uncore pmu offline callback, which migrate the pmu context.
+Since that's liable to lead to some kind of use-after-free.
+
+Use cpuhp_state_remove_instance_nocalls() instead of
+cpuhp_state_remove_instance() so that the notifiers don't execute after
+the PMU device has been failed to register.
+
+Fixes: a0ab25cd82ee ("drivers/perf: hisi: Add support for HiSilicon PA PMU driver")
+FIxes: 3bf30882c3c7 ("drivers/perf: hisi: Add support for HiSilicon SLLC PMU driver")
+Signed-off-by: Junhao He <hejunhao3@huawei.com>
+Link: https://lore.kernel.org/r/20231024113630.13472-1-hejunhao3@huawei.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/hisilicon/hisi_uncore_pa_pmu.c | 4 ++--
+ drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/perf/hisilicon/hisi_uncore_pa_pmu.c b/drivers/perf/hisilicon/hisi_uncore_pa_pmu.c
+index 47d3cc9b6eecd..d385234fa28df 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_pa_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_pa_pmu.c
+@@ -416,8 +416,8 @@ static int hisi_pa_pmu_probe(struct platform_device *pdev)
+ ret = perf_pmu_register(&pa_pmu->pmu, name, -1);
+ if (ret) {
+ dev_err(pa_pmu->dev, "PMU register failed, ret = %d\n", ret);
+- cpuhp_state_remove_instance(CPUHP_AP_PERF_ARM_HISI_PA_ONLINE,
+- &pa_pmu->node);
++ cpuhp_state_remove_instance_nocalls(CPUHP_AP_PERF_ARM_HISI_PA_ONLINE,
++ &pa_pmu->node);
+ return ret;
+ }
+
+diff --git a/drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c
+index b9c79f17230c2..7d363d475deb2 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c
+@@ -450,8 +450,8 @@ static int hisi_sllc_pmu_probe(struct platform_device *pdev)
+ ret = perf_pmu_register(&sllc_pmu->pmu, name, -1);
+ if (ret) {
+ dev_err(sllc_pmu->dev, "PMU register failed, ret = %d\n", ret);
+- cpuhp_state_remove_instance(CPUHP_AP_PERF_ARM_HISI_SLLC_ONLINE,
+- &sllc_pmu->node);
++ cpuhp_state_remove_instance_nocalls(CPUHP_AP_PERF_ARM_HISI_SLLC_ONLINE,
++ &sllc_pmu->node);
+ return ret;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 49c1617e86756b3a7cf7bee7a175b25571c167e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 15:23:08 -0700
+Subject: perf hist: Add missing puts to hist__account_cycles
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit c1149037f65bcf0334886180ebe3d5efcf214912 ]
+
+Caught using reference count checking on perf top with
+"--call-graph=lbr". After this no memory leaks were detected.
+
+Fixes: 57849998e2cd ("perf report: Add processing for cycle histograms")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: K Prateek Nayak <kprateek.nayak@amd.com>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Cc: Sandipan Das <sandipan.das@amd.com>
+Cc: Anshuman Khandual <anshuman.khandual@arm.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Nick Terrell <terrelln@fb.com>
+Cc: Sean Christopherson <seanjc@google.com>
+Cc: Changbin Du <changbin.du@huawei.com>
+Cc: liuwenyu <liuwenyu7@huawei.com>
+Cc: Yang Jihong <yangjihong1@huawei.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Miguel Ojeda <ojeda@kernel.org>
+Cc: Song Liu <song@kernel.org>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: Yanteng Si <siyanteng@loongson.cn>
+Cc: Liam Howlett <liam.howlett@oracle.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Link: https://lore.kernel.org/r/20231024222353.3024098-6-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/hist.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
+index 17a05e943b44b..bffd058cbecee 100644
+--- a/tools/perf/util/hist.c
++++ b/tools/perf/util/hist.c
+@@ -2645,8 +2645,6 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al,
+
+ /* If we have branch cycles always annotate them. */
+ if (bs && bs->nr && entries[0].flags.cycles) {
+- int i;
+-
+ bi = sample__resolve_bstack(sample, al);
+ if (bi) {
+ struct addr_map_symbol *prev = NULL;
+@@ -2661,7 +2659,7 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al,
+ * Note that perf stores branches reversed from
+ * program order!
+ */
+- for (i = bs->nr - 1; i >= 0; i--) {
++ for (int i = bs->nr - 1; i >= 0; i--) {
+ addr_map_symbol__account_cycles(&bi[i].from,
+ nonany_branch_mode ? NULL : prev,
+ bi[i].flags.cycles);
+@@ -2670,6 +2668,12 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al,
+ if (total_cycles)
+ *total_cycles += bi[i].flags.cycles;
+ }
++ for (unsigned int i = 0; i < bs->nr; i++) {
++ map__put(bi[i].to.ms.map);
++ maps__put(bi[i].to.ms.maps);
++ map__put(bi[i].from.ms.map);
++ maps__put(bi[i].from.ms.maps);
++ }
+ free(bi);
+ }
+ }
+--
+2.42.0
+
--- /dev/null
+From a67269437f7e5e22ab1afa82e4272cd3bff03a8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 08:49:03 +0000
+Subject: perf kwork: Add the supported subcommands to the document
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 76e0d8c821bbd952730799cc7af841f9de67b7f7 ]
+
+Add missing report, latency and timehist subcommands to the document.
+
+Fixes: f98919ec4fccdacf ("perf kwork: Implement 'report' subcommand")
+Fixes: ad3d9f7a929ab2df ("perf kwork: Implement perf kwork latency")
+Fixes: bcc8b3e88d6fa1a3 ("perf kwork: Implement perf kwork timehist")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Cc: Sandipan Das <sandipan.das@amd.com>
+Link: https://lore.kernel.org/r/20230812084917.169338-3-yangjihong1@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Documentation/perf-kwork.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/Documentation/perf-kwork.txt b/tools/perf/Documentation/perf-kwork.txt
+index 3c36324712b6e..482d6c52e2edf 100644
+--- a/tools/perf/Documentation/perf-kwork.txt
++++ b/tools/perf/Documentation/perf-kwork.txt
+@@ -8,7 +8,7 @@ perf-kwork - Tool to trace/measure kernel work properties (latencies)
+ SYNOPSIS
+ --------
+ [verse]
+-'perf kwork' {record}
++'perf kwork' {record|report|latency|timehist}
+
+ DESCRIPTION
+ -----------
+--
+2.42.0
+
--- /dev/null
+From 64c7d135c00bc7ce1198ed78d868718a7261e89f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 08:49:02 +0000
+Subject: perf kwork: Fix incorrect and missing free atom in work_push_atom()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit d39710088d82ef100b33cdf4a9de3546fb0bb5df ]
+
+1. Atoms are managed in page mode and should be released using atom_free()
+ instead of free().
+2. When the event does not match, the atom needs to free.
+
+Fixes: f98919ec4fccdacf ("perf kwork: Implement 'report' subcommand")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Cc: Sandipan Das <sandipan.das@amd.com>
+Cc: Yang Jihong <yangjihong1@huawei.com>
+Link: https://lore.kernel.org/r/20230812084917.169338-2-yangjihong1@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-kwork.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/builtin-kwork.c b/tools/perf/builtin-kwork.c
+index fb8c63656ad89..25dff3a40d3df 100644
+--- a/tools/perf/builtin-kwork.c
++++ b/tools/perf/builtin-kwork.c
+@@ -399,12 +399,14 @@ static int work_push_atom(struct perf_kwork *kwork,
+
+ work = work_findnew(&class->work_root, &key, &kwork->cmp_id);
+ if (work == NULL) {
+- free(atom);
++ atom_free(atom);
+ return -1;
+ }
+
+- if (!profile_event_match(kwork, work, sample))
++ if (!profile_event_match(kwork, work, sample)) {
++ atom_free(atom);
+ return 0;
++ }
+
+ if (dst_type < KWORK_TRACE_MAX) {
+ dst_atom = list_last_entry_or_null(&work->atom_list[dst_type],
+--
+2.42.0
+
--- /dev/null
+From a93b727d335be31dcfa681babe92a17c00ae0080 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 08:49:04 +0000
+Subject: perf kwork: Set ordered_events to true in 'struct perf_tool'
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 0c526579a4b2b6ecd540472f2e34c2850cf70f76 ]
+
+'perf kwork' processes data based on timestamps and needs to sort events.
+
+Fixes: f98919ec4fccdacf ("perf kwork: Implement 'report' subcommand")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Cc: Sandipan Das <sandipan.das@amd.com>
+Cc: Yang Jihong <yangjihong1@huawei.com>
+Link: https://lore.kernel.org/r/20230812084917.169338-4-yangjihong1@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-kwork.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/builtin-kwork.c b/tools/perf/builtin-kwork.c
+index 25dff3a40d3df..25cba0d61736c 100644
+--- a/tools/perf/builtin-kwork.c
++++ b/tools/perf/builtin-kwork.c
+@@ -1672,9 +1672,10 @@ int cmd_kwork(int argc, const char **argv)
+ static struct perf_kwork kwork = {
+ .class_list = LIST_HEAD_INIT(kwork.class_list),
+ .tool = {
+- .mmap = perf_event__process_mmap,
+- .mmap2 = perf_event__process_mmap2,
+- .sample = perf_kwork__process_tracepoint_sample,
++ .mmap = perf_event__process_mmap,
++ .mmap2 = perf_event__process_mmap2,
++ .sample = perf_kwork__process_tracepoint_sample,
++ .ordered_events = true,
+ },
+ .atom_page_list = LIST_HEAD_INIT(kwork.atom_page_list),
+ .sort_list = LIST_HEAD_INIT(kwork.sort_list),
+--
+2.42.0
+
--- /dev/null
+From 7e119e105f9e618cd4b5924eec0385df750bda40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 15:23:05 -0700
+Subject: perf machine: Avoid out of bounds LBR memory read
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit ab8ce150781d326c6bfbe1e09f175ffde1186f80 ]
+
+Running perf top with address sanitizer and "--call-graph=lbr" fails
+due to reading sample 0 when no samples exist. Add a guard to prevent
+this.
+
+Fixes: e2b23483eb1d ("perf machine: Factor out lbr_callchain_add_lbr_ip()")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: K Prateek Nayak <kprateek.nayak@amd.com>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Cc: Sandipan Das <sandipan.das@amd.com>
+Cc: Anshuman Khandual <anshuman.khandual@arm.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Nick Terrell <terrelln@fb.com>
+Cc: Sean Christopherson <seanjc@google.com>
+Cc: Changbin Du <changbin.du@huawei.com>
+Cc: liuwenyu <liuwenyu7@huawei.com>
+Cc: Yang Jihong <yangjihong1@huawei.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Miguel Ojeda <ojeda@kernel.org>
+Cc: Song Liu <song@kernel.org>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: Yanteng Si <siyanteng@loongson.cn>
+Cc: Liam Howlett <liam.howlett@oracle.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Link: https://lore.kernel.org/r/20231024222353.3024098-3-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/machine.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index 76316e459c3de..9cd52f50ea7ac 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -2555,16 +2555,18 @@ static int lbr_callchain_add_lbr_ip(struct thread *thread,
+ save_lbr_cursor_node(thread, cursor, i);
+ }
+
+- /* Add LBR ip from first entries.to */
+- ip = entries[0].to;
+- flags = &entries[0].flags;
+- *branch_from = entries[0].from;
+- err = add_callchain_ip(thread, cursor, parent,
+- root_al, &cpumode, ip,
+- true, flags, NULL,
+- *branch_from);
+- if (err)
+- return err;
++ if (lbr_nr > 0) {
++ /* Add LBR ip from first entries.to */
++ ip = entries[0].to;
++ flags = &entries[0].flags;
++ *branch_from = entries[0].from;
++ err = add_callchain_ip(thread, cursor, parent,
++ root_al, &cpumode, ip,
++ true, flags, NULL,
++ *branch_from);
++ if (err)
++ return err;
++ }
+
+ return 0;
+ }
+--
+2.42.0
+
--- /dev/null
+From 7e13d30d7dddfb8e9ff44c7774d79b28a6caa22f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 16:44:44 -0700
+Subject: perf record: Fix BTF type checks in the off-cpu profiling
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 0e501a65d35bf72414379fed0e31a0b6b81ab57d ]
+
+The BTF func proto for a tracepoint has one more argument than the
+actual tracepoint function since it has a context argument at the
+begining. So it should compare to 5 when the tracepoint has 4
+arguments.
+
+ typedef void (*btf_trace_sched_switch)(void *, bool, struct task_struct *, struct task_struct *, unsigned int);
+
+Also, recent change in the perf tool would use a hand-written minimal
+vmlinux.h to generate BTF in the skeleton. So it won't have the info
+of the tracepoint. Anyway it should use the kernel's vmlinux BTF to
+check the type in the kernel.
+
+Fixes: b36888f71c85 ("perf record: Handle argument change in sched_switch")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Acked-by: Song Liu <song@kernel.org>
+Cc: Hao Luo <haoluo@google.com>
+CC: bpf@vger.kernel.org
+Link: https://lore.kernel.org/r/20230922234444.3115821-1-namhyung@kernel.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf_off_cpu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/bpf_off_cpu.c b/tools/perf/util/bpf_off_cpu.c
+index 01f70b8e705a8..21f4d9ba023d9 100644
+--- a/tools/perf/util/bpf_off_cpu.c
++++ b/tools/perf/util/bpf_off_cpu.c
+@@ -98,7 +98,7 @@ static void off_cpu_finish(void *arg __maybe_unused)
+ /* v5.18 kernel added prev_state arg, so it needs to check the signature */
+ static void check_sched_switch_args(void)
+ {
+- const struct btf *btf = bpf_object__btf(skel->obj);
++ const struct btf *btf = btf__load_vmlinux_btf();
+ const struct btf_type *t1, *t2, *t3;
+ u32 type_id;
+
+@@ -116,7 +116,8 @@ static void check_sched_switch_args(void)
+ return;
+
+ t3 = btf__type_by_id(btf, t2->type);
+- if (t3 && btf_is_func_proto(t3) && btf_vlen(t3) == 4) {
++ /* btf_trace func proto has one more argument for the context */
++ if (t3 && btf_is_func_proto(t3) && btf_vlen(t3) == 5) {
+ /* new format: pass prev_state as 4th arg */
+ skel->rodata->has_prev_state = true;
+ }
+--
+2.42.0
+
--- /dev/null
+From 0bc504d25961d1cdde7d0432d5024c7b5d227837 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Sep 2023 17:39:12 -0700
+Subject: perf stat: Fix aggr mode initialization
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit a84fbf205609313594b86065c67e823f09ebe29b ]
+
+Generating metrics llc_code_read_mpi_demand_plus_prefetch,
+llc_data_read_mpi_demand_plus_prefetch,
+llc_miss_local_memory_bandwidth_read,
+llc_miss_local_memory_bandwidth_write,
+nllc_miss_remote_memory_bandwidth_read, memory_bandwidth_read,
+memory_bandwidth_write, uncore_frequency, upi_data_transmit_bw,
+C2_Pkg_Residency, C3_Core_Residency, C3_Pkg_Residency,
+C6_Core_Residency, C6_Pkg_Residency, C7_Core_Residency,
+C7_Pkg_Residency, UNCORE_FREQ and tma_info_system_socket_clks would
+trigger an address sanitizer heap-buffer-overflows on a SkylakeX.
+
+```
+==2567752==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5020003ed098 at pc 0x5621a816654e bp 0x7fffb55d4da0 sp 0x7fffb55d4d98
+READ of size 4 at 0x5020003eee78 thread T0
+ #0 0x558265d6654d in aggr_cpu_id__is_empty tools/perf/util/cpumap.c:694:12
+ #1 0x558265c914da in perf_stat__get_aggr tools/perf/builtin-stat.c:1490:6
+ #2 0x558265c914da in perf_stat__get_global_cached tools/perf/builtin-stat.c:1530:9
+ #3 0x558265e53290 in should_skip_zero_counter tools/perf/util/stat-display.c:947:31
+ #4 0x558265e53290 in print_counter_aggrdata tools/perf/util/stat-display.c:985:18
+ #5 0x558265e51931 in print_counter tools/perf/util/stat-display.c:1110:3
+ #6 0x558265e51931 in evlist__print_counters tools/perf/util/stat-display.c:1571:5
+ #7 0x558265c8ec87 in print_counters tools/perf/builtin-stat.c:981:2
+ #8 0x558265c8cc71 in cmd_stat tools/perf/builtin-stat.c:2837:3
+ #9 0x558265bb9bd4 in run_builtin tools/perf/perf.c:323:11
+ #10 0x558265bb98eb in handle_internal_command tools/perf/perf.c:377:8
+ #11 0x558265bb9389 in run_argv tools/perf/perf.c:421:2
+ #12 0x558265bb9389 in main tools/perf/perf.c:537:3
+```
+
+The issue was the use of testing a cpumap with NULL rather than using
+empty, as a map containing the dummy value isn't NULL and the -1
+results in an empty aggr map being allocated which legitimately
+overflows when any member is accessed.
+
+Fixes: 8a96f454f5668572 ("perf stat: Avoid SEGV if core.cpus isn't set")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230906003912.3317462-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-stat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index a2c74a34e4a44..bdd8dd54fdb63 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -1444,7 +1444,7 @@ static int perf_stat_init_aggr_mode(void)
+ * taking the highest cpu number to be the size of
+ * the aggregation translate cpumap.
+ */
+- if (evsel_list->core.user_requested_cpus)
++ if (!perf_cpu_map__empty(evsel_list->core.user_requested_cpus))
+ nr = perf_cpu_map__max(evsel_list->core.user_requested_cpus).cpu;
+ else
+ nr = 0;
+--
+2.42.0
+
--- /dev/null
+From 8a20edc2cb1539b6e32221cd72b464363008b54e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Sep 2023 13:33:54 +0100
+Subject: pinctrl: renesas: rzg2l: Make reverse order of enable() for disable()
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit dd462cf53e4dff0f4eba5e6650e31ceddec74c6f ]
+
+We usually do reverse order of enable() for disable(). Currently, the
+ordering of irq_chip_disable_parent() is not correct in
+rzg2l_gpio_irq_disable(). Fix the incorrect order.
+
+Fixes: db2e5f21a48e ("pinctrl: renesas: pinctrl-rzg2l: Add IRQ domain to handle GPIO interrupt")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230918123355.262115-2-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+index 2a617832a7e60..159812fe1c97c 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+@@ -1173,6 +1173,8 @@ static void rzg2l_gpio_irq_disable(struct irq_data *d)
+ u32 port;
+ u8 bit;
+
++ irq_chip_disable_parent(d);
++
+ port = RZG2L_PIN_ID_TO_PORT(hwirq);
+ bit = RZG2L_PIN_ID_TO_PIN(hwirq);
+
+@@ -1187,7 +1189,6 @@ static void rzg2l_gpio_irq_disable(struct irq_data *d)
+ spin_unlock_irqrestore(&pctrl->lock, flags);
+
+ gpiochip_disable_irq(gc, hwirq);
+- irq_chip_disable_parent(d);
+ }
+
+ static void rzg2l_gpio_irq_enable(struct irq_data *d)
+--
+2.42.0
+
--- /dev/null
+From 30390a02f32215472a1a78d04b414b04c248606f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 23:10:04 +0200
+Subject: platform/x86: wmi: Fix opening of char device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit eba9ac7abab91c8f6d351460239108bef5e7a0b6 ]
+
+Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via
+file private data"), the miscdevice stores a pointer to itself inside
+filp->private_data, which means that private_data will not be NULL when
+wmi_char_open() is called. This might cause memory corruption should
+wmi_char_open() be unable to find its driver, something which can
+happen when the associated WMI device is deleted in wmi_free_devices().
+
+Fix the problem by using the miscdevice pointer to retrieve the WMI
+device data associated with a char device using container_of(). This
+also avoids wmi_char_open() picking a wrong WMI device bound to a
+driver with the same name as the original driver.
+
+Fixes: 44b6b7661132 ("platform/x86: wmi: create userspace interface for drivers")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20231020211005.38216-5-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/wmi.c | 20 ++++++--------------
+ 1 file changed, 6 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
+index 0fcfdc574191b..2b79377cc21e2 100644
+--- a/drivers/platform/x86/wmi.c
++++ b/drivers/platform/x86/wmi.c
+@@ -849,21 +849,13 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
+ }
+ static int wmi_char_open(struct inode *inode, struct file *filp)
+ {
+- const char *driver_name = filp->f_path.dentry->d_iname;
+- struct wmi_block *wblock;
+- struct wmi_block *next;
+-
+- list_for_each_entry_safe(wblock, next, &wmi_block_list, list) {
+- if (!wblock->dev.dev.driver)
+- continue;
+- if (strcmp(driver_name, wblock->dev.dev.driver->name) == 0) {
+- filp->private_data = wblock;
+- break;
+- }
+- }
++ /*
++ * The miscdevice already stores a pointer to itself
++ * inside filp->private_data
++ */
++ struct wmi_block *wblock = container_of(filp->private_data, struct wmi_block, char_dev);
+
+- if (!filp->private_data)
+- return -ENODEV;
++ filp->private_data = wblock;
+
+ return nonseekable_open(inode, filp);
+ }
+--
+2.42.0
+
--- /dev/null
+From 681c0cfcbfcb84b25b9ad7e27f036a43710a0d6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 23:10:03 +0200
+Subject: platform/x86: wmi: Fix probe failure when failing to register WMI
+ devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit ed85891a276edaf7a867de0e9acd0837bc3008f2 ]
+
+When a WMI device besides the first one somehow fails to register,
+retval is returned while still containing a negative error code. This
+causes the ACPI device fail to probe, leaving behind zombie WMI devices
+leading to various errors later.
+
+Handle the single error path separately and return 0 unconditionally
+after trying to register all WMI devices to solve the issue. Also
+continue to register WMI devices even if some fail to allocate memory.
+
+Fixes: 6ee50aaa9a20 ("platform/x86: wmi: Instantiate all devices before adding them")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20231020211005.38216-4-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/wmi.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
+index 2fe6e147785e4..0fcfdc574191b 100644
+--- a/drivers/platform/x86/wmi.c
++++ b/drivers/platform/x86/wmi.c
+@@ -1212,8 +1212,8 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
+ struct wmi_block *wblock, *next;
+ union acpi_object *obj;
+ acpi_status status;
+- int retval = 0;
+ u32 i, total;
++ int retval;
+
+ status = acpi_evaluate_object(device->handle, "_WDG", NULL, &out);
+ if (ACPI_FAILURE(status))
+@@ -1224,8 +1224,8 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
+ return -ENXIO;
+
+ if (obj->type != ACPI_TYPE_BUFFER) {
+- retval = -ENXIO;
+- goto out_free_pointer;
++ kfree(obj);
++ return -ENXIO;
+ }
+
+ gblock = (const struct guid_block *)obj->buffer.pointer;
+@@ -1240,8 +1240,8 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
+
+ wblock = kzalloc(sizeof(*wblock), GFP_KERNEL);
+ if (!wblock) {
+- retval = -ENOMEM;
+- break;
++ dev_err(wmi_bus_dev, "Failed to allocate %pUL\n", &gblock[i].guid);
++ continue;
+ }
+
+ wblock->acpi_device = device;
+@@ -1280,9 +1280,9 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
+ }
+ }
+
+-out_free_pointer:
+- kfree(out.pointer);
+- return retval;
++ kfree(obj);
++
++ return 0;
+ }
+
+ /*
+--
+2.42.0
+
--- /dev/null
+From 2aaf5432ec7e9300676e7b9808e69966367b8427 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 11:32:17 +0200
+Subject: PM / devfreq: rockchip-dfi: Make pmu regmap mandatory
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit 1e0731c05c985deb68a97fa44c1adcd3305dda90 ]
+
+As a matter of fact the regmap_pmu already is mandatory because
+it is used unconditionally in the driver. Bail out gracefully in
+probe() rather than crashing later.
+
+Link: https://lore.kernel.org/lkml/20230704093242.583575-2-s.hauer@pengutronix.de/
+Fixes: b9d1262bca0af ("PM / devfreq: event: support rockchip dfi controller")
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/event/rockchip-dfi.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c
+index 39ac069cabc75..74893c06aa087 100644
+--- a/drivers/devfreq/event/rockchip-dfi.c
++++ b/drivers/devfreq/event/rockchip-dfi.c
+@@ -193,14 +193,15 @@ static int rockchip_dfi_probe(struct platform_device *pdev)
+ return dev_err_probe(dev, PTR_ERR(data->clk),
+ "Cannot get the clk pclk_ddr_mon\n");
+
+- /* try to find the optional reference to the pmu syscon */
+ node = of_parse_phandle(np, "rockchip,pmu", 0);
+- if (node) {
+- data->regmap_pmu = syscon_node_to_regmap(node);
+- of_node_put(node);
+- if (IS_ERR(data->regmap_pmu))
+- return PTR_ERR(data->regmap_pmu);
+- }
++ if (!node)
++ return dev_err_probe(&pdev->dev, -ENODEV, "Can't find pmu_grf registers\n");
++
++ data->regmap_pmu = syscon_node_to_regmap(node);
++ of_node_put(node);
++ if (IS_ERR(data->regmap_pmu))
++ return PTR_ERR(data->regmap_pmu);
++
+ data->dev = dev;
+
+ desc = devm_kzalloc(dev, sizeof(*desc), GFP_KERNEL);
+--
+2.42.0
+
--- /dev/null
+From c14404b4e2604ac8d3837da788e0988597fc5110 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 20:31:17 +0200
+Subject: powerpc/40x: Remove stale PTE_ATOMIC_UPDATES macro
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit cc8ee288f484a2a59c01ccd4d8a417d6ed3466e3 ]
+
+40x TLB handlers were reworked by commit 2c74e2586bb9 ("powerpc/40x:
+Rework 40x PTE access and TLB miss") to not require PTE_ATOMIC_UPDATES
+anymore.
+
+Then commit 4e1df545e2fa ("powerpc/pgtable: Drop PTE_ATOMIC_UPDATES")
+removed all code related to PTE_ATOMIC_UPDATES.
+
+Remove left over PTE_ATOMIC_UPDATES macro.
+
+Fixes: 2c74e2586bb9 ("powerpc/40x: Rework 40x PTE access and TLB miss")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/f061db5857fcd748f84a6707aad01754686ce97e.1695659959.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/nohash/32/pte-40x.h | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/nohash/32/pte-40x.h b/arch/powerpc/include/asm/nohash/32/pte-40x.h
+index 2d3153cfc0d79..acf61242e85bf 100644
+--- a/arch/powerpc/include/asm/nohash/32/pte-40x.h
++++ b/arch/powerpc/include/asm/nohash/32/pte-40x.h
+@@ -69,9 +69,6 @@
+
+ #define _PTE_NONE_MASK 0
+
+-/* Until my rework is finished, 40x still needs atomic PTE updates */
+-#define PTE_ATOMIC_UPDATES 1
+-
+ #define _PAGE_BASE_NC (_PAGE_PRESENT | _PAGE_ACCESSED)
+ #define _PAGE_BASE (_PAGE_BASE_NC)
+
+--
+2.42.0
+
--- /dev/null
+From 69b29e18f26fce60d315a173713bb34f250a358d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Mar 2023 14:48:31 +0100
+Subject: powerpc/imc-pmu: Use the correct spinlock initializer.
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 007240d59c11f87ac4f6cfc6a1d116630b6b634c ]
+
+The macro __SPIN_LOCK_INITIALIZER() is implementation specific. Users
+that desire to initialize a spinlock in a struct must use
+__SPIN_LOCK_UNLOCKED().
+
+Use __SPIN_LOCK_UNLOCKED() for the spinlock_t in imc_global_refc.
+
+Fixes: 76d588dddc459 ("powerpc/imc-pmu: Fix use of mutex in IRQs disabled section")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230309134831.Nz12nqsU@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/imc-pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
+index 9d229ef7f86ef..ada817c49b722 100644
+--- a/arch/powerpc/perf/imc-pmu.c
++++ b/arch/powerpc/perf/imc-pmu.c
+@@ -51,7 +51,7 @@ static int trace_imc_mem_size;
+ * core and trace-imc
+ */
+ static struct imc_pmu_ref imc_global_refc = {
+- .lock = __SPIN_LOCK_INITIALIZER(imc_global_refc.lock),
++ .lock = __SPIN_LOCK_UNLOCKED(imc_global_refc.lock),
+ .id = 0,
+ .refc = 0,
+ };
+--
+2.42.0
+
--- /dev/null
+From 9d674c26ff3698cf7cc27cd3834525563054cb4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 14:33:13 +0200
+Subject: powerpc: Only define __parse_fpscr() when required
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit c7e0d9bb9154c6e6b2ac8746faba27b53393f25e ]
+
+Clang 17 reports:
+
+arch/powerpc/kernel/traps.c:1167:19: error: unused function '__parse_fpscr' [-Werror,-Wunused-function]
+
+__parse_fpscr() is called from two sites. First call is guarded
+by #ifdef CONFIG_PPC_FPU_REGS
+
+Second call is guarded by CONFIG_MATH_EMULATION which selects
+CONFIG_PPC_FPU_REGS.
+
+So only define __parse_fpscr() when CONFIG_PPC_FPU_REGS is defined.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202309210327.WkqSd5Bq-lkp@intel.com/
+Fixes: b6254ced4da6 ("powerpc/signal: Don't manage floating point regs when no FPU")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/5de2998c57f3983563b27b39228ea9a7229d4110.1695385984.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/traps.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 9bdd79aa51cfc..3956f32682c62 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -1164,6 +1164,7 @@ static void emulate_single_step(struct pt_regs *regs)
+ __single_step_exception(regs);
+ }
+
++#ifdef CONFIG_PPC_FPU_REGS
+ static inline int __parse_fpscr(unsigned long fpscr)
+ {
+ int ret = FPE_FLTUNK;
+@@ -1190,6 +1191,7 @@ static inline int __parse_fpscr(unsigned long fpscr)
+
+ return ret;
+ }
++#endif
+
+ static void parse_fpe(struct pt_regs *regs)
+ {
+--
+2.42.0
+
--- /dev/null
+From 91e5b750b681f809406714fc52b101473e5e75b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 15:46:23 +0800
+Subject: powerpc/pseries: fix potential memory leak in
+ init_cpu_associativity()
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit 95f1a128cd728a7257d78e868f1f5a145fc43736 ]
+
+If the vcpu_associativity alloc memory successfully but the
+pcpu_associativity fails to alloc memory, the vcpu_associativity
+memory leaks.
+
+Fixes: d62c8deeb6e6 ("powerpc/pseries: Provide vcpu dispatch statistics")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Reviewed-by: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/1671003983-10794-1-git-send-email-wangyufen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/lpar.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index 2c2812a87d470..541199c6a587d 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -524,8 +524,10 @@ static ssize_t vcpudispatch_stats_write(struct file *file, const char __user *p,
+
+ if (cmd) {
+ rc = init_cpu_associativity();
+- if (rc)
++ if (rc) {
++ destroy_cpu_associativity();
+ goto out;
++ }
+
+ for_each_possible_cpu(cpu) {
+ disp = per_cpu_ptr(&vcpu_disp_data, cpu);
+--
+2.42.0
+
--- /dev/null
+From 3a3be3a235a6b719a43dd5d26a96a2704edd1372 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 14:50:33 -0700
+Subject: powerpc/vas: Limit open window failure messages in log bufffer
+
+From: Haren Myneni <haren@linux.ibm.com>
+
+[ Upstream commit 73b25505ce043b561028e5571d84dc82aa53c2b4 ]
+
+The VAS open window call prints error message and returns -EBUSY
+after the migration suspend event initiated and until the resume
+event completed on the destination system. It can cause the log
+buffer filled with these error messages if the user space issues
+continuous open window calls. Similar case even for DLPAR CPU
+remove event when no credits are available until the credits are
+freed or with the other DLPAR CPU add event.
+
+So changes in the patch to use pr_err_ratelimited() instead of
+pr_err() to display open window failure and not-available credits
+error messages.
+
+Use pr_fmt() and make the corresponding changes to have the
+consistencein prefix all pr_*() messages (vas-api.c).
+
+Fixes: 37e6764895ef ("powerpc/pseries/vas: Add VAS migration handler")
+Signed-off-by: Haren Myneni <haren@linux.ibm.com>
+[mpe: Use "vas-api" as the prefix to match the file name.]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231019215033.1335251-1-haren@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/book3s/vas-api.c | 34 ++++++++++++-------------
+ arch/powerpc/platforms/pseries/vas.c | 4 +--
+ 2 files changed, 18 insertions(+), 20 deletions(-)
+
+diff --git a/arch/powerpc/platforms/book3s/vas-api.c b/arch/powerpc/platforms/book3s/vas-api.c
+index 40f5ae5e1238d..92e60cb3163fa 100644
+--- a/arch/powerpc/platforms/book3s/vas-api.c
++++ b/arch/powerpc/platforms/book3s/vas-api.c
+@@ -4,6 +4,8 @@
+ * Copyright (C) 2019 Haren Myneni, IBM Corp
+ */
+
++#define pr_fmt(fmt) "vas-api: " fmt
++
+ #include <linux/kernel.h>
+ #include <linux/device.h>
+ #include <linux/cdev.h>
+@@ -78,7 +80,7 @@ int get_vas_user_win_ref(struct vas_user_win_ref *task_ref)
+ task_ref->mm = get_task_mm(current);
+ if (!task_ref->mm) {
+ put_pid(task_ref->pid);
+- pr_err("VAS: pid(%d): mm_struct is not found\n",
++ pr_err("pid(%d): mm_struct is not found\n",
+ current->pid);
+ return -EPERM;
+ }
+@@ -235,8 +237,7 @@ void vas_update_csb(struct coprocessor_request_block *crb,
+ rc = kill_pid_info(SIGSEGV, &info, pid);
+ rcu_read_unlock();
+
+- pr_devel("%s(): pid %d kill_proc_info() rc %d\n", __func__,
+- pid_vnr(pid), rc);
++ pr_devel("pid %d kill_proc_info() rc %d\n", pid_vnr(pid), rc);
+ }
+
+ void vas_dump_crb(struct coprocessor_request_block *crb)
+@@ -294,7 +295,7 @@ static int coproc_ioc_tx_win_open(struct file *fp, unsigned long arg)
+
+ rc = copy_from_user(&uattr, uptr, sizeof(uattr));
+ if (rc) {
+- pr_err("%s(): copy_from_user() returns %d\n", __func__, rc);
++ pr_err("copy_from_user() returns %d\n", rc);
+ return -EFAULT;
+ }
+
+@@ -311,7 +312,7 @@ static int coproc_ioc_tx_win_open(struct file *fp, unsigned long arg)
+ txwin = cp_inst->coproc->vops->open_win(uattr.vas_id, uattr.flags,
+ cp_inst->coproc->cop_type);
+ if (IS_ERR(txwin)) {
+- pr_err("%s() VAS window open failed, %ld\n", __func__,
++ pr_err_ratelimited("VAS window open failed rc=%ld\n",
+ PTR_ERR(txwin));
+ return PTR_ERR(txwin);
+ }
+@@ -405,8 +406,7 @@ static vm_fault_t vas_mmap_fault(struct vm_fault *vmf)
+ * window is not opened. Shouldn't expect this error.
+ */
+ if (!cp_inst || !cp_inst->txwin) {
+- pr_err("%s(): Unexpected fault on paste address with TX window closed\n",
+- __func__);
++ pr_err("Unexpected fault on paste address with TX window closed\n");
+ return VM_FAULT_SIGBUS;
+ }
+
+@@ -421,8 +421,7 @@ static vm_fault_t vas_mmap_fault(struct vm_fault *vmf)
+ * issue NX request.
+ */
+ if (txwin->task_ref.vma != vmf->vma) {
+- pr_err("%s(): No previous mapping with paste address\n",
+- __func__);
++ pr_err("No previous mapping with paste address\n");
+ return VM_FAULT_SIGBUS;
+ }
+
+@@ -481,19 +480,19 @@ static int coproc_mmap(struct file *fp, struct vm_area_struct *vma)
+ txwin = cp_inst->txwin;
+
+ if ((vma->vm_end - vma->vm_start) > PAGE_SIZE) {
+- pr_debug("%s(): size 0x%zx, PAGE_SIZE 0x%zx\n", __func__,
++ pr_debug("size 0x%zx, PAGE_SIZE 0x%zx\n",
+ (vma->vm_end - vma->vm_start), PAGE_SIZE);
+ return -EINVAL;
+ }
+
+ /* Ensure instance has an open send window */
+ if (!txwin) {
+- pr_err("%s(): No send window open?\n", __func__);
++ pr_err("No send window open?\n");
+ return -EINVAL;
+ }
+
+ if (!cp_inst->coproc->vops || !cp_inst->coproc->vops->paste_addr) {
+- pr_err("%s(): VAS API is not registered\n", __func__);
++ pr_err("VAS API is not registered\n");
+ return -EACCES;
+ }
+
+@@ -510,14 +509,14 @@ static int coproc_mmap(struct file *fp, struct vm_area_struct *vma)
+ */
+ mutex_lock(&txwin->task_ref.mmap_mutex);
+ if (txwin->status != VAS_WIN_ACTIVE) {
+- pr_err("%s(): Window is not active\n", __func__);
++ pr_err("Window is not active\n");
+ rc = -EACCES;
+ goto out;
+ }
+
+ paste_addr = cp_inst->coproc->vops->paste_addr(txwin);
+ if (!paste_addr) {
+- pr_err("%s(): Window paste address failed\n", __func__);
++ pr_err("Window paste address failed\n");
+ rc = -EINVAL;
+ goto out;
+ }
+@@ -533,8 +532,8 @@ static int coproc_mmap(struct file *fp, struct vm_area_struct *vma)
+ rc = remap_pfn_range(vma, vma->vm_start, pfn + vma->vm_pgoff,
+ vma->vm_end - vma->vm_start, prot);
+
+- pr_devel("%s(): paste addr %llx at %lx, rc %d\n", __func__,
+- paste_addr, vma->vm_start, rc);
++ pr_devel("paste addr %llx at %lx, rc %d\n", paste_addr,
++ vma->vm_start, rc);
+
+ txwin->task_ref.vma = vma;
+ vma->vm_ops = &vas_vm_ops;
+@@ -609,8 +608,7 @@ int vas_register_coproc_api(struct module *mod, enum vas_cop_type cop_type,
+ goto err;
+ }
+
+- pr_devel("%s: Added dev [%d,%d]\n", __func__, MAJOR(devno),
+- MINOR(devno));
++ pr_devel("Added dev [%d,%d]\n", MAJOR(devno), MINOR(devno));
+
+ return 0;
+
+diff --git a/arch/powerpc/platforms/pseries/vas.c b/arch/powerpc/platforms/pseries/vas.c
+index 041a25c08066b..5db8060776b0c 100644
+--- a/arch/powerpc/platforms/pseries/vas.c
++++ b/arch/powerpc/platforms/pseries/vas.c
+@@ -340,7 +340,7 @@ static struct vas_window *vas_allocate_window(int vas_id, u64 flags,
+
+ if (atomic_inc_return(&cop_feat_caps->nr_used_credits) >
+ atomic_read(&cop_feat_caps->nr_total_credits)) {
+- pr_err("Credits are not available to allocate window\n");
++ pr_err_ratelimited("Credits are not available to allocate window\n");
+ rc = -EINVAL;
+ goto out;
+ }
+@@ -423,7 +423,7 @@ static struct vas_window *vas_allocate_window(int vas_id, u64 flags,
+
+ put_vas_user_win_ref(&txwin->vas_win.task_ref);
+ rc = -EBUSY;
+- pr_err("No credit is available to allocate window\n");
++ pr_err_ratelimited("No credit is available to allocate window\n");
+
+ out_free:
+ /*
+--
+2.42.0
+
--- /dev/null
+From 2880750159eb4fc3170bffb25b31d84cf1c310c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Oct 2023 16:37:00 +1100
+Subject: powerpc/xive: Fix endian conversion size
+
+From: Benjamin Gray <bgray@linux.ibm.com>
+
+[ Upstream commit ff7a60ab1e065257a0e467c13b519f4debcd7fcf ]
+
+Sparse reports a size mismatch in the endian swap. The Opal
+implementation[1] passes the value as a __be64, and the receiving
+variable out_qsize is a u64, so the use of be32_to_cpu() appears to be
+an error.
+
+[1]: https://github.com/open-power/skiboot/blob/80e2b1dc73/hw/xive.c#L3854
+
+Fixes: 88ec6b93c8e7 ("powerpc/xive: add OPAL extensions for the XIVE native exploitation support")
+Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231011053711.93427-2-bgray@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/xive/native.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
+index 3925825954bcc..e5baa91ddd07b 100644
+--- a/arch/powerpc/sysdev/xive/native.c
++++ b/arch/powerpc/sysdev/xive/native.c
+@@ -804,7 +804,7 @@ int xive_native_get_queue_info(u32 vp_id, u32 prio,
+ if (out_qpage)
+ *out_qpage = be64_to_cpu(qpage);
+ if (out_qsize)
+- *out_qsize = be32_to_cpu(qsize);
++ *out_qsize = be64_to_cpu(qsize);
+ if (out_qeoi_page)
+ *out_qeoi_page = be64_to_cpu(qeoi_page);
+ if (out_escalate_irq)
+--
+2.42.0
+
--- /dev/null
+From 6a326100fcca091e4e61bd255b4b74560dd7ad2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jun 2023 10:27:06 +0800
+Subject: pstore/platform: Add check for kstrdup
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit a19d48f7c5d57c0f0405a7d4334d1d38fe9d3c1c ]
+
+Add check for the return value of kstrdup() and return the error
+if it fails in order to avoid NULL pointer dereference.
+
+Fixes: 563ca40ddf40 ("pstore/platform: Switch pstore_info::name to const")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20230623022706.32125-1-jiasheng@iscas.ac.cn
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/platform.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
+index 0c034ea399547..7787fb544621c 100644
+--- a/fs/pstore/platform.c
++++ b/fs/pstore/platform.c
+@@ -561,6 +561,8 @@ static int pstore_write_user_compat(struct pstore_record *record,
+ */
+ int pstore_register(struct pstore_info *psi)
+ {
++ char *new_backend;
++
+ if (backend && strcmp(backend, psi->name)) {
+ pr_warn("ignoring unexpected backend '%s'\n", psi->name);
+ return -EPERM;
+@@ -580,11 +582,16 @@ int pstore_register(struct pstore_info *psi)
+ return -EINVAL;
+ }
+
++ new_backend = kstrdup(psi->name, GFP_KERNEL);
++ if (!new_backend)
++ return -ENOMEM;
++
+ mutex_lock(&psinfo_lock);
+ if (psinfo) {
+ pr_warn("backend '%s' already loaded: ignoring '%s'\n",
+ psinfo->name, psi->name);
+ mutex_unlock(&psinfo_lock);
++ kfree(new_backend);
+ return -EBUSY;
+ }
+
+@@ -617,7 +624,7 @@ int pstore_register(struct pstore_info *psi)
+ * Update the module parameter backend, so it is visible
+ * through /sys/module/pstore/parameters/backend
+ */
+- backend = kstrdup(psi->name, GFP_KERNEL);
++ backend = new_backend;
+
+ pr_info("Registered %s as persistent store backend\n", psi->name);
+
+--
+2.42.0
+
--- /dev/null
+From b687726f68e545fe296baf5ee1b05bcc6bc56810 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 08:51:13 +0200
+Subject: r8169: fix rare issue with broken rx after link-down on RTL8125
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 621735f590643e3048ca2060c285b80551660601 ]
+
+In very rare cases (I've seen two reports so far about different
+RTL8125 chip versions) it seems the MAC locks up when link goes down
+and requires a software reset to get revived.
+Realtek doesn't publish hw errata information, therefore the root cause
+is unknown. Realtek vendor drivers do a full hw re-initialization on
+each link-up event, the slimmed-down variant here was reported to fix
+the issue for the reporting user.
+It's not fully clear which parts of the NIC are reset as part of the
+software reset, therefore I can't rule out side effects.
+
+Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125")
+Reported-by: Martin Kjær Jørgensen <me@lagy.org>
+Link: https://lore.kernel.org/netdev/97ec2232-3257-316c-c3e7-a08192ce16a6@gmail.com/T/
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/9edde757-9c3b-4730-be3b-0ef3a374ff71@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index dd8cb52b0a17e..94f902d8e975f 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4561,7 +4561,11 @@ static void r8169_phylink_handler(struct net_device *ndev)
+ if (netif_carrier_ok(ndev)) {
+ rtl_link_chg_patch(tp);
+ pm_request_resume(d);
++ netif_wake_queue(tp->dev);
+ } else {
++ /* In few cases rx is broken after link-down otherwise */
++ if (rtl_is_8125(tp))
++ rtl_reset_work(tp);
+ pm_runtime_idle(d);
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 72e62fad001db9e61542c0d1099471d17fa96b65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Nov 2022 01:12:44 +0900
+Subject: r8169: use tp_to_dev instead of open code
+
+From: Juhee Kang <claudiajkang@gmail.com>
+
+[ Upstream commit 4b6c6065fca123d419afef005a696f51e6590470 ]
+
+The open code is defined as a helper function(tp_to_dev) on r8169_main.c,
+which the open code is &tp->pci_dev->dev. The helper function was added
+in commit 1e1205b7d3e9 ("r8169: add helper tp_to_dev"). And then later,
+commit f1e911d5d0df ("r8169: add basic phylib support") added
+r8169_phylink_handler function but it didn't use the helper function.
+Thus, tp_to_dev() replaces the open code. This patch doesn't change logic.
+
+Signed-off-by: Juhee Kang <claudiajkang@gmail.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/20221129161244.5356-1-claudiajkang@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: 621735f59064 ("r8169: fix rare issue with broken rx after link-down on RTL8125")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 80b6079b8a8e3..dd8cb52b0a17e 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4556,12 +4556,13 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
+ static void r8169_phylink_handler(struct net_device *ndev)
+ {
+ struct rtl8169_private *tp = netdev_priv(ndev);
++ struct device *d = tp_to_dev(tp);
+
+ if (netif_carrier_ok(ndev)) {
+ rtl_link_chg_patch(tp);
+- pm_request_resume(&tp->pci_dev->dev);
++ pm_request_resume(d);
+ } else {
+- pm_runtime_idle(&tp->pci_dev->dev);
++ pm_runtime_idle(d);
+ }
+
+ phy_print_status(tp->phydev);
+--
+2.42.0
+
--- /dev/null
+From 97eaa92c542a3544c03d4a75e7e21a24ff190a98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Sep 2023 15:21:36 -0600
+Subject: RDMA/core: Use size_{add,sub,mul}() in calls to struct_size()
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit 81760bedc65194ff38e1e4faefd5f9f0c95c19a4 ]
+
+If, for any reason, the open-coded arithmetic causes a wraparound,
+the protection that `struct_size()` provides against potential integer
+overflows is defeated. Fix this by hardening calls to `struct_size()`
+with `size_add()`, `size_sub()` and `size_mul()`.
+
+Fixes: 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes")
+Fixes: a4676388e2e2 ("RDMA/core: Simplify how the gid_attrs sysfs is created")
+Fixes: e9dd5daf884c ("IB/umad: Refactor code to use cdev_device_add()")
+Fixes: 324e227ea7c9 ("RDMA/device: Add ib_device_get_by_netdev()")
+Fixes: 5aad26a7eac5 ("IB/core: Use struct_size() in kzalloc()")
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Link: https://lore.kernel.org/r/ZQdt4NsJFwwOYxUR@work
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/device.c | 2 +-
+ drivers/infiniband/core/sa_query.c | 4 +++-
+ drivers/infiniband/core/sysfs.c | 10 +++++-----
+ drivers/infiniband/core/user_mad.c | 4 +++-
+ 4 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 3c422698a51c1..3a9b9a28d858f 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -804,7 +804,7 @@ static int alloc_port_data(struct ib_device *device)
+ * empty slots at the beginning.
+ */
+ pdata_rcu = kzalloc(struct_size(pdata_rcu, pdata,
+- rdma_end_port(device) + 1),
++ size_add(rdma_end_port(device), 1)),
+ GFP_KERNEL);
+ if (!pdata_rcu)
+ return -ENOMEM;
+diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
+index 0de83d9a4985d..8c69bdb5bb754 100644
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -2220,7 +2220,9 @@ static int ib_sa_add_one(struct ib_device *device)
+ s = rdma_start_port(device);
+ e = rdma_end_port(device);
+
+- sa_dev = kzalloc(struct_size(sa_dev, port, e - s + 1), GFP_KERNEL);
++ sa_dev = kzalloc(struct_size(sa_dev, port,
++ size_add(size_sub(e, s), 1)),
++ GFP_KERNEL);
+ if (!sa_dev)
+ return -ENOMEM;
+
+diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
+index ee59d73915689..ec5efdc166601 100644
+--- a/drivers/infiniband/core/sysfs.c
++++ b/drivers/infiniband/core/sysfs.c
+@@ -903,7 +903,7 @@ alloc_hw_stats_device(struct ib_device *ibdev)
+ * Two extra attribue elements here, one for the lifespan entry and
+ * one to NULL terminate the list for the sysfs core code
+ */
+- data = kzalloc(struct_size(data, attrs, stats->num_counters + 1),
++ data = kzalloc(struct_size(data, attrs, size_add(stats->num_counters, 1)),
+ GFP_KERNEL);
+ if (!data)
+ goto err_free_stats;
+@@ -1009,7 +1009,7 @@ alloc_hw_stats_port(struct ib_port *port, struct attribute_group *group)
+ * Two extra attribue elements here, one for the lifespan entry and
+ * one to NULL terminate the list for the sysfs core code
+ */
+- data = kzalloc(struct_size(data, attrs, stats->num_counters + 1),
++ data = kzalloc(struct_size(data, attrs, size_add(stats->num_counters, 1)),
+ GFP_KERNEL);
+ if (!data)
+ goto err_free_stats;
+@@ -1140,7 +1140,7 @@ static int setup_gid_attrs(struct ib_port *port,
+ int ret;
+
+ gid_attr_group = kzalloc(struct_size(gid_attr_group, attrs_list,
+- attr->gid_tbl_len * 2),
++ size_mul(attr->gid_tbl_len, 2)),
+ GFP_KERNEL);
+ if (!gid_attr_group)
+ return -ENOMEM;
+@@ -1205,8 +1205,8 @@ static struct ib_port *setup_port(struct ib_core_device *coredev, int port_num,
+ int ret;
+
+ p = kvzalloc(struct_size(p, attrs_list,
+- attr->gid_tbl_len + attr->pkey_tbl_len),
+- GFP_KERNEL);
++ size_add(attr->gid_tbl_len, attr->pkey_tbl_len)),
++ GFP_KERNEL);
+ if (!p)
+ return ERR_PTR(-ENOMEM);
+ p->ibdev = device;
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index 98cb594cd9a69..d96c78e436f98 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -1373,7 +1373,9 @@ static int ib_umad_add_one(struct ib_device *device)
+ s = rdma_start_port(device);
+ e = rdma_end_port(device);
+
+- umad_dev = kzalloc(struct_size(umad_dev, ports, e - s + 1), GFP_KERNEL);
++ umad_dev = kzalloc(struct_size(umad_dev, ports,
++ size_add(size_sub(e, s), 1)),
++ GFP_KERNEL);
+ if (!umad_dev)
+ return -ENOMEM;
+
+--
+2.42.0
+
--- /dev/null
+From e4642872340bfd813f8ba50513347f45f3a149d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 18:07:31 +0300
+Subject: RDMA/hfi1: Workaround truncation compilation error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit d4b2d165714c0ce8777d5131f6e0aad617b7adc4 ]
+
+Increase name array to be large enough to overcome the following
+compilation error.
+
+drivers/infiniband/hw/hfi1/efivar.c: In function ‘read_hfi1_efi_var’:
+drivers/infiniband/hw/hfi1/efivar.c:124:44: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
+ 124 | snprintf(name, sizeof(name), "%s-%s", prefix_name, kind);
+ | ^
+drivers/infiniband/hw/hfi1/efivar.c:124:9: note: ‘snprintf’ output 2 or more bytes (assuming 65) into a destination of size 64
+ 124 | snprintf(name, sizeof(name), "%s-%s", prefix_name, kind);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/infiniband/hw/hfi1/efivar.c:133:52: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
+ 133 | snprintf(name, sizeof(name), "%s-%s", prefix_name, kind);
+ | ^
+drivers/infiniband/hw/hfi1/efivar.c:133:17: note: ‘snprintf’ output 2 or more bytes (assuming 65) into a destination of size 64
+ 133 | snprintf(name, sizeof(name), "%s-%s", prefix_name, kind);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+cc1: all warnings being treated as errors
+make[6]: *** [scripts/Makefile.build:243: drivers/infiniband/hw/hfi1/efivar.o] Error 1
+
+Fixes: c03c08d50b3d ("IB/hfi1: Check upper-case EFI variables")
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/238fa39a8fd60e87a5ad7e1ca6584fcdf32e9519.1698159993.git.leonro@nvidia.com
+Acked-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/efivar.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/efivar.c b/drivers/infiniband/hw/hfi1/efivar.c
+index 7741a1d69097c..2b5d264f41e51 100644
+--- a/drivers/infiniband/hw/hfi1/efivar.c
++++ b/drivers/infiniband/hw/hfi1/efivar.c
+@@ -112,7 +112,7 @@ int read_hfi1_efi_var(struct hfi1_devdata *dd, const char *kind,
+ unsigned long *size, void **return_data)
+ {
+ char prefix_name[64];
+- char name[64];
++ char name[128];
+ int result;
+
+ /* create a common prefix */
+--
+2.42.0
+
--- /dev/null
+From 7bb32869dbee689e853e1ba22e3b49f934b68657 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 20:52:36 +0800
+Subject: RDMA/hns: Add check for SL
+
+From: Luoyouming <luoyouming@huawei.com>
+
+[ Upstream commit 5e617c18b1f34ec57ad5dce44f09de603cf6bd6c ]
+
+SL set by users may exceed the capability of devices. So add check
+for this situation.
+
+Fixes: fba429fcf9a5 ("RDMA/hns: Fix missing fields in address vector")
+Fixes: 70f92521584f ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT")
+Fixes: f0cb411aad23 ("RDMA/hns: Use new interface to modify QP context")
+Signed-off-by: Luoyouming <luoyouming@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20231017125239.164455-5-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_ah.c | 13 +++++++++++-
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 23 ++++++++++++----------
+ 2 files changed, 25 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
+index 480c062dd04f1..103a7787b3712 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
++++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
+@@ -33,7 +33,9 @@
+ #include <linux/pci.h>
+ #include <rdma/ib_addr.h>
+ #include <rdma/ib_cache.h>
++#include "hnae3.h"
+ #include "hns_roce_device.h"
++#include "hns_roce_hw_v2.h"
+
+ static inline u16 get_ah_udp_sport(const struct rdma_ah_attr *ah_attr)
+ {
+@@ -58,6 +60,7 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
+ struct hns_roce_dev *hr_dev = to_hr_dev(ibah->device);
+ struct hns_roce_ah *ah = to_hr_ah(ibah);
+ int ret = 0;
++ u32 max_sl;
+
+ if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08 && udata)
+ return -EOPNOTSUPP;
+@@ -71,9 +74,17 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
+ ah->av.hop_limit = grh->hop_limit;
+ ah->av.flowlabel = grh->flow_label;
+ ah->av.udp_sport = get_ah_udp_sport(ah_attr);
+- ah->av.sl = rdma_ah_get_sl(ah_attr);
+ ah->av.tclass = get_tclass(grh);
+
++ ah->av.sl = rdma_ah_get_sl(ah_attr);
++ max_sl = min_t(u32, MAX_SERVICE_LEVEL, hr_dev->caps.sl_num - 1);
++ if (unlikely(ah->av.sl > max_sl)) {
++ ibdev_err_ratelimited(&hr_dev->ib_dev,
++ "failed to set sl, sl (%u) shouldn't be larger than %u.\n",
++ ah->av.sl, max_sl);
++ return -EINVAL;
++ }
++
+ memcpy(ah->av.dgid, grh->dgid.raw, HNS_ROCE_GID_SIZE);
+ memcpy(ah->av.mac, ah_attr->roce.dmac, ETH_ALEN);
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 6a9e29a44bf74..56da0a469882d 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4979,22 +4979,32 @@ static int hns_roce_v2_set_path(struct ib_qp *ibqp,
+ struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
+ struct ib_device *ibdev = &hr_dev->ib_dev;
+ const struct ib_gid_attr *gid_attr = NULL;
++ u8 sl = rdma_ah_get_sl(&attr->ah_attr);
+ int is_roce_protocol;
+ u16 vlan_id = 0xffff;
+ bool is_udp = false;
++ u32 max_sl;
+ u8 ib_port;
+ u8 hr_port;
+ int ret;
+
++ max_sl = min_t(u32, MAX_SERVICE_LEVEL, hr_dev->caps.sl_num - 1);
++ if (unlikely(sl > max_sl)) {
++ ibdev_err_ratelimited(ibdev,
++ "failed to fill QPC, sl (%u) shouldn't be larger than %u.\n",
++ sl, max_sl);
++ return -EINVAL;
++ }
++
+ /*
+ * If free_mr_en of qp is set, it means that this qp comes from
+ * free mr. This qp will perform the loopback operation.
+ * In the loopback scenario, only sl needs to be set.
+ */
+ if (hr_qp->free_mr_en) {
+- hr_reg_write(context, QPC_SL, rdma_ah_get_sl(&attr->ah_attr));
++ hr_reg_write(context, QPC_SL, sl);
+ hr_reg_clear(qpc_mask, QPC_SL);
+- hr_qp->sl = rdma_ah_get_sl(&attr->ah_attr);
++ hr_qp->sl = sl;
+ return 0;
+ }
+
+@@ -5061,14 +5071,7 @@ static int hns_roce_v2_set_path(struct ib_qp *ibqp,
+ memcpy(context->dgid, grh->dgid.raw, sizeof(grh->dgid.raw));
+ memset(qpc_mask->dgid, 0, sizeof(grh->dgid.raw));
+
+- hr_qp->sl = rdma_ah_get_sl(&attr->ah_attr);
+- if (unlikely(hr_qp->sl > MAX_SERVICE_LEVEL)) {
+- ibdev_err(ibdev,
+- "failed to fill QPC, sl (%u) shouldn't be larger than %d.\n",
+- hr_qp->sl, MAX_SERVICE_LEVEL);
+- return -EINVAL;
+- }
+-
++ hr_qp->sl = sl;
+ hr_reg_write(context, QPC_SL, hr_qp->sl);
+ hr_reg_clear(qpc_mask, QPC_SL);
+
+--
+2.42.0
+
--- /dev/null
+From 4c6e4759bbf99c1d96627061c25ac514995c5dea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 20:52:33 +0800
+Subject: RDMA/hns: Fix printing level of asynchronous events
+
+From: Chengchang Tang <tangchengchang@huawei.com>
+
+[ Upstream commit 9faef73ef4f6666b97e04d99734ac09251098185 ]
+
+The current driver will print all asynchronous events. Some of the
+print levels are set improperly, e.g. SRQ limit reach and SRQ last
+wqe reach, which may also occur during normal operation of the software.
+Currently, the information of these event is printed as a warning,
+which causes a large amount of printing even during normal use of the
+application. As a result, the service performance deteriorates.
+
+This patch fixes the printing storms by modifying the print level.
+
+Fixes: b00a92c8f2ca ("RDMA/hns: Move all prints out of irq handle")
+Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20231017125239.164455-2-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 33980485ef5ba..db21d6f2d59ff 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -5961,7 +5961,7 @@ static void hns_roce_irq_work_handle(struct work_struct *work)
+ case HNS_ROCE_EVENT_TYPE_COMM_EST:
+ break;
+ case HNS_ROCE_EVENT_TYPE_SQ_DRAINED:
+- ibdev_warn(ibdev, "send queue drained.\n");
++ ibdev_dbg(ibdev, "send queue drained.\n");
+ break;
+ case HNS_ROCE_EVENT_TYPE_WQ_CATAS_ERROR:
+ ibdev_err(ibdev, "local work queue 0x%x catast error, sub_event type is: %d\n",
+@@ -5976,10 +5976,10 @@ static void hns_roce_irq_work_handle(struct work_struct *work)
+ irq_work->queue_num, irq_work->sub_type);
+ break;
+ case HNS_ROCE_EVENT_TYPE_SRQ_LIMIT_REACH:
+- ibdev_warn(ibdev, "SRQ limit reach.\n");
++ ibdev_dbg(ibdev, "SRQ limit reach.\n");
+ break;
+ case HNS_ROCE_EVENT_TYPE_SRQ_LAST_WQE_REACH:
+- ibdev_warn(ibdev, "SRQ last wqe reach.\n");
++ ibdev_dbg(ibdev, "SRQ last wqe reach.\n");
+ break;
+ case HNS_ROCE_EVENT_TYPE_SRQ_CATAS_ERROR:
+ ibdev_err(ibdev, "SRQ catas error.\n");
+--
+2.42.0
+
--- /dev/null
+From ba46188b6ad734ba1e0dbc773be5342606798826 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 20:52:35 +0800
+Subject: RDMA/hns: Fix signed-unsigned mixed comparisons
+
+From: Chengchang Tang <tangchengchang@huawei.com>
+
+[ Upstream commit b5f9efff101b06fd06a5e280a2b00b1335f5f476 ]
+
+The ib_mtu_enum_to_int() and uverbs_attr_get_len() may returns a negative
+value. In this case, mixed comparisons of signed and unsigned types will
+throw wrong results.
+
+This patch adds judgement for this situation.
+
+Fixes: 30b707886aeb ("RDMA/hns: Support inline data in extented sge space for RC")
+Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20231017125239.164455-4-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index db21d6f2d59ff..6a9e29a44bf74 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -270,7 +270,7 @@ static bool check_inl_data_len(struct hns_roce_qp *qp, unsigned int len)
+ struct hns_roce_dev *hr_dev = to_hr_dev(qp->ibqp.device);
+ int mtu = ib_mtu_enum_to_int(qp->path_mtu);
+
+- if (len > qp->max_inline_data || len > mtu) {
++ if (mtu < 0 || len > qp->max_inline_data || len > mtu) {
+ ibdev_err(&hr_dev->ib_dev,
+ "invalid length of data, data len = %u, max inline len = %u, path mtu = %d.\n",
+ len, qp->max_inline_data, mtu);
+--
+2.42.0
+
--- /dev/null
+From 6c65b2c81da49ffce97ecc7f96aaea7faf1abbdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 20:52:34 +0800
+Subject: RDMA/hns: Fix uninitialized ucmd in hns_roce_create_qp_common()
+
+From: Chengchang Tang <tangchengchang@huawei.com>
+
+[ Upstream commit c64e9710f9241e38a1c761ed1c1a30854784da66 ]
+
+ucmd in hns_roce_create_qp_common() are not initialized. But it works fine
+until new member sdb_addr is added to struct hns_roce_ib_create_qp.
+
+If the user-mode driver uses an old version ABI, then the value of the new
+member will be undefined after ib_copy_from_udata().
+
+This patch fixes it by initialize this variable to 0. And the default value
+of the new member sdb_addr will be 0 which is invalid.
+
+Fixes: 0425e3e6e0c7 ("RDMA/hns: Support flush cqe for hip08 in kernel space")
+Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20231017125239.164455-3-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 7a95f8677a02c..7b79e6b3f3baa 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -1128,7 +1128,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
+ {
+ struct hns_roce_ib_create_qp_resp resp = {};
+ struct ib_device *ibdev = &hr_dev->ib_dev;
+- struct hns_roce_ib_create_qp ucmd;
++ struct hns_roce_ib_create_qp ucmd = {};
+ int ret;
+
+ mutex_init(&hr_qp->mutex);
+--
+2.42.0
+
--- /dev/null
+From e32959a4a6694afe0d93488e335ab14b6f973968 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 20:52:37 +0800
+Subject: RDMA/hns: The UD mode can only be configured with DCQCN
+
+From: Luoyouming <luoyouming@huawei.com>
+
+[ Upstream commit 27c5fd271d8b8730fc0bb1b6cae953ad7808a874 ]
+
+Due to hardware limitations, only DCQCN is supported for UD. Therefore, the
+default algorithm for UD is set to DCQCN.
+
+Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW")
+Signed-off-by: Luoyouming <luoyouming@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20231017125239.164455-6-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 56da0a469882d..8a9d28f81149a 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4883,6 +4883,9 @@ static int check_cong_type(struct ib_qp *ibqp,
+ {
+ struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
+
++ if (ibqp->qp_type == IB_QPT_UD)
++ hr_dev->caps.cong_type = CONG_TYPE_DCQCN;
++
+ /* different congestion types match different configurations */
+ switch (hr_dev->caps.cong_type) {
+ case CONG_TYPE_DCQCN:
+--
+2.42.0
+
--- /dev/null
+From 55cce0a48ad8f157e8a6cf5c139b66b60b2f6a1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Sep 2023 22:04:06 +0200
+Subject: regmap: debugfs: Fix a erroneous check after snprintf()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit d3601857e14de6369f00ae19564f1d817d175d19 ]
+
+This error handling looks really strange.
+Check if the string has been truncated instead.
+
+Fixes: f0c2319f9f19 ("regmap: Expose the driver name in debugfs")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/8595de2462c490561f70020a6d11f4d6b652b468.1693857825.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap-debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index 817eda2075aa5..1e3d205ce15a0 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -48,7 +48,7 @@ static ssize_t regmap_name_read_file(struct file *file,
+ name = map->dev->driver->name;
+
+ ret = snprintf(buf, PAGE_SIZE, "%s\n", name);
+- if (ret < 0) {
++ if (ret >= PAGE_SIZE) {
+ kfree(buf);
+ return ret;
+ }
+--
+2.42.0
+
--- /dev/null
+From f21f91eaa3c17ba38f42e8248fe79a68814e6bee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Nov 2023 10:29:27 -0400
+Subject: regmap: prevent noinc writes from clobbering cache
+
+From: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+
+[ Upstream commit 984a4afdc87a1fc226fd657b1cd8255c13d3fc1a ]
+
+Currently, noinc writes are cached as if they were standard incrementing
+writes, overwriting unrelated register values in the cache. Instead, we
+want to cache the last value written to the register, as is done in the
+accelerated noinc handler (regmap_noinc_readwrite).
+
+Fixes: cdf6b11daa77 ("regmap: Add regmap_noinc_write API")
+Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+Link: https://lore.kernel.org/r/20231101142926.2722603-2-ben.wolsieffer@hefring.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index df1f78abdf266..140af27f591ae 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1702,17 +1702,19 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg,
+ }
+
+ if (!map->cache_bypass && map->format.parse_val) {
+- unsigned int ival;
++ unsigned int ival, offset;
+ int val_bytes = map->format.val_bytes;
+- for (i = 0; i < val_len / val_bytes; i++) {
+- ival = map->format.parse_val(val + (i * val_bytes));
+- ret = regcache_write(map,
+- reg + regmap_get_offset(map, i),
+- ival);
++
++ /* Cache the last written value for noinc writes */
++ i = noinc ? val_len - val_bytes : 0;
++ for (; i < val_len; i += val_bytes) {
++ ival = map->format.parse_val(val + i);
++ offset = noinc ? 0 : regmap_get_offset(map, i / val_bytes);
++ ret = regcache_write(map, reg + offset, ival);
+ if (ret) {
+ dev_err(map->dev,
+ "Error in caching of register: %x ret: %d\n",
+- reg + regmap_get_offset(map, i), ret);
++ reg + offset, ret);
+ return ret;
+ }
+ }
+--
+2.42.0
+
--- /dev/null
+From 487b37005d7a4a8e8046a13e31f7033f7648242d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 16:29:16 +0800
+Subject: regulator: mt6358: Fail probe on unknown chip ID
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 7442edec72bc657e6ce38ae01de9f10e55decfaa ]
+
+The MT6358 and MT6366 PMICs, and likely many others from MediaTek, have
+a chip ID register, making the chip semi-discoverable.
+
+The driver currently supports two PMICs and expects to be probed on one
+or the other. It does not account for incorrect mfd driver entries or
+device trees. While these should not happen, if they do, it could be
+catastrophic for the device. The driver should be sure the hardware is
+what it expects.
+
+Make the driver fail to probe if the chip ID presented is not a known
+one.
+
+Suggested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Fixes: f0e3c6261af1 ("regulator: mt6366: Add support for MT6366 regulator")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230913082919.1631287-2-wenst@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/mt6358-regulator.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/regulator/mt6358-regulator.c b/drivers/regulator/mt6358-regulator.c
+index a0441b8086712..de7b5db8f7f2d 100644
+--- a/drivers/regulator/mt6358-regulator.c
++++ b/drivers/regulator/mt6358-regulator.c
+@@ -655,12 +655,18 @@ static int mt6358_regulator_probe(struct platform_device *pdev)
+ struct mt6358_regulator_info *mt6358_info;
+ int i, max_regulator;
+
+- if (mt6397->chip_id == MT6366_CHIP_ID) {
+- max_regulator = MT6366_MAX_REGULATOR;
+- mt6358_info = mt6366_regulators;
+- } else {
++ switch (mt6397->chip_id) {
++ case MT6358_CHIP_ID:
+ max_regulator = MT6358_MAX_REGULATOR;
+ mt6358_info = mt6358_regulators;
++ break;
++ case MT6366_CHIP_ID:
++ max_regulator = MT6366_MAX_REGULATOR;
++ mt6358_info = mt6366_regulators;
++ break;
++ default:
++ dev_err(&pdev->dev, "unsupported chip ID: %d\n", mt6397->chip_id);
++ return -EINVAL;
+ }
+
+ for (i = 0; i < max_regulator; i++) {
+--
+2.42.0
+
--- /dev/null
+From 0eba37d97c4acfbcc8863f303946de59f0b37619 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Dec 2022 16:43:43 +0100
+Subject: Revert "HID: logitech-hidpp: add a module parameter to keep firmware
+ gestures"
+
+From: Bastien Nocera <hadess@hadess.net>
+
+[ Upstream commit cae253d6033da885e71c29c1591b22838a52de76 ]
+
+Now that we're in 2022, and the majority of desktop environments can and
+should support touchpad gestures through libinput, remove the legacy
+module parameter that made it possible to use gestures implemented in
+firmware.
+
+This will eventually allow simplifying the driver's initialisation code.
+
+This reverts commit 9188dbaed68a4b23dc96eba165265c08caa7dc2a.
+
+Signed-off-by: Bastien Nocera <hadess@hadess.net>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Link: https://lore.kernel.org/r/20221220154345.474596-1-hadess@hadess.net
+Stable-dep-of: 11ca0322a419 ("HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 8d0dad12b2d37..d2772dfc4da6a 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -31,11 +31,6 @@ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Benjamin Tissoires <benjamin.tissoires@gmail.com>");
+ MODULE_AUTHOR("Nestor Lopez Casado <nlopezcasad@logitech.com>");
+
+-static bool disable_raw_mode;
+-module_param(disable_raw_mode, bool, 0644);
+-MODULE_PARM_DESC(disable_raw_mode,
+- "Disable Raw mode reporting for touchpads and keep firmware gestures.");
+-
+ static bool disable_tap_to_click;
+ module_param(disable_tap_to_click, bool, 0644);
+ MODULE_PARM_DESC(disable_tap_to_click,
+@@ -4190,11 +4185,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ hidpp_application_equals(hdev, HID_GD_KEYBOARD))
+ hidpp->quirks |= HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS;
+
+- if (disable_raw_mode) {
+- hidpp->quirks &= ~HIDPP_QUIRK_CLASS_WTP;
+- hidpp->quirks &= ~HIDPP_QUIRK_NO_HIDINPUT;
+- }
+-
+ if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
+ ret = wtp_allocate(hdev, id);
+ if (ret)
+--
+2.42.0
+
--- /dev/null
+From a95e63c4c94d8d3815f1b507b15edd9039f46307 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Oct 2023 14:32:40 -0700
+Subject: Revert "hwmon: (sch56xx-common) Add automatic module loading on
+ supported devices"
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit d621a46d05107f4e510383d6a38f2160c62d28f7 ]
+
+This reverts commit 393935baa45e5ccb9603cf7f9f020ed1bc0915f7.
+
+As reported by Ian Nartowicz, this and the next patch
+result in a failure to load the driver on Celsius W280.
+While the alternative would be to add the board to the DMI
+override table, it is quite likely that other systems are
+also affected. Revert the offending patches to avoid future
+problems.
+
+Fixes: 393935baa45e ("hwmon: (sch56xx-common) Add automatic module loading on supported devices")
+Reported-by: Ian Nartowicz <deadbeef@nartowicz.co.uk>
+Closes: https://lore.kernel.org/linux-hwmon/20231025192239.3c5389ae@debian.org/T/#t
+Cc: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sch56xx-common.c | 40 ++--------------------------------
+ 1 file changed, 2 insertions(+), 38 deletions(-)
+
+diff --git a/drivers/hwmon/sch56xx-common.c b/drivers/hwmon/sch56xx-common.c
+index 3ece53adabd62..ac1f725807155 100644
+--- a/drivers/hwmon/sch56xx-common.c
++++ b/drivers/hwmon/sch56xx-common.c
+@@ -7,10 +7,8 @@
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+ #include <linux/module.h>
+-#include <linux/mod_devicetable.h>
+ #include <linux/init.h>
+ #include <linux/platform_device.h>
+-#include <linux/dmi.h>
+ #include <linux/err.h>
+ #include <linux/io.h>
+ #include <linux/acpi.h>
+@@ -21,10 +19,7 @@
+ #include <linux/slab.h>
+ #include "sch56xx-common.h"
+
+-static bool ignore_dmi;
+-module_param(ignore_dmi, bool, 0);
+-MODULE_PARM_DESC(ignore_dmi, "Omit DMI check for supported devices (default=0)");
+-
++/* Insmod parameters */
+ static bool nowayout = WATCHDOG_NOWAYOUT;
+ module_param(nowayout, bool, 0);
+ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
+@@ -523,42 +518,11 @@ static int __init sch56xx_device_add(int address, const char *name)
+ return PTR_ERR_OR_ZERO(sch56xx_pdev);
+ }
+
+-/* For autoloading only */
+-static const struct dmi_system_id sch56xx_dmi_table[] __initconst = {
+- {
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- },
+- },
+- { }
+-};
+-MODULE_DEVICE_TABLE(dmi, sch56xx_dmi_table);
+-
+ static int __init sch56xx_init(void)
+ {
+- const char *name = NULL;
+ int address;
++ const char *name = NULL;
+
+- if (!ignore_dmi) {
+- if (!dmi_check_system(sch56xx_dmi_table))
+- return -ENODEV;
+-
+- /*
+- * Some machines like the Esprimo P720 and Esprimo C700 have
+- * onboard devices named " Antiope"/" Theseus" instead of
+- * "Antiope"/"Theseus", so we need to check for both.
+- */
+- if (!dmi_find_device(DMI_DEV_TYPE_OTHER, "Antiope", NULL) &&
+- !dmi_find_device(DMI_DEV_TYPE_OTHER, " Antiope", NULL) &&
+- !dmi_find_device(DMI_DEV_TYPE_OTHER, "Theseus", NULL) &&
+- !dmi_find_device(DMI_DEV_TYPE_OTHER, " Theseus", NULL))
+- return -ENODEV;
+- }
+-
+- /*
+- * Some devices like the Esprimo C700 have both onboard devices,
+- * so we still have to check manually
+- */
+ address = sch56xx_find(0x4e, &name);
+ if (address < 0)
+ address = sch56xx_find(0x2e, &name);
+--
+2.42.0
+
--- /dev/null
+From a686cf3c5694f7fe7c51d1f9d5252aecdcf9326b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Oct 2023 14:28:49 -0700
+Subject: Revert "hwmon: (sch56xx-common) Add DMI override table"
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 28da9dee3594423534f3ea1e1f61e6bb2d2fa651 ]
+
+This reverts commit fd2d53c367ae9983c2100ac733a834e0c79d7537.
+
+As reported by Ian Nartowicz, this and the preceding patch
+result in a failure to load the driver on Celsius W280.
+While the alternative would be to add the board to the DMI
+override table, it is quite likely that other systems are
+also affected. Revert the offending patches to avoid future
+problems.
+
+Fixes: fd2d53c367ae ("hwmon: (sch56xx-common) Add DMI override table")
+Reported-by: Ian Nartowicz <deadbeef@nartowicz.co.uk>
+Closes: https://lore.kernel.org/linux-hwmon/20231025192239.3c5389ae@debian.org/T/#t
+Cc: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sch56xx-common.c | 44 ++++++++--------------------------
+ 1 file changed, 10 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/hwmon/sch56xx-common.c b/drivers/hwmon/sch56xx-common.c
+index de3a0886c2f72..3ece53adabd62 100644
+--- a/drivers/hwmon/sch56xx-common.c
++++ b/drivers/hwmon/sch56xx-common.c
+@@ -523,28 +523,6 @@ static int __init sch56xx_device_add(int address, const char *name)
+ return PTR_ERR_OR_ZERO(sch56xx_pdev);
+ }
+
+-static const struct dmi_system_id sch56xx_dmi_override_table[] __initconst = {
+- {
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS W380"),
+- },
+- },
+- {
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "ESPRIMO P710"),
+- },
+- },
+- {
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "ESPRIMO E9900"),
+- },
+- },
+- { }
+-};
+-
+ /* For autoloading only */
+ static const struct dmi_system_id sch56xx_dmi_table[] __initconst = {
+ {
+@@ -565,18 +543,16 @@ static int __init sch56xx_init(void)
+ if (!dmi_check_system(sch56xx_dmi_table))
+ return -ENODEV;
+
+- if (!dmi_check_system(sch56xx_dmi_override_table)) {
+- /*
+- * Some machines like the Esprimo P720 and Esprimo C700 have
+- * onboard devices named " Antiope"/" Theseus" instead of
+- * "Antiope"/"Theseus", so we need to check for both.
+- */
+- if (!dmi_find_device(DMI_DEV_TYPE_OTHER, "Antiope", NULL) &&
+- !dmi_find_device(DMI_DEV_TYPE_OTHER, " Antiope", NULL) &&
+- !dmi_find_device(DMI_DEV_TYPE_OTHER, "Theseus", NULL) &&
+- !dmi_find_device(DMI_DEV_TYPE_OTHER, " Theseus", NULL))
+- return -ENODEV;
+- }
++ /*
++ * Some machines like the Esprimo P720 and Esprimo C700 have
++ * onboard devices named " Antiope"/" Theseus" instead of
++ * "Antiope"/"Theseus", so we need to check for both.
++ */
++ if (!dmi_find_device(DMI_DEV_TYPE_OTHER, "Antiope", NULL) &&
++ !dmi_find_device(DMI_DEV_TYPE_OTHER, " Antiope", NULL) &&
++ !dmi_find_device(DMI_DEV_TYPE_OTHER, "Theseus", NULL) &&
++ !dmi_find_device(DMI_DEV_TYPE_OTHER, " Theseus", NULL))
++ return -ENODEV;
+ }
+
+ /*
+--
+2.42.0
+
--- /dev/null
+From e01c58942d526deb6a38e037a2c9bd62b28f75ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 16:34:21 +0200
+Subject: rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits
+ call
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+[ Upstream commit 2be36c09b6b07306be33519e1aa70d2e2a2161bb ]
+
+The current implementation passes PIN_IO_INTA_OUT (2) as a mask and
+PIN_IO_INTAPM (GENMASK(1, 0)) as a value.
+Swap the variables to assign mask and value the right way.
+
+This error was first introduced with the alarm support. For better or
+worse it worked as expected because 0x02 was applied as a mask to 0x03,
+resulting 0x02 anyway. This will of course not work for any other value.
+
+Fixes: e5aac267a10a ("rtc: pcf85363: add alarm support")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://lore.kernel.org/r/20231013-topic-pcf85363_regmap_update_bits-v1-1-c454f016f71f@gmail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf85363.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-pcf85363.c b/drivers/rtc/rtc-pcf85363.c
+index c05b722f00605..0d1517cb3c62d 100644
+--- a/drivers/rtc/rtc-pcf85363.c
++++ b/drivers/rtc/rtc-pcf85363.c
+@@ -402,7 +402,7 @@ static int pcf85363_probe(struct i2c_client *client)
+ if (client->irq > 0) {
+ regmap_write(pcf85363->regmap, CTRL_FLAGS, 0);
+ regmap_update_bits(pcf85363->regmap, CTRL_PIN_IO,
+- PIN_IO_INTA_OUT, PIN_IO_INTAPM);
++ PIN_IO_INTAPM, PIN_IO_INTA_OUT);
+ ret = devm_request_threaded_irq(&client->dev, client->irq,
+ NULL, pcf85363_rtc_handle_irq,
+ IRQF_TRIGGER_LOW | IRQF_ONESHOT,
+--
+2.42.0
+
--- /dev/null
+From 801e15f4002f036c5a55c32fc46b81fbe32ef1fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 13:20:31 +0000
+Subject: sched/fair: Fix cfs_rq_is_decayed() on !SMP
+
+From: Chengming Zhou <zhouchengming@bytedance.com>
+
+[ Upstream commit c0490bc9bb62d9376f3dd4ec28e03ca0fef97152 ]
+
+We don't need to maintain per-queue leaf_cfs_rq_list on !SMP, since
+it's used for cfs_rq load tracking & balancing on SMP.
+
+But sched debug interface uses it to print per-cfs_rq stats.
+
+This patch fixes the !SMP version of cfs_rq_is_decayed(), so the
+per-queue leaf_cfs_rq_list is also maintained correctly on !SMP,
+to fix the warning in assert_list_leaf_cfs_rq().
+
+Fixes: 0a00a354644e ("sched/fair: Delete useless condition in tg_unthrottle_up()")
+Reported-by: Leo Yu-Chi Liang <ycliang@andestech.com>
+Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Leo Yu-Chi Liang <ycliang@andestech.com>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Closes: https://lore.kernel.org/all/ZN87UsqkWcFLDxea@swlinux02/
+Link: https://lore.kernel.org/r/20230913132031.2242151-1-chengming.zhou@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 612873ec2197f..65cd5c153216c 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4585,7 +4585,7 @@ static inline void update_misfit_status(struct task_struct *p, struct rq *rq)
+
+ static inline bool cfs_rq_is_decayed(struct cfs_rq *cfs_rq)
+ {
+- return true;
++ return !cfs_rq->nr_running;
+ }
+
+ #define UPDATE_TG 0x0
+--
+2.42.0
+
--- /dev/null
+From e5d9883a8df354bc7eb4c56bfd5aded48b302bd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Oct 2023 20:57:39 +0200
+Subject: sched: Fix stop_one_cpu_nowait() vs hotplug
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit f0498d2a54e7966ce23cd7c7ff42c64fa0059b07 ]
+
+Kuyo reported sporadic failures on a sched_setaffinity() vs CPU
+hotplug stress-test -- notably affine_move_task() remains stuck in
+wait_for_completion(), leading to a hung-task detector warning.
+
+Specifically, it was reported that stop_one_cpu_nowait(.fn =
+migration_cpu_stop) returns false -- this stopper is responsible for
+the matching complete().
+
+The race scenario is:
+
+ CPU0 CPU1
+
+ // doing _cpu_down()
+
+ __set_cpus_allowed_ptr()
+ task_rq_lock();
+ takedown_cpu()
+ stop_machine_cpuslocked(take_cpu_down..)
+
+ <PREEMPT: cpu_stopper_thread()
+ MULTI_STOP_PREPARE
+ ...
+ __set_cpus_allowed_ptr_locked()
+ affine_move_task()
+ task_rq_unlock();
+
+ <PREEMPT: cpu_stopper_thread()\>
+ ack_state()
+ MULTI_STOP_RUN
+ take_cpu_down()
+ __cpu_disable();
+ stop_machine_park();
+ stopper->enabled = false;
+ />
+ />
+ stop_one_cpu_nowait(.fn = migration_cpu_stop);
+ if (stopper->enabled) // false!!!
+
+That is, by doing stop_one_cpu_nowait() after dropping rq-lock, the
+stopper thread gets a chance to preempt and allows the cpu-down for
+the target CPU to complete.
+
+OTOH, since stop_one_cpu_nowait() / cpu_stop_queue_work() needs to
+issue a wakeup, it must not be ran under the scheduler locks.
+
+Solve this apparent contradiction by keeping preemption disabled over
+the unlock + queue_stopper combination:
+
+ preempt_disable();
+ task_rq_unlock(...);
+ if (!stop_pending)
+ stop_one_cpu_nowait(...)
+ preempt_enable();
+
+This respects the lock ordering contraints while still avoiding the
+above race. That is, if we find the CPU is online under rq-lock, the
+targeted stop_one_cpu_nowait() must succeed.
+
+Apply this pattern to all similar stop_one_cpu_nowait() invocations.
+
+Fixes: 6d337eab041d ("sched: Fix migrate_disable() vs set_cpus_allowed_ptr()")
+Reported-by: "Kuyo Chang (張建文)" <Kuyo.Chang@mediatek.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: "Kuyo Chang (張建文)" <Kuyo.Chang@mediatek.com>
+Link: https://lkml.kernel.org/r/20231010200442.GA16515@noisy.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 10 ++++++++--
+ kernel/sched/deadline.c | 2 ++
+ kernel/sched/fair.c | 4 +++-
+ kernel/sched/rt.c | 4 ++++
+ 4 files changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 55d13980e29fd..18a4f8f28a25f 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -2463,9 +2463,11 @@ static int migration_cpu_stop(void *data)
+ * it.
+ */
+ WARN_ON_ONCE(!pending->stop_pending);
++ preempt_disable();
+ task_rq_unlock(rq, p, &rf);
+ stop_one_cpu_nowait(task_cpu(p), migration_cpu_stop,
+ &pending->arg, &pending->stop_work);
++ preempt_enable();
+ return 0;
+ }
+ out:
+@@ -2746,12 +2748,13 @@ static int affine_move_task(struct rq *rq, struct task_struct *p, struct rq_flag
+ complete = true;
+ }
+
++ preempt_disable();
+ task_rq_unlock(rq, p, rf);
+-
+ if (push_task) {
+ stop_one_cpu_nowait(rq->cpu, push_cpu_stop,
+ p, &rq->push_work);
+ }
++ preempt_enable();
+
+ if (complete)
+ complete_all(&pending->done);
+@@ -2817,12 +2820,13 @@ static int affine_move_task(struct rq *rq, struct task_struct *p, struct rq_flag
+ if (flags & SCA_MIGRATE_ENABLE)
+ p->migration_flags &= ~MDF_PUSH;
+
++ preempt_disable();
+ task_rq_unlock(rq, p, rf);
+-
+ if (!stop_pending) {
+ stop_one_cpu_nowait(cpu_of(rq), migration_cpu_stop,
+ &pending->arg, &pending->stop_work);
+ }
++ preempt_enable();
+
+ if (flags & SCA_MIGRATE_ENABLE)
+ return 0;
+@@ -9255,9 +9259,11 @@ static void balance_push(struct rq *rq)
+ * Temporarily drop rq->lock such that we can wake-up the stop task.
+ * Both preemption and IRQs are still disabled.
+ */
++ preempt_disable();
+ raw_spin_rq_unlock(rq);
+ stop_one_cpu_nowait(rq->cpu, __balance_push_cpu_stop, push_task,
+ this_cpu_ptr(&push_work));
++ preempt_enable();
+ /*
+ * At this point need_resched() is true and we'll take the loop in
+ * schedule(). The next pick is obviously going to be the stop task
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 9ce9810861ba5..389290e950bea 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2460,9 +2460,11 @@ static void pull_dl_task(struct rq *this_rq)
+ double_unlock_balance(this_rq, src_rq);
+
+ if (push_task) {
++ preempt_disable();
+ raw_spin_rq_unlock(this_rq);
+ stop_one_cpu_nowait(src_rq->cpu, push_cpu_stop,
+ push_task, &src_rq->push_work);
++ preempt_enable();
+ raw_spin_rq_lock(this_rq);
+ }
+ }
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index e7ae0ba3fd0bc..2558ab9033bee 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -10713,13 +10713,15 @@ static int load_balance(int this_cpu, struct rq *this_rq,
+ busiest->push_cpu = this_cpu;
+ active_balance = 1;
+ }
+- raw_spin_rq_unlock_irqrestore(busiest, flags);
+
++ preempt_disable();
++ raw_spin_rq_unlock_irqrestore(busiest, flags);
+ if (active_balance) {
+ stop_one_cpu_nowait(cpu_of(busiest),
+ active_load_balance_cpu_stop, busiest,
+ &busiest->active_balance_work);
+ }
++ preempt_enable();
+ }
+ } else {
+ sd->nr_balance_failed = 0;
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index 576eb2f51f043..76bafa8d331a7 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -2109,9 +2109,11 @@ static int push_rt_task(struct rq *rq, bool pull)
+ */
+ push_task = get_push_task(rq);
+ if (push_task) {
++ preempt_disable();
+ raw_spin_rq_unlock(rq);
+ stop_one_cpu_nowait(rq->cpu, push_cpu_stop,
+ push_task, &rq->push_work);
++ preempt_enable();
+ raw_spin_rq_lock(rq);
+ }
+
+@@ -2448,9 +2450,11 @@ static void pull_rt_task(struct rq *this_rq)
+ double_unlock_balance(this_rq, src_rq);
+
+ if (push_task) {
++ preempt_disable();
+ raw_spin_rq_unlock(this_rq);
+ stop_one_cpu_nowait(src_rq->cpu, push_cpu_stop,
+ push_task, &src_rq->push_work);
++ preempt_enable();
+ raw_spin_rq_lock(this_rq);
+ }
+ }
+--
+2.42.0
+
--- /dev/null
+From 809e24f087acc81e25bcbebb99efa5d8cf3d27d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Sep 2023 00:29:54 +0100
+Subject: sched/uclamp: Ignore (util == 0) optimization in feec() when
+ p_util_max = 0
+
+From: Qais Yousef <qyousef@layalina.io>
+
+[ Upstream commit 23c9519def98ee0fa97ea5871535e9b136f522fc ]
+
+find_energy_efficient_cpu() bails out early if effective util of the
+task is 0 as the delta at this point will be zero and there's nothing
+for EAS to do. When uclamp is being used, this could lead to wrong
+decisions when uclamp_max is set to 0. In this case the task is capped
+to performance point 0, but it is actually running and consuming energy
+and we can benefit from EAS energy calculations.
+
+Rework the condition so that it bails out when both util and uclamp_min
+are 0.
+
+We can do that without needing to use uclamp_task_util(); remove it.
+
+Fixes: d81304bc6193 ("sched/uclamp: Cater for uclamp in find_energy_efficient_cpu()'s early exit condition")
+Signed-off-by: Qais Yousef (Google) <qyousef@layalina.io>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230916232955.2099394-3-qyousef@layalina.io
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 18 +-----------------
+ 1 file changed, 1 insertion(+), 17 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 95ccb883efdda..e7ae0ba3fd0bc 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4279,22 +4279,6 @@ static inline unsigned long task_util_est(struct task_struct *p)
+ return max(task_util(p), _task_util_est(p));
+ }
+
+-#ifdef CONFIG_UCLAMP_TASK
+-static inline unsigned long uclamp_task_util(struct task_struct *p,
+- unsigned long uclamp_min,
+- unsigned long uclamp_max)
+-{
+- return clamp(task_util_est(p), uclamp_min, uclamp_max);
+-}
+-#else
+-static inline unsigned long uclamp_task_util(struct task_struct *p,
+- unsigned long uclamp_min,
+- unsigned long uclamp_max)
+-{
+- return task_util_est(p);
+-}
+-#endif
+-
+ static inline void util_est_enqueue(struct cfs_rq *cfs_rq,
+ struct task_struct *p)
+ {
+@@ -7279,7 +7263,7 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu)
+ target = prev_cpu;
+
+ sync_entity_load_avg(&p->se);
+- if (!uclamp_task_util(p, p_util_min, p_util_max))
++ if (!task_util_est(p) && p_util_min == 0)
+ goto unlock;
+
+ eenv_task_busy_time(&eenv, p, prev_cpu);
+--
+2.42.0
+
--- /dev/null
+From e99315b204a34e2d8aa9b8ab17df52aea8300258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Sep 2023 00:29:53 +0100
+Subject: sched/uclamp: Set max_spare_cap_cpu even if max_spare_cap is 0
+
+From: Qais Yousef <qyousef@layalina.io>
+
+[ Upstream commit 6b00a40147653c8ea748e8f4396510f252763364 ]
+
+When uclamp_max is being used, the util of the task could be higher than
+the spare capacity of the CPU, but due to uclamp_max value we force-fit
+it there.
+
+The way the condition for checking for max_spare_cap in
+find_energy_efficient_cpu() was constructed; it ignored any CPU that has
+its spare_cap less than or _equal_ to max_spare_cap. Since we initialize
+max_spare_cap to 0; this lead to never setting max_spare_cap_cpu and
+hence ending up never performing compute_energy() for this cluster and
+missing an opportunity for a better energy efficient placement to honour
+uclamp_max setting.
+
+ max_spare_cap = 0;
+ cpu_cap = capacity_of(cpu) - cpu_util(p); // 0 if cpu_util(p) is high
+
+ ...
+
+ util_fits_cpu(...); // will return true if uclamp_max forces it to fit
+
+ ...
+
+ // this logic will fail to update max_spare_cap_cpu if cpu_cap is 0
+ if (cpu_cap > max_spare_cap) {
+ max_spare_cap = cpu_cap;
+ max_spare_cap_cpu = cpu;
+ }
+
+prev_spare_cap suffers from a similar problem.
+
+Fix the logic by converting the variables into long and treating -1
+value as 'not populated' instead of 0 which is a viable and correct
+spare capacity value. We need to be careful signed comparison is used
+when comparing with cpu_cap in one of the conditions.
+
+Fixes: 1d42509e475c ("sched/fair: Make EAS wakeup placement consider uclamp restrictions")
+Signed-off-by: Qais Yousef (Google) <qyousef@layalina.io>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230916232955.2099394-2-qyousef@layalina.io
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 65cd5c153216c..95ccb883efdda 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7287,11 +7287,10 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu)
+ for (; pd; pd = pd->next) {
+ unsigned long util_min = p_util_min, util_max = p_util_max;
+ unsigned long cpu_cap, cpu_thermal_cap, util;
+- unsigned long cur_delta, max_spare_cap = 0;
++ long prev_spare_cap = -1, max_spare_cap = -1;
+ unsigned long rq_util_min, rq_util_max;
+- unsigned long prev_spare_cap = 0;
++ unsigned long cur_delta, base_energy;
+ int max_spare_cap_cpu = -1;
+- unsigned long base_energy;
+ int fits, max_fits = -1;
+
+ cpumask_and(cpus, perf_domain_span(pd), cpu_online_mask);
+@@ -7354,7 +7353,7 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu)
+ prev_spare_cap = cpu_cap;
+ prev_fits = fits;
+ } else if ((fits > max_fits) ||
+- ((fits == max_fits) && (cpu_cap > max_spare_cap))) {
++ ((fits == max_fits) && ((long)cpu_cap > max_spare_cap))) {
+ /*
+ * Find the CPU with the maximum spare capacity
+ * among the remaining CPUs in the performance
+@@ -7366,7 +7365,7 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu)
+ }
+ }
+
+- if (max_spare_cap_cpu < 0 && prev_spare_cap == 0)
++ if (max_spare_cap_cpu < 0 && prev_spare_cap < 0)
+ continue;
+
+ eenv_pd_busy_time(&eenv, cpus, p);
+@@ -7374,7 +7373,7 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu)
+ base_energy = compute_energy(&eenv, pd, cpus, p, -1);
+
+ /* Evaluate the energy impact of using prev_cpu. */
+- if (prev_spare_cap > 0) {
++ if (prev_spare_cap > -1) {
+ prev_delta = compute_energy(&eenv, pd, cpus, p,
+ prev_cpu);
+ /* CPU utilization has changed */
+--
+2.42.0
+
--- /dev/null
+From 4ac9f0276cadf8613cb924ed07404d0228a1f663 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 17:54:28 -0500
+Subject: scsi: ibmvfc: Fix erroneous use of rtas_busy_delay with hcall return
+ code
+
+From: Tyrel Datwyler <tyreld@linux.ibm.com>
+
+[ Upstream commit 670106eb4c8b23475f8c2b3416005a312afa622f ]
+
+Commit 0217a272fe13 ("scsi: ibmvfc: Store return code of H_FREE_SUB_CRQ
+during cleanup") wrongly changed the busy loop check to use
+rtas_busy_delay() instead of H_BUSY and H_IS_LONG_BUSY(). The busy return
+codes for RTAS and hypercalls are not the same.
+
+Fix this issue by restoring the use of H_BUSY and H_IS_LONG_BUSY().
+
+Fixes: 0217a272fe13 ("scsi: ibmvfc: Store return code of H_FREE_SUB_CRQ during cleanup")
+Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+Link: https://lore.kernel.org/r/20230921225435.3537728-5-tyreld@linux.ibm.com
+Reviewed-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ibmvscsi/ibmvfc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
+index 1a0c0b7289d26..41148b0430df9 100644
+--- a/drivers/scsi/ibmvscsi/ibmvfc.c
++++ b/drivers/scsi/ibmvscsi/ibmvfc.c
+@@ -22,7 +22,6 @@
+ #include <linux/bsg-lib.h>
+ #include <asm/firmware.h>
+ #include <asm/irq.h>
+-#include <asm/rtas.h>
+ #include <asm/vio.h>
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_cmnd.h>
+@@ -5804,7 +5803,7 @@ static int ibmvfc_register_scsi_channel(struct ibmvfc_host *vhost,
+ irq_failed:
+ do {
+ rc = plpar_hcall_norets(H_FREE_SUB_CRQ, vdev->unit_address, scrq->cookie);
+- } while (rtas_busy_delay(rc));
++ } while (rc == H_BUSY || H_IS_LONG_BUSY(rc));
+ reg_failed:
+ LEAVE;
+ return rc;
+--
+2.42.0
+
--- /dev/null
+From 32ef4cabf752d567ff9d4bb74f9bc2a25a165151 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 11:20:26 -0700
+Subject: scsi: ufs: core: Leave space for '\0' in utf8 desc string
+
+From: Daniel Mentz <danielmentz@google.com>
+
+[ Upstream commit a75a16c62a2540f11eeae4f2b50e95deefb652ea ]
+
+utf16s_to_utf8s does not NULL terminate the output string. For us to be
+able to add a NULL character when utf16s_to_utf8s returns, we need to make
+sure that there is space for such NULL character at the end of the output
+buffer. We can achieve this by passing an output buffer size to
+utf16s_to_utf8s that is one character less than what we allocated.
+
+Other call sites of utf16s_to_utf8s appear to be using the same technique
+where they artificially reduce the buffer size by one to leave space for a
+NULL character or line feed character.
+
+Fixes: 4b828fe156a6 ("scsi: ufs: revamp string descriptor reading")
+Reviewed-by: Mars Cheng <marscheng@google.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Yen-lin Lai <yenlinlai@google.com>
+Signed-off-by: Daniel Mentz <danielmentz@google.com>
+Link: https://lore.kernel.org/r/20231017182026.2141163-1-danielmentz@google.com
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 6ba4ef2c3949e..dc38d1fa77874 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -3579,7 +3579,7 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8 desc_index,
+ */
+ ret = utf16s_to_utf8s(uc_str->uc,
+ uc_str->len - QUERY_DESC_HDR_SIZE,
+- UTF16_BIG_ENDIAN, str, ascii_len);
++ UTF16_BIG_ENDIAN, str, ascii_len - 1);
+
+ /* replace non-printable or non-ASCII characters with spaces */
+ for (i = 0; i < ret; i++)
+--
+2.42.0
+
--- /dev/null
+From 9571ccb30b0da1beb202cb7582ef1c739a542e6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 23:42:56 +0800
+Subject: selftests/bpf: Correct map_fd to data_fd in tailcalls
+
+From: Leon Hwang <hffilwlqm@gmail.com>
+
+[ Upstream commit 96daa9874211d5497aa70fa409b67afc29f0cb86 ]
+
+Get and check data_fd. It should not check map_fd again.
+
+Meanwhile, correct some 'return' to 'goto out'.
+
+Thank the suggestion from Maciej in "bpf, x64: Fix tailcall infinite
+loop"[0] discussions.
+
+[0] https://lore.kernel.org/bpf/e496aef8-1f80-0f8e-dcdd-25a8c300319a@gmail.com/T/#m7d3b601066ba66400d436b7e7579b2df4a101033
+
+Fixes: 79d49ba048ec ("bpf, testing: Add various tail call test cases")
+Fixes: 3b0379111197 ("selftests/bpf: Add tailcall_bpf2bpf tests")
+Fixes: 5e0b0a4c52d3 ("selftests/bpf: Test tail call counting with bpf2bpf and data on stack")
+Signed-off-by: Leon Hwang <hffilwlqm@gmail.com>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://lore.kernel.org/r/20230906154256.95461-1-hffilwlqm@gmail.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/prog_tests/tailcalls.c | 32 +++++++++----------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/tailcalls.c b/tools/testing/selftests/bpf/prog_tests/tailcalls.c
+index 58fe2c586ed76..09c189761926c 100644
+--- a/tools/testing/selftests/bpf/prog_tests/tailcalls.c
++++ b/tools/testing/selftests/bpf/prog_tests/tailcalls.c
+@@ -271,11 +271,11 @@ static void test_tailcall_count(const char *which)
+
+ data_map = bpf_object__find_map_by_name(obj, "tailcall.bss");
+ if (CHECK_FAIL(!data_map || !bpf_map__is_internal(data_map)))
+- return;
++ goto out;
+
+ data_fd = bpf_map__fd(data_map);
+- if (CHECK_FAIL(map_fd < 0))
+- return;
++ if (CHECK_FAIL(data_fd < 0))
++ goto out;
+
+ i = 0;
+ err = bpf_map_lookup_elem(data_fd, &i, &val);
+@@ -352,11 +352,11 @@ static void test_tailcall_4(void)
+
+ data_map = bpf_object__find_map_by_name(obj, "tailcall.bss");
+ if (CHECK_FAIL(!data_map || !bpf_map__is_internal(data_map)))
+- return;
++ goto out;
+
+ data_fd = bpf_map__fd(data_map);
+- if (CHECK_FAIL(map_fd < 0))
+- return;
++ if (CHECK_FAIL(data_fd < 0))
++ goto out;
+
+ for (i = 0; i < bpf_map__max_entries(prog_array); i++) {
+ snprintf(prog_name, sizeof(prog_name), "classifier_%d", i);
+@@ -442,11 +442,11 @@ static void test_tailcall_5(void)
+
+ data_map = bpf_object__find_map_by_name(obj, "tailcall.bss");
+ if (CHECK_FAIL(!data_map || !bpf_map__is_internal(data_map)))
+- return;
++ goto out;
+
+ data_fd = bpf_map__fd(data_map);
+- if (CHECK_FAIL(map_fd < 0))
+- return;
++ if (CHECK_FAIL(data_fd < 0))
++ goto out;
+
+ for (i = 0; i < bpf_map__max_entries(prog_array); i++) {
+ snprintf(prog_name, sizeof(prog_name), "classifier_%d", i);
+@@ -631,11 +631,11 @@ static void test_tailcall_bpf2bpf_2(void)
+
+ data_map = bpf_object__find_map_by_name(obj, "tailcall.bss");
+ if (CHECK_FAIL(!data_map || !bpf_map__is_internal(data_map)))
+- return;
++ goto out;
+
+ data_fd = bpf_map__fd(data_map);
+- if (CHECK_FAIL(map_fd < 0))
+- return;
++ if (CHECK_FAIL(data_fd < 0))
++ goto out;
+
+ i = 0;
+ err = bpf_map_lookup_elem(data_fd, &i, &val);
+@@ -805,11 +805,11 @@ static void test_tailcall_bpf2bpf_4(bool noise)
+
+ data_map = bpf_object__find_map_by_name(obj, "tailcall.bss");
+ if (CHECK_FAIL(!data_map || !bpf_map__is_internal(data_map)))
+- return;
++ goto out;
+
+ data_fd = bpf_map__fd(data_map);
+- if (CHECK_FAIL(map_fd < 0))
+- return;
++ if (CHECK_FAIL(data_fd < 0))
++ goto out;
+
+ i = 0;
+ val.noise = noise;
+@@ -872,7 +872,7 @@ static void test_tailcall_bpf2bpf_6(void)
+ ASSERT_EQ(topts.retval, 0, "tailcall retval");
+
+ data_fd = bpf_map__fd(obj->maps.bss);
+- if (!ASSERT_GE(map_fd, 0, "bss map fd"))
++ if (!ASSERT_GE(data_fd, 0, "bss map fd"))
+ goto out;
+
+ i = 0;
+--
+2.42.0
+
--- /dev/null
+From 40d7f6b79dc556f1521e2f1e2c6973a4415185a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 13:17:54 -0400
+Subject: selftests: netfilter: test for sctp collision processing in
+ nf_conntrack
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit cf791b22bef7d9352ff730a8727d3871942d6001 ]
+
+This patch adds a test case to reproduce the SCTP DATA chunk retransmission
+timeout issue caused by the improper SCTP collision processing in netfilter
+nf_conntrack_proto_sctp.
+
+In this test, client sends a INIT chunk, but the INIT_ACK replied from
+server is delayed until the server sends a INIT chunk to start a new
+connection from its side. After the connection is complete from server
+side, the delayed INIT_ACK arrives in nf_conntrack_proto_sctp.
+
+The delayed INIT_ACK should be dropped in nf_conntrack_proto_sctp instead
+of updating the vtag with the out-of-date init_tag, otherwise, the vtag
+in DATA chunks later sent by client don't match the vtag in the conntrack
+entry and the DATA chunks get dropped.
+
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Stable-dep-of: c4eee56e14fe ("net: skb_find_text: Ignore patterns extending past 'to'")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/netfilter/Makefile | 5 +-
+ .../netfilter/conntrack_sctp_collision.sh | 89 +++++++++++++++++
+ .../selftests/netfilter/sctp_collision.c | 99 +++++++++++++++++++
+ 3 files changed, 191 insertions(+), 2 deletions(-)
+ create mode 100755 tools/testing/selftests/netfilter/conntrack_sctp_collision.sh
+ create mode 100644 tools/testing/selftests/netfilter/sctp_collision.c
+
+diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
+index 321db8850da00..ef90aca4cc96a 100644
+--- a/tools/testing/selftests/netfilter/Makefile
++++ b/tools/testing/selftests/netfilter/Makefile
+@@ -6,13 +6,14 @@ TEST_PROGS := nft_trans_stress.sh nft_fib.sh nft_nat.sh bridge_brouter.sh \
+ nft_concat_range.sh nft_conntrack_helper.sh \
+ nft_queue.sh nft_meta.sh nf_nat_edemux.sh \
+ ipip-conntrack-mtu.sh conntrack_tcp_unreplied.sh \
+- conntrack_vrf.sh nft_synproxy.sh rpath.sh nft_audit.sh
++ conntrack_vrf.sh nft_synproxy.sh rpath.sh nft_audit.sh \
++ conntrack_sctp_collision.sh
+
+ HOSTPKG_CONFIG := pkg-config
+
+ CFLAGS += $(shell $(HOSTPKG_CONFIG) --cflags libmnl 2>/dev/null)
+ LDLIBS += $(shell $(HOSTPKG_CONFIG) --libs libmnl 2>/dev/null || echo -lmnl)
+
+-TEST_GEN_FILES = nf-queue connect_close audit_logread
++TEST_GEN_FILES = nf-queue connect_close audit_logread sctp_collision
+
+ include ../lib.mk
+diff --git a/tools/testing/selftests/netfilter/conntrack_sctp_collision.sh b/tools/testing/selftests/netfilter/conntrack_sctp_collision.sh
+new file mode 100755
+index 0000000000000..a924e595cfd8b
+--- /dev/null
++++ b/tools/testing/selftests/netfilter/conntrack_sctp_collision.sh
+@@ -0,0 +1,89 @@
++#!/bin/bash
++# SPDX-License-Identifier: GPL-2.0
++#
++# Testing For SCTP COLLISION SCENARIO as Below:
++#
++# 14:35:47.655279 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT] [init tag: 2017837359]
++# 14:35:48.353250 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT] [init tag: 1187206187]
++# 14:35:48.353275 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT ACK] [init tag: 2017837359]
++# 14:35:48.353283 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [COOKIE ECHO]
++# 14:35:48.353977 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [COOKIE ACK]
++# 14:35:48.855335 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT ACK] [init tag: 164579970]
++#
++# TOPO: SERVER_NS (link0)<--->(link1) ROUTER_NS (link2)<--->(link3) CLIENT_NS
++
++CLIENT_NS=$(mktemp -u client-XXXXXXXX)
++CLIENT_IP="198.51.200.1"
++CLIENT_PORT=1234
++
++SERVER_NS=$(mktemp -u server-XXXXXXXX)
++SERVER_IP="198.51.100.1"
++SERVER_PORT=1234
++
++ROUTER_NS=$(mktemp -u router-XXXXXXXX)
++CLIENT_GW="198.51.200.2"
++SERVER_GW="198.51.100.2"
++
++# setup the topo
++setup() {
++ ip net add $CLIENT_NS
++ ip net add $SERVER_NS
++ ip net add $ROUTER_NS
++ ip -n $SERVER_NS link add link0 type veth peer name link1 netns $ROUTER_NS
++ ip -n $CLIENT_NS link add link3 type veth peer name link2 netns $ROUTER_NS
++
++ ip -n $SERVER_NS link set link0 up
++ ip -n $SERVER_NS addr add $SERVER_IP/24 dev link0
++ ip -n $SERVER_NS route add $CLIENT_IP dev link0 via $SERVER_GW
++
++ ip -n $ROUTER_NS link set link1 up
++ ip -n $ROUTER_NS link set link2 up
++ ip -n $ROUTER_NS addr add $SERVER_GW/24 dev link1
++ ip -n $ROUTER_NS addr add $CLIENT_GW/24 dev link2
++ ip net exec $ROUTER_NS sysctl -wq net.ipv4.ip_forward=1
++
++ ip -n $CLIENT_NS link set link3 up
++ ip -n $CLIENT_NS addr add $CLIENT_IP/24 dev link3
++ ip -n $CLIENT_NS route add $SERVER_IP dev link3 via $CLIENT_GW
++
++ # simulate the delay on OVS upcall by setting up a delay for INIT_ACK with
++ # tc on $SERVER_NS side
++ tc -n $SERVER_NS qdisc add dev link0 root handle 1: htb
++ tc -n $SERVER_NS class add dev link0 parent 1: classid 1:1 htb rate 100mbit
++ tc -n $SERVER_NS filter add dev link0 parent 1: protocol ip u32 match ip protocol 132 \
++ 0xff match u8 2 0xff at 32 flowid 1:1
++ tc -n $SERVER_NS qdisc add dev link0 parent 1:1 handle 10: netem delay 1200ms
++
++ # simulate the ctstate check on OVS nf_conntrack
++ ip net exec $ROUTER_NS iptables -A FORWARD -m state --state INVALID,UNTRACKED -j DROP
++ ip net exec $ROUTER_NS iptables -A INPUT -p sctp -j DROP
++
++ # use a smaller number for assoc's max_retrans to reproduce the issue
++ modprobe sctp
++ ip net exec $CLIENT_NS sysctl -wq net.sctp.association_max_retrans=3
++}
++
++cleanup() {
++ ip net exec $CLIENT_NS pkill sctp_collision 2>&1 >/dev/null
++ ip net exec $SERVER_NS pkill sctp_collision 2>&1 >/dev/null
++ ip net del "$CLIENT_NS"
++ ip net del "$SERVER_NS"
++ ip net del "$ROUTER_NS"
++}
++
++do_test() {
++ ip net exec $SERVER_NS ./sctp_collision server \
++ $SERVER_IP $SERVER_PORT $CLIENT_IP $CLIENT_PORT &
++ ip net exec $CLIENT_NS ./sctp_collision client \
++ $CLIENT_IP $CLIENT_PORT $SERVER_IP $SERVER_PORT
++}
++
++# NOTE: one way to work around the issue is set a smaller hb_interval
++# ip net exec $CLIENT_NS sysctl -wq net.sctp.hb_interval=3500
++
++# run the test case
++trap cleanup EXIT
++setup && \
++echo "Test for SCTP Collision in nf_conntrack:" && \
++do_test && echo "PASS!"
++exit $?
+diff --git a/tools/testing/selftests/netfilter/sctp_collision.c b/tools/testing/selftests/netfilter/sctp_collision.c
+new file mode 100644
+index 0000000000000..21bb1cfd8a856
+--- /dev/null
++++ b/tools/testing/selftests/netfilter/sctp_collision.c
+@@ -0,0 +1,99 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <unistd.h>
++#include <arpa/inet.h>
++
++int main(int argc, char *argv[])
++{
++ struct sockaddr_in saddr = {}, daddr = {};
++ int sd, ret, len = sizeof(daddr);
++ struct timeval tv = {25, 0};
++ char buf[] = "hello";
++
++ if (argc != 6 || (strcmp(argv[1], "server") && strcmp(argv[1], "client"))) {
++ printf("%s <server|client> <LOCAL_IP> <LOCAL_PORT> <REMOTE_IP> <REMOTE_PORT>\n",
++ argv[0]);
++ return -1;
++ }
++
++ sd = socket(AF_INET, SOCK_SEQPACKET, IPPROTO_SCTP);
++ if (sd < 0) {
++ printf("Failed to create sd\n");
++ return -1;
++ }
++
++ saddr.sin_family = AF_INET;
++ saddr.sin_addr.s_addr = inet_addr(argv[2]);
++ saddr.sin_port = htons(atoi(argv[3]));
++
++ ret = bind(sd, (struct sockaddr *)&saddr, sizeof(saddr));
++ if (ret < 0) {
++ printf("Failed to bind to address\n");
++ goto out;
++ }
++
++ ret = listen(sd, 5);
++ if (ret < 0) {
++ printf("Failed to listen on port\n");
++ goto out;
++ }
++
++ daddr.sin_family = AF_INET;
++ daddr.sin_addr.s_addr = inet_addr(argv[4]);
++ daddr.sin_port = htons(atoi(argv[5]));
++
++ /* make test shorter than 25s */
++ ret = setsockopt(sd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
++ if (ret < 0) {
++ printf("Failed to setsockopt SO_RCVTIMEO\n");
++ goto out;
++ }
++
++ if (!strcmp(argv[1], "server")) {
++ sleep(1); /* wait a bit for client's INIT */
++ ret = connect(sd, (struct sockaddr *)&daddr, len);
++ if (ret < 0) {
++ printf("Failed to connect to peer\n");
++ goto out;
++ }
++ ret = recvfrom(sd, buf, sizeof(buf), 0, (struct sockaddr *)&daddr, &len);
++ if (ret < 0) {
++ printf("Failed to recv msg %d\n", ret);
++ goto out;
++ }
++ ret = sendto(sd, buf, strlen(buf) + 1, 0, (struct sockaddr *)&daddr, len);
++ if (ret < 0) {
++ printf("Failed to send msg %d\n", ret);
++ goto out;
++ }
++ printf("Server: sent! %d\n", ret);
++ }
++
++ if (!strcmp(argv[1], "client")) {
++ usleep(300000); /* wait a bit for server's listening */
++ ret = connect(sd, (struct sockaddr *)&daddr, len);
++ if (ret < 0) {
++ printf("Failed to connect to peer\n");
++ goto out;
++ }
++ sleep(1); /* wait a bit for server's delayed INIT_ACK to reproduce the issue */
++ ret = sendto(sd, buf, strlen(buf) + 1, 0, (struct sockaddr *)&daddr, len);
++ if (ret < 0) {
++ printf("Failed to send msg %d\n", ret);
++ goto out;
++ }
++ ret = recvfrom(sd, buf, sizeof(buf), 0, (struct sockaddr *)&daddr, &len);
++ if (ret < 0) {
++ printf("Failed to recv msg %d\n", ret);
++ goto out;
++ }
++ printf("Client: rcvd! %d\n", ret);
++ }
++ ret = 0;
++out:
++ close(sd);
++ return ret;
++}
+--
+2.42.0
+
--- /dev/null
+From 764500d6bd58f2412850c9e68475585fb8a12022 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 13:36:28 +0200
+Subject: selftests/pidfd: Fix ksft print formats
+
+From: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
+
+[ Upstream commit 4d7f4e8158b62f63031510cdc24acc520956c091 ]
+
+Compiling pidfd selftest after adding a __printf() attribute to
+ksft_print_msg() and ksft_test_result_pass() exposes -Wformat warnings
+in error_report(), test_pidfd_poll_exec_thread(),
+child_poll_exec_test(), test_pidfd_poll_leader_exit_thread(),
+child_poll_leader_exit_test().
+
+The ksft_test_result_pass() in error_report() expects a string but
+doesn't provide any argument after the format string. All the other
+calls to ksft_print_msg() in the functions mentioned above have format
+strings that don't match with other passed arguments.
+
+Fix format specifiers so they match the passed variables.
+
+Add a missing variable to ksft_test_result_pass() inside
+error_report() so it matches other cases in the switch statement.
+
+Fixes: 2def297ec7fb ("pidfd: add tests for NSpid info in fdinfo")
+
+Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/pidfd/pidfd_fdinfo_test.c | 2 +-
+ tools/testing/selftests/pidfd/pidfd_test.c | 12 ++++++------
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/pidfd/pidfd_fdinfo_test.c b/tools/testing/selftests/pidfd/pidfd_fdinfo_test.c
+index 3fd8e903118f5..3bc46d6151f44 100644
+--- a/tools/testing/selftests/pidfd/pidfd_fdinfo_test.c
++++ b/tools/testing/selftests/pidfd/pidfd_fdinfo_test.c
+@@ -62,7 +62,7 @@ static void error_report(struct error *err, const char *test_name)
+ break;
+
+ case PIDFD_PASS:
+- ksft_test_result_pass("%s test: Passed\n");
++ ksft_test_result_pass("%s test: Passed\n", test_name);
+ break;
+
+ default:
+diff --git a/tools/testing/selftests/pidfd/pidfd_test.c b/tools/testing/selftests/pidfd/pidfd_test.c
+index e2dd4ed849846..cf4f3174c83e0 100644
+--- a/tools/testing/selftests/pidfd/pidfd_test.c
++++ b/tools/testing/selftests/pidfd/pidfd_test.c
+@@ -380,13 +380,13 @@ static int test_pidfd_send_signal_syscall_support(void)
+
+ static void *test_pidfd_poll_exec_thread(void *priv)
+ {
+- ksft_print_msg("Child Thread: starting. pid %d tid %d ; and sleeping\n",
++ ksft_print_msg("Child Thread: starting. pid %d tid %ld ; and sleeping\n",
+ getpid(), syscall(SYS_gettid));
+ ksft_print_msg("Child Thread: doing exec of sleep\n");
+
+ execl("/bin/sleep", "sleep", str(CHILD_THREAD_MIN_WAIT), (char *)NULL);
+
+- ksft_print_msg("Child Thread: DONE. pid %d tid %d\n",
++ ksft_print_msg("Child Thread: DONE. pid %d tid %ld\n",
+ getpid(), syscall(SYS_gettid));
+ return NULL;
+ }
+@@ -426,7 +426,7 @@ static int child_poll_exec_test(void *args)
+ {
+ pthread_t t1;
+
+- ksft_print_msg("Child (pidfd): starting. pid %d tid %d\n", getpid(),
++ ksft_print_msg("Child (pidfd): starting. pid %d tid %ld\n", getpid(),
+ syscall(SYS_gettid));
+ pthread_create(&t1, NULL, test_pidfd_poll_exec_thread, NULL);
+ /*
+@@ -479,10 +479,10 @@ static void test_pidfd_poll_exec(int use_waitpid)
+
+ static void *test_pidfd_poll_leader_exit_thread(void *priv)
+ {
+- ksft_print_msg("Child Thread: starting. pid %d tid %d ; and sleeping\n",
++ ksft_print_msg("Child Thread: starting. pid %d tid %ld ; and sleeping\n",
+ getpid(), syscall(SYS_gettid));
+ sleep(CHILD_THREAD_MIN_WAIT);
+- ksft_print_msg("Child Thread: DONE. pid %d tid %d\n", getpid(), syscall(SYS_gettid));
++ ksft_print_msg("Child Thread: DONE. pid %d tid %ld\n", getpid(), syscall(SYS_gettid));
+ return NULL;
+ }
+
+@@ -491,7 +491,7 @@ static int child_poll_leader_exit_test(void *args)
+ {
+ pthread_t t1, t2;
+
+- ksft_print_msg("Child: starting. pid %d tid %d\n", getpid(), syscall(SYS_gettid));
++ ksft_print_msg("Child: starting. pid %d tid %ld\n", getpid(), syscall(SYS_gettid));
+ pthread_create(&t1, NULL, test_pidfd_poll_leader_exit_thread, NULL);
+ pthread_create(&t2, NULL, test_pidfd_poll_leader_exit_thread, NULL);
+
+--
+2.42.0
+
--- /dev/null
+From a79f6af71cbdb71951e3fce8d6be8a61a8c30d95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Sep 2023 12:53:32 +0300
+Subject: selftests/resctrl: Ensure the benchmark commands fits to its array
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 4a28c7665c2a1ac0400864eabb0c641e135f61aa ]
+
+Benchmark command is copied into an array in the stack. The array is
+BENCHMARK_ARGS items long but the command line could try to provide a
+longer command. Argument size is also fixed by BENCHMARK_ARG_SIZE (63
+bytes of space after fitting the terminating \0 character) and user
+could have inputted argument longer than that.
+
+Return error in case the benchmark command does not fit to the space
+allocated for it.
+
+Fixes: ecdbb911f22d ("selftests/resctrl: Add MBM test")
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Tested-by: Shaopeng Tan <tan.shaopeng@jp.fujitsu.com>
+Reviewed-by: Shaopeng Tan <tan.shaopeng@jp.fujitsu.com>
+Reviewed-by: "Wieczor-Retman, Maciej" <maciej.wieczor-retman@intel.com>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/resctrl_tests.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/tools/testing/selftests/resctrl/resctrl_tests.c b/tools/testing/selftests/resctrl/resctrl_tests.c
+index df0d8d8526fc6..4418155a879b9 100644
+--- a/tools/testing/selftests/resctrl/resctrl_tests.c
++++ b/tools/testing/selftests/resctrl/resctrl_tests.c
+@@ -228,9 +228,14 @@ int main(int argc, char **argv)
+ return ksft_exit_skip("Not running as root. Skipping...\n");
+
+ if (has_ben) {
++ if (argc - ben_ind >= BENCHMARK_ARGS)
++ ksft_exit_fail_msg("Too long benchmark command.\n");
++
+ /* Extract benchmark command from command line. */
+ for (i = ben_ind; i < argc; i++) {
+ benchmark_cmd[i - ben_ind] = benchmark_cmd_area[i];
++ if (strlen(argv[i]) >= BENCHMARK_ARG_SIZE)
++ ksft_exit_fail_msg("Too long benchmark command argument.\n");
+ sprintf(benchmark_cmd[i - ben_ind], "%s", argv[i]);
+ }
+ benchmark_cmd[ben_count] = NULL;
+--
+2.42.0
+
hwmon-nct6775-fix-incorrect-variable-reuse-in-fan_div-calculation.patch
+sched-fair-fix-cfs_rq_is_decayed-on-smp.patch
+iov_iter-x86-be-consistent-about-the-__user-tag-on-c.patch
+sched-uclamp-set-max_spare_cap_cpu-even-if-max_spare.patch
+sched-uclamp-ignore-util-0-optimization-in-feec-when.patch
+objtool-propagate-early-errors.patch
+sched-fix-stop_one_cpu_nowait-vs-hotplug.patch
+vfs-fix-readahead-2-on-block-devices.patch
+writeback-cgroup-switch-inodes-with-dirty-timestamps.patch
+x86-srso-fix-sbpb-enablement-for-possible-future-fix.patch
+futex-don-t-include-process-mm-in-futex-key-on-no-mm.patch
+x86-numa-introduce-numa_fill_memblks.patch
+acpi-numa-apply-srat-proximity-domain-to-entire-cfmw.patch
+x86-sev-es-allow-copy_from_kernel_nofault-in-earlier.patch
+x86-boot-fix-incorrect-startup_gdt_descr.size.patch
+drivers-clocksource-timer-ti-dm-don-t-call-clk_get_r.patch
+pstore-platform-add-check-for-kstrdup.patch
+string-adjust-strtomem-logic-to-allow-for-smaller-so.patch
+genirq-matrix-exclude-managed-interrupts-in-irq_matr.patch
+wifi-cfg80211-add-flush-functions-for-wiphy-work.patch
+wifi-mac80211-move-radar-detect-work-to-wiphy-work.patch
+wifi-mac80211-move-scan-work-to-wiphy-work.patch
+wifi-mac80211-move-offchannel-works-to-wiphy-work.patch
+wifi-mac80211-move-sched-scan-stop-work-to-wiphy-wor.patch
+wifi-mac80211-fix-of-msdu-in-a-msdu-calculation.patch
+wifi-iwlwifi-honor-the-enable_ini-value.patch
+i40e-fix-potential-memory-leaks-in-i40e_remove.patch
+iavf-fix-promiscuous-mode-configuration-flow-message.patch
+selftests-bpf-correct-map_fd-to-data_fd-in-tailcalls.patch
+wifi-iwlwifi-use-fw-rate-for-non-data-frames.patch
+udp-add-missing-write_once-around-up-encap_rcv.patch
+tcp-call-tcp_try_undo_recovery-when-an-rtod-tfo-syna.patch
+gve-use-size_add-in-call-to-struct_size.patch
+mlxsw-use-size_mul-in-call-to-struct_size.patch
+tls-only-use-data-field-in-crypto-completion-functio.patch
+tls-use-size_add-in-call-to-struct_size.patch
+tipc-use-size_add-in-calls-to-struct_size.patch
+net-spider_net-use-size_add-in-call-to-struct_size.patch
+net-ethernet-mtk_wed-fix-ext_int_status_rx_fbuf-defi.patch
+wifi-rtw88-debug-fix-the-null-vs-is_err-bug-for-debu.patch
+wifi-ath11k-fix-boot-failure-with-one-msi-vector.patch
+wifi-mt76-mt7603-rework-fix-rx-pse-hang-check.patch
+wifi-mt76-mt7603-improve-watchdog-reset-reliablity.patch
+wifi-mt76-mt7603-improve-stuck-beacon-handling.patch
+wifi-mt76-mt7915-fix-beamforming-availability-check.patch
+wifi-ath-dfs_pattern_detector-fix-a-memory-initializ.patch
+tcp_metrics-add-missing-barriers-on-delete.patch
+tcp_metrics-properly-set-tp-snd_ssthresh-in-tcp_init.patch
+tcp_metrics-do-not-create-an-entry-from-tcp_init_met.patch
+wifi-rtlwifi-fix-edca-limit-set-by-bt-coexistence.patch
+acpi-property-allow-_dsd-buffer-data-only-for-byte-a.patch
+acpi-video-add-acpi_backlight-vendor-quirk-for-toshi.patch
+wifi-ath11k-fix-tx-power-value-during-active-cac.patch
+can-dev-can_restart-don-t-crash-kernel-if-carrier-is.patch
+can-dev-can_restart-fix-race-condition-between-contr.patch
+can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
+pm-devfreq-rockchip-dfi-make-pmu-regmap-mandatory.patch
+wifi-wfx-fix-case-where-rates-are-out-of-order.patch
+netfilter-nf_tables-drop-pointless-memset-when-dumpi.patch
+thermal-core-prevent-potential-string-overflow.patch
+r8169-use-tp_to_dev-instead-of-open-code.patch
+r8169-fix-rare-issue-with-broken-rx-after-link-down-.patch
+selftests-netfilter-test-for-sctp-collision-processi.patch
+net-skb_find_text-ignore-patterns-extending-past-to.patch
+chtls-fix-tp-rcv_tstamp-initialization.patch
+tcp-fix-cookie_init_timestamp-overflows.patch
+wifi-iwlwifi-call-napi_synchronize-before-freeing-rx.patch
+wifi-iwlwifi-pcie-synchronize-irqs-before-napi.patch
+wifi-iwlwifi-empty-overflow-queue-during-flush.patch
+bluetooth-hci_sync-fix-opcode-prints-in-bt_dev_dbg-e.patch
+bpf-fix-unnecessary-ebusy-from-htab_lock_bucket.patch
+acpi-sysfs-fix-create_pnp_modalias-and-create_of_mod.patch
+ipv6-avoid-atomic-fragment-on-gso-packets.patch
+net-add-dev_stats_read-helper.patch
+ipvlan-properly-track-tx_errors.patch
+regmap-debugfs-fix-a-erroneous-check-after-snprintf.patch
+spi-tegra-fix-missing-irq-check-in-tegra_slink_probe.patch
+clk-qcom-gcc-msm8996-remove-rpm-bus-clocks.patch
+clk-qcom-clk-rcg2-fix-clock-rate-overflow-for-high-p.patch
+clk-qcom-mmcc-msm8998-don-t-check-halt-bit-on-some-b.patch
+clk-qcom-mmcc-msm8998-fix-the-smmu-gdsc.patch
+clk-qcom-gcc-sm8150-fix-gcc_sdcc2_apps_clk_src.patch
+regulator-mt6358-fail-probe-on-unknown-chip-id.patch
+clk-imx-select-mxc_clk-for-clk_imx8qxp.patch
+clk-imx-imx8mq-correct-error-handling-path.patch
+clk-imx-imx8qxp-fix-elcdif_pll-clock.patch
+clk-renesas-rcar-gen3-extend-sdnh-divider-table.patch
+clk-renesas-rzg2l-wait-for-status-bit-of-sd-mux-befo.patch
+clk-renesas-rzg2l-lock-around-writes-to-mux-register.patch
+clk-renesas-rzg2l-trust-value-returned-by-hardware.patch
+clk-renesas-rzg2l-use-field_get-for-pll-register-fie.patch
+clk-renesas-rzg2l-fix-computation-formula.patch
+clk-linux-clk-provider.h-fix-kernel-doc-warnings-and.patch
+spi-nxp-fspi-use-the-correct-ioremap-function.patch
+clk-keystone-pll-fix-a-couple-null-vs-is_err-checks.patch
+clk-ti-change-ti_clk_register-_omap_hw-api.patch
+clk-ti-fix-double-free-in-of_ti_divider_clk_setup.patch
+clk-npcm7xx-fix-incorrect-kfree.patch
+clk-mediatek-clk-mt6765-add-check-for-mtk_alloc_clk_.patch
+clk-mediatek-clk-mt6779-add-check-for-mtk_alloc_clk_.patch
+clk-mediatek-clk-mt6797-add-check-for-mtk_alloc_clk_.patch
+clk-mediatek-clk-mt7629-eth-add-check-for-mtk_alloc_.patch
+clk-mediatek-clk-mt7629-add-check-for-mtk_alloc_clk_.patch
+clk-mediatek-clk-mt2701-add-check-for-mtk_alloc_clk_.patch
+clk-qcom-config-ipq_apss_6018-should-depend-on-qcom_.patch
+platform-x86-wmi-fix-probe-failure-when-failing-to-r.patch
+platform-x86-wmi-fix-opening-of-char-device.patch
+hwmon-axi-fan-control-fix-possible-null-pointer-dere.patch
+hwmon-coretemp-fix-potentially-truncated-sysfs-attri.patch
+revert-hwmon-sch56xx-common-add-dmi-override-table.patch
+revert-hwmon-sch56xx-common-add-automatic-module-loa.patch
+hwmon-sch5627-use-bit-macros-when-accessing-the-cont.patch
+hwmon-sch5627-disallow-write-access-if-virtual-regis.patch
+hte-tegra-fix-missing-error-code-in-tegra_hte_test_p.patch
+drm-rockchip-vop-fix-reset-of-state-in-duplicate-sta.patch
+drm-rockchip-vop-fix-call-to-crtc-reset-helper.patch
+drm-rockchip-vop2-don-t-crash-for-invalid-duplicate_.patch
+drm-rockchip-vop2-add-missing-call-to-crtc-reset-hel.patch
+drm-radeon-possible-buffer-overflow.patch
+drm-bridge-it66121-fix-invalid-connector-dereference.patch
+drm-bridge-lt8912b-add-hot-plug-detection.patch
+drm-bridge-lt8912b-fix-bridge_detach.patch
+drm-bridge-lt8912b-fix-crash-on-bridge-detach.patch
+drm-bridge-lt8912b-manually-disable-hpd-only-if-it-w.patch
+drm-bridge-lt8912b-add-missing-drm_bridge_attach-cal.patch
+drm-bridge-tc358768-fix-use-of-uninitialized-variabl.patch
+drm-bridge-tc358768-fix-bit-updates.patch
+drm-bridge-tc358768-remove-unused-variable.patch
+drm-bridge-tc358768-use-struct-videomode.patch
+drm-bridge-tc358768-print-logical-values-not-raw-reg.patch
+drm-bridge-tc358768-use-dev-for-dbg-prints-not-priv-.patch
+drm-bridge-tc358768-rename-dsibclk-to-hsbyteclk.patch
+drm-bridge-tc358768-clean-up-clock-period-code.patch
+drm-bridge-tc358768-fix-tc358768_ns_to_cnt.patch
+drm-amdkfd-fix-some-race-conditions-in-vram-buffer-a.patch
+drm-amd-display-check-all-enabled-planes-in-dm_check.patch
+drm-amd-display-refactor-dm_get_plane_scale-helper.patch
+drm-amd-display-bail-from-dm_check_crtc_cursor-if-no.patch
+io_uring-kbuf-fix-check-of-bid-wrapping-in-provided-.patch
+io_uring-kbuf-allow-the-full-buffer-id-space-for-pro.patch
+drm-mediatek-fix-iommu-fault-by-swapping-fbs-after-u.patch
+drm-mediatek-fix-iommu-fault-during-crtc-enabling.patch
+drm-rockchip-cdn-dp-fix-some-error-handling-paths-in.patch
+gpu-host1x-correct-allocated-size-for-contexts.patch
+drm-bridge-lt9611uxc-fix-the-race-in-the-error-path.patch
+arm64-arm-xen-enlighten-fix-kpti-checks.patch
+drm-rockchip-fix-type-promotion-bug-in-rockchip_gem_.patch
+xenbus-fix-error-exit-in-xenbus_init.patch
+xen-pciback-consider-intx-disabled-when-msi-msi-x-is.patch
+drm-msm-dsi-use-msm_gem_kernel_put-to-free-tx-buffer.patch
+drm-msm-dsi-free-tx-buffer-in-unbind.patch
+clocksource-drivers-arm_arch_timer-limit-xgene-1-wor.patch
+drm-mediatek-mtk_dsi-fix-no_eot_packet-settings-hand.patch
+drivers-perf-hisi-use-cpuhp_state_remove_instance_no.patch
+perf-arm-cmn-revamp-model-detection.patch
+perf-arm-cmn-fix-dtc-domain-detection.patch
+drivers-perf-hisi_pcie-check-the-type-first-in-pmu-e.patch
+perf-hisi-fix-use-after-free-when-register-pmu-fails.patch
+arm-dts-renesas-blanche-fix-typo-in-gp_11_2-pin-name.patch
+arm64-dts-qcom-sdm845-cheza-doesn-t-support-lmh-node.patch
+arm64-dts-qcom-sc7280-link-usb3_phy_wrapper_gcc_usb3.patch
+arm64-dts-qcom-msm8916-fix-iommu-local-address-range.patch
+arm64-dts-qcom-msm8992-libra-drop-duplicated-reserve.patch
+arm64-dts-qcom-sc7280-add-missing-lmh-interrupts.patch
+arm64-dts-qcom-sm8150-add-ref-clock-to-pcie-phys.patch
+arm64-dts-qcom-sm8350-fix-pinctrl-for-uart18.patch
+arm64-dts-qcom-sdm845-mtp-fix-wifi-configuration.patch
+arm64-dts-marvell-cn9310-use-appropriate-label-for-s.patch
+arm64-dts-qcom-apq8016-sbc-add-missing-adv7533-regul.patch
+arm-dts-qcom-mdm9615-populate-vsdcc-fixed-regulator.patch
+soc-qcom-llcc-handle-a-second-device-without-data-co.patch
+kunit-fix-missed-memory-release-in-kunit_free_suite_.patch
+firmware-ti_sci-mark-driver-as-non-removable.patch
+arm64-dts-ti-k3-am62a7-sk-drop-i2c-1-to-100khz.patch
+firmware-arm_ffa-assign-the-missing-idr-allocation-i.patch
+firmware-arm_ffa-allow-the-ff-a-drivers-to-use-32bit.patch
+arm-dts-unify-pinctrl-single-pin-group-nodes-for-oma.patch
+arm-dts-am3517-evm-fix-led3-4-pinmux.patch
+clk-scmi-free-scmi_clk-allocated-when-the-clocks-wit.patch
+arm64-dts-imx8qm-ss-img-fix-jpegenc-compatible-entry.patch
+arm64-dts-imx8mm-add-sound-dai-cells-to-micfil-node.patch
+arm64-dts-imx8mn-add-sound-dai-cells-to-micfil-node.patch
+arm64-tegra-use-correct-interrupts-for-tegra234-tke.patch
+selftests-pidfd-fix-ksft-print-formats.patch
+selftests-resctrl-ensure-the-benchmark-commands-fits.patch
+module-decompress-use-vmalloc-for-gzip-decompression.patch
+asoc-cs35l41-verify-pm-runtime-resume-errors-in-irq-.patch
+asoc-cs35l41-undo-runtime-pm-changes-at-driver-exit-.patch
+alsa-hda-cs35l41-fix-unbalanced-pm_runtime_get.patch
+alsa-hda-cs35l41-undo-runtime-pm-changes-at-driver-e.patch
+keys-include-linux-errno.h-in-linux-verification.h.patch
+crypto-hisilicon-hpre-fix-a-erroneous-check-after-sn.patch
+hwrng-bcm2835-fix-hwrng-throughput-regression.patch
+hwrng-geode-fix-accessing-registers.patch
+rdma-core-use-size_-add-sub-mul-in-calls-to-struct_s.patch
+crypto-qat-ignore-subsequent-state-up-commands.patch
+crypto-qat-relocate-bufferlist-logic.patch
+crypto-qat-rename-bufferlist-functions.patch
+crypto-qat-change-bufferlist-logic-interface.patch
+crypto-qat-generalize-crypto-request-buffers.patch
+crypto-qat-extend-buffer-list-interface.patch
+crypto-qat-fix-unregistration-of-crypto-algorithms.patch
+scsi-ibmvfc-fix-erroneous-use-of-rtas_busy_delay-wit.patch
+libnvdimm-of_pmem-use-devm_kstrdup-instead-of-kstrdu.patch
+nd_btt-make-btt-lanes-preemptible.patch
+crypto-caam-qi2-fix-chacha20-poly1305-self-test-fail.patch
+crypto-caam-jr-fix-chacha20-poly1305-self-test-failu.patch
+crypto-qat-increase-size-of-buffers.patch
+pci-vmd-correct-pci-header-type-register-s-multi-fun.patch
+hid-cp2112-fix-duplicate-workqueue-initialization.patch
+crypto-hisilicon-qm-delete-redundant-null-assignment.patch
+crypto-hisilicon-qm-modify-the-process-of-regs-dfx.patch
+crypto-hisilicon-qm-split-a-debugfs.c-from-qm.patch
+crypto-hisilicon-qm-fix-pf-queue-parameter-issue.patch
+arm-9321-1-memset-cast-the-constant-byte-to-unsigned.patch
+ext4-move-ix-sanity-check-to-corrent-position.patch
+asoc-fsl-mpc5200_dma.c-fix-warning-of-function-param.patch
+ib-mlx5-fix-rdma-counter-binding-for-raw-qp.patch
+rdma-hns-fix-printing-level-of-asynchronous-events.patch
+rdma-hns-fix-uninitialized-ucmd-in-hns_roce_create_q.patch
+rdma-hns-fix-signed-unsigned-mixed-comparisons.patch
+rdma-hns-add-check-for-sl.patch
+rdma-hns-the-ud-mode-can-only-be-configured-with-dcq.patch
+asoc-sof-core-ensure-sof_ops_free-is-still-called-wh.patch
+asoc-fsl-fix-pm-disable-depth-imbalance-in-fsl_easrc.patch
+scsi-ufs-core-leave-space-for-0-in-utf8-desc-string.patch
+rdma-hfi1-workaround-truncation-compilation-error.patch
+hid-cp2112-make-irq_chip-immutable.patch
+hid-cp2112-fix-irq-shutdown-stopping-polling-for-all.patch
+sh-bios-revive-earlyprintk-support.patch
+revert-hid-logitech-hidpp-add-a-module-parameter-to-.patch
+hid-logitech-hidpp-remove-hidpp_quirk_no_hidinput-qu.patch
+hid-logitech-hidpp-don-t-restart-io-instead-defer-hi.patch
+hid-logitech-hidpp-revert-don-t-restart-communicatio.patch
+hid-logitech-hidpp-move-get_wireless_feature_index-c.patch
+asoc-intel-skylake-fix-mem-leak-when-parsing-uuids-f.patch
+padata-fix-refcnt-handling-in-padata_free_shell.patch
+crypto-qat-fix-deadlock-in-backlog-processing.patch
+asoc-ams-delta.c-use-component-after-check.patch
+ib-mlx5-fix-init-stage-error-handling-to-avoid-doubl.patch
+mfd-core-un-constify-mfd_cell.of_reg.patch
+mfd-core-ensure-disabled-devices-are-skipped-without.patch
+mfd-dln2-fix-double-put-in-dln2_probe.patch
+dt-bindings-mfd-mt6397-add-binding-for-mt6357.patch
+dt-bindings-mfd-mt6397-split-out-compatible-for-medi.patch
+mfd-arizona-spi-set-pdata.hpdet_channel-for-acpi-enu.patch
+leds-turris-omnia-drop-unnecessary-mutex-locking.patch
+leds-turris-omnia-do-not-use-smbus-calls.patch
+leds-pwm-don-t-disable-the-pwm-when-the-led-should-b.patch
+leds-trigger-ledtrig-cpu-fix-output-may-be-truncated.patch
+kunit-add-macro-to-allow-conditionally-exposing-stat.patch
+apparmor-test-make-static-symbols-visible-during-kun.patch
+apparmor-fix-invalid-reference-on-profile-disconnect.patch
+perf-stat-fix-aggr-mode-initialization.patch
+iio-frequency-adf4350-use-device-managed-functions-a.patch
+perf-kwork-fix-incorrect-and-missing-free-atom-in-wo.patch
+perf-kwork-add-the-supported-subcommands-to-the-docu.patch
+perf-kwork-set-ordered_events-to-true-in-struct-perf.patch
+filemap-add-filemap_get_folios_tag.patch
+f2fs-convert-f2fs_write_cache_pages-to-use-filemap_g.patch
+f2fs-compress-fix-deadloop-in-f2fs_write_cache_pages.patch
+f2fs-compress-fix-to-avoid-use-after-free-on-dic.patch
+f2fs-compress-fix-to-avoid-redundant-compress-extens.patch
+tty-tty_jobctrl-fix-pid-memleak-in-disassociate_ctty.patch
+livepatch-fix-missing-newline-character-in-klp_resol.patch
+pinctrl-renesas-rzg2l-make-reverse-order-of-enable-f.patch
+perf-record-fix-btf-type-checks-in-the-off-cpu-profi.patch
+dmaengine-idxd-register-dsa_bus_type-before-register.patch
+usb-dwc2-fix-possible-null-pointer-dereference-cause.patch
+usb-chipidea-fix-dma-overwrite-for-tegra.patch
+usb-chipidea-simplify-tegra-dma-alignment-code.patch
+dmaengine-ti-edma-handle-irq_of_parse_and_map-errors.patch
+misc-st_core-do-not-call-kfree_skb-under-spin_lock_i.patch
+tools-iio-iio_generic_buffer-ensure-alignment.patch
+usb-usbip-fix-stub_dev-hub-disconnect.patch
+dmaengine-pxa_dma-remove-an-erroneous-bug_on-in-pxad.patch
+f2fs-fix-to-initialize-map.m_pblk-in-f2fs_precache_e.patch
+interconnect-qcom-sc7180-retire-define_qbcm.patch
+interconnect-qcom-sc7180-set-acv-enable_mask.patch
+interconnect-qcom-sc7280-set-acv-enable_mask.patch
+interconnect-qcom-sc8180x-set-acv-enable_mask.patch
+interconnect-qcom-sc8280xp-set-acv-enable_mask.patch
+interconnect-qcom-sdm845-retire-define_qbcm.patch
+interconnect-qcom-sdm845-set-acv-enable_mask.patch
+interconnect-qcom-sm6350-retire-define_qbcm.patch
+interconnect-qcom-sm6350-set-acv-enable_mask.patch
+interconnect-move-ignore_list-out-of-of_count_icc_pr.patch
+interconnect-qcom-sm8150-drop-ip0-interconnects.patch
+interconnect-qcom-sm8150-retire-define_qbcm.patch
+interconnect-qcom-sm8150-set-acv-enable_mask.patch
+interconnect-qcom-sm8350-retire-define_qbcm.patch
+interconnect-qcom-sm8350-set-acv-enable_mask.patch
+powerpc-only-define-__parse_fpscr-when-required.patch
+modpost-fix-tee-module_device_table-built-on-big-end.patch
+modpost-fix-ishtp-module_device_table-built-on-big-e.patch
+powerpc-40x-remove-stale-pte_atomic_updates-macro.patch
+powerpc-xive-fix-endian-conversion-size.patch
+powerpc-vas-limit-open-window-failure-messages-in-lo.patch
+powerpc-imc-pmu-use-the-correct-spinlock-initializer.patch
+powerpc-pseries-fix-potential-memory-leak-in-init_cp.patch
+xhci-loosen-rpm-as-default-policy-to-cover-for-amd-x.patch
+usb-host-xhci-plat-fix-possible-kernel-oops-while-re.patch
+perf-machine-avoid-out-of-bounds-lbr-memory-read.patch
+perf-hist-add-missing-puts-to-hist__account_cycles.patch
+9p-net-fix-possible-memory-leak-in-p9_check_errors.patch
+i3c-fix-potential-refcount-leak-in-i3c_master_regist.patch
+cxl-mem-fix-shutdown-order.patch
+crypto-ccp-name-1-return-value-as-sev_ret_no_fw_call.patch
+x86-sev-change-snp_guest_issue_request-s-fw_err-argu.patch
+virt-sevguest-fix-passing-a-stack-buffer-as-a-scatte.patch
+rtc-pcf85363-fix-wrong-mask-val-parameters-in-regmap.patch
+pcmcia-cs-fix-possible-hung-task-and-memory-leak-pcc.patch
+pcmcia-ds-fix-refcount-leak-in-pcmcia_device_add.patch
+pcmcia-ds-fix-possible-name-leak-in-error-path-in-pc.patch
+media-hantro-check-whether-reset-op-is-defined-befor.patch
+media-verisilicon-do-not-enable-g2-postproc-downscal.patch
+media-ov5640-drop-dead-code-using-frame_interval.patch
+media-ov5640-fix-vblank-unchange-issue-when-work-at-.patch
+media-i2c-max9286-fix-some-redundant-of_node_put-cal.patch
+media-ov5640-fix-a-memory-leak-when-ov5640_probe-fai.patch
+media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
+media-amphion-handle-firmware-debug-message.patch
+media-mtk-jpegenc-fix-bug-in-jpeg-encode-quality-sel.patch
+media-s3c-camif-avoid-inappropriate-kfree.patch
+media-vidtv-psi-add-check-for-kstrdup.patch
+media-vidtv-mux-add-check-and-kfree-for-kstrdup.patch
+media-cedrus-fix-clock-reset-sequence.patch
+media-cadence-csi2rx-unregister-v4l2-async-notifier.patch
+media-dvb-usb-v2-af9035-fix-missing-unlock.patch
+media-cec-meson-always-include-meson-sub-directory-i.patch
+regmap-prevent-noinc-writes-from-clobbering-cache.patch
--- /dev/null
+From 2090b4dd08e9076bff1f818de93d92eb3c33ec73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 11:46:43 +0200
+Subject: sh: bios: Revive earlyprintk support
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 553f7ac78fbb41b2c93ab9b9d78e42274d27daa9 ]
+
+The SuperH BIOS earlyprintk code is protected by CONFIG_EARLY_PRINTK.
+However, when this protection was added, it was missed that SuperH no
+longer defines an EARLY_PRINTK config symbol since commit
+e76fe57447e88916 ("sh: Remove old early serial console code V2"), so
+BIOS earlyprintk can no longer be used.
+
+Fix this by reviving the EARLY_PRINTK config symbol.
+
+Fixes: d0380e6c3c0f6edb ("early_printk: consolidate random copies of identical code")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/c40972dfec3dcc6719808d5df388857360262878.1697708489.git.geert+renesas@glider.be
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/Kconfig.debug | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug
+index c449e7c1b20ff..8bcd6c1431a95 100644
+--- a/arch/sh/Kconfig.debug
++++ b/arch/sh/Kconfig.debug
+@@ -22,6 +22,17 @@ config STACK_DEBUG
+ every function call and will therefore incur a major
+ performance hit. Most users should say N.
+
++config EARLY_PRINTK
++ bool "Early printk"
++ depends on SH_STANDARD_BIOS
++ help
++ Say Y here to redirect kernel printk messages to the serial port
++ used by the SH-IPL bootloader, starting very early in the boot
++ process and ending when the kernel's serial console is initialised.
++ This option is only useful while porting the kernel to a new machine,
++ when the kernel may crash or hang before the serial console is
++ initialised. If unsure, say N.
++
+ config 4KSTACKS
+ bool "Use 4Kb for kernel stacks instead of 8Kb"
+ depends on DEBUG_KERNEL && (MMU || BROKEN) && !PAGE_SIZE_64KB
+--
+2.42.0
+
--- /dev/null
+From 43acd57c27f597833cbc8be7ca240484d835b2b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Sep 2023 10:32:29 +0200
+Subject: soc: qcom: llcc: Handle a second device without data corruption
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit f1a1bc8775b26345aba2be278118999e7f661d3d ]
+
+Usually there is only one llcc device. But if there were a second, even
+a failed probe call would modify the global drv_data pointer. So check
+if drv_data is valid before overwriting it.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Fixes: a3134fb09e0b ("drivers: soc: Add LLCC driver")
+Link: https://lore.kernel.org/r/20230926083229.2073890-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/llcc-qcom.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c
+index 85219b5e1f416..bc400669ee022 100644
+--- a/drivers/soc/qcom/llcc-qcom.c
++++ b/drivers/soc/qcom/llcc-qcom.c
+@@ -778,6 +778,9 @@ static int qcom_llcc_probe(struct platform_device *pdev)
+ u32 version;
+ struct regmap *regmap;
+
++ if (!IS_ERR(drv_data))
++ return -EBUSY;
++
+ drv_data = devm_kzalloc(dev, sizeof(*drv_data), GFP_KERNEL);
+ if (!drv_data) {
+ ret = -ENOMEM;
+--
+2.42.0
+
--- /dev/null
+From d283d488260451c0a56aa4b367ecdc1c8bb8dd02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Oct 2023 15:15:24 -0500
+Subject: spi: nxp-fspi: use the correct ioremap function
+
+From: Han Xu <han.xu@nxp.com>
+
+[ Upstream commit c3aa5cb264a38ae9bbcce32abca4c155af0456df ]
+
+AHB memory as MMIO should be mapped with ioremap rather than ioremap_wc,
+which should have been used initially just to handle unaligned access as
+a workaround.
+
+Fixes: d166a73503ef ("spi: fspi: dynamically alloc AHB memory")
+Signed-off-by: Han Xu <han.xu@nxp.com>
+Link: https://lore.kernel.org/r/20231010201524.2021340-1-han.xu@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-nxp-fspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c
+index c7a4a3606547e..afecf69d3ceba 100644
+--- a/drivers/spi/spi-nxp-fspi.c
++++ b/drivers/spi/spi-nxp-fspi.c
+@@ -708,7 +708,7 @@ static int nxp_fspi_read_ahb(struct nxp_fspi *f, const struct spi_mem_op *op)
+ f->memmap_len = len > NXP_FSPI_MIN_IOMAP ?
+ len : NXP_FSPI_MIN_IOMAP;
+
+- f->ahb_addr = ioremap_wc(f->memmap_phy + f->memmap_start,
++ f->ahb_addr = ioremap(f->memmap_phy + f->memmap_start,
+ f->memmap_len);
+
+ if (!f->ahb_addr) {
+--
+2.42.0
+
--- /dev/null
+From 96ca6b2790ac80aed9d322d9e91bf433a8e92b93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Aug 2023 18:02:54 +0800
+Subject: spi: tegra: Fix missing IRQ check in tegra_slink_probe()
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit eb9913b511f10968a02cfa5329a896855dd152a3 ]
+
+This func misses checking for platform_get_irq()'s call and may passes the
+negative error codes to request_irq(), which takes unsigned IRQ #,
+causing it to fail with -EINVAL, overriding an original error code.
+
+Fix this by stop calling request_irq() with invalid IRQ #s.
+
+Fixes: dc4dc3605639 ("spi: tegra: add spi driver for SLINK controller")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Reviewed-by: Helen Koike <helen.koike@collabora.com>
+Link: https://lore.kernel.org/r/tencent_73FCC06A3D1C14EE5175253C6FB46A07B709@qq.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra20-slink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index 148043d0c2b84..24cab56ecb7fd 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -1093,6 +1093,8 @@ static int tegra_slink_probe(struct platform_device *pdev)
+ reset_control_deassert(tspi->rst);
+
+ spi_irq = platform_get_irq(pdev, 0);
++ if (spi_irq < 0)
++ return spi_irq;
+ tspi->irq = spi_irq;
+ ret = request_threaded_irq(tspi->irq, tegra_slink_isr,
+ tegra_slink_isr_thread, IRQF_ONESHOT,
+--
+2.42.0
+
--- /dev/null
+From 1e1653bd8ab0abcb72b1d01e6a1a5ee3b3685ce0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Oct 2023 10:53:58 -0700
+Subject: string: Adjust strtomem() logic to allow for smaller sources
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 0e108725f6cc5b3be9e607f89c9fbcbb236367b7 ]
+
+Arnd noticed we have a case where a shorter source string is being copied
+into a destination byte array, but this results in a strnlen() call that
+exceeds the size of the source. This is seen with -Wstringop-overread:
+
+In file included from ../include/linux/uuid.h:11,
+ from ../include/linux/mod_devicetable.h:14,
+ from ../include/linux/cpufeature.h:12,
+ from ../arch/x86/coco/tdx/tdx.c:7:
+../arch/x86/coco/tdx/tdx.c: In function 'tdx_panic.constprop':
+../include/linux/string.h:284:9: error: 'strnlen' specified bound 64 exceeds source size 60 [-Werror=stringop-overread]
+ 284 | memcpy_and_pad(dest, _dest_len, src, strnlen(src, _dest_len), pad); \
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+../arch/x86/coco/tdx/tdx.c:124:9: note: in expansion of macro 'strtomem_pad'
+ 124 | strtomem_pad(message.str, msg, '\0');
+ | ^~~~~~~~~~~~
+
+Use the smaller of the two buffer sizes when calling strnlen(). When
+src length is unknown (SIZE_MAX), it is adjusted to use dest length,
+which is what the original code did.
+
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: dfbafa70bde2 ("string: Introduce strtomem() and strtomem_pad()")
+Tested-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Andy Shevchenko <andy@kernel.org>
+Cc: linux-hardening@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/string.h | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/string.h b/include/linux/string.h
+index cf7607b321027..26ab8928d8661 100644
+--- a/include/linux/string.h
++++ b/include/linux/string.h
+@@ -276,10 +276,12 @@ void memcpy_and_pad(void *dest, size_t dest_len, const void *src, size_t count,
+ */
+ #define strtomem_pad(dest, src, pad) do { \
+ const size_t _dest_len = __builtin_object_size(dest, 1); \
++ const size_t _src_len = __builtin_object_size(src, 1); \
+ \
+ BUILD_BUG_ON(!__builtin_constant_p(_dest_len) || \
+ _dest_len == (size_t)-1); \
+- memcpy_and_pad(dest, _dest_len, src, strnlen(src, _dest_len), pad); \
++ memcpy_and_pad(dest, _dest_len, src, \
++ strnlen(src, min(_src_len, _dest_len)), pad); \
+ } while (0)
+
+ /**
+@@ -297,10 +299,11 @@ void memcpy_and_pad(void *dest, size_t dest_len, const void *src, size_t count,
+ */
+ #define strtomem(dest, src) do { \
+ const size_t _dest_len = __builtin_object_size(dest, 1); \
++ const size_t _src_len = __builtin_object_size(src, 1); \
+ \
+ BUILD_BUG_ON(!__builtin_constant_p(_dest_len) || \
+ _dest_len == (size_t)-1); \
+- memcpy(dest, src, min(_dest_len, strnlen(src, _dest_len))); \
++ memcpy(dest, src, strnlen(src, min(_src_len, _dest_len))); \
+ } while (0)
+
+ /**
+--
+2.42.0
+
--- /dev/null
+From 4ff151c643e8433d801aeebb3c3deaa6a605ffd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 14:36:20 +0000
+Subject: tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed
+
+From: Aananth V <aananthv@google.com>
+
+[ Upstream commit e326578a21414738de45f77badd332fb00bd0f58 ]
+
+For passive TCP Fast Open sockets that had SYN/ACK timeout and did not
+send more data in SYN_RECV, upon receiving the final ACK in 3WHS, the
+congestion state may awkwardly stay in CA_Loss mode unless the CA state
+was undone due to TCP timestamp checks. However, if
+tcp_rcv_synrecv_state_fastopen() decides not to undo, then we should
+enter CA_Open, because at that point we have received an ACK covering
+the retransmitted SYNACKs. Currently, the icsk_ca_state is only set to
+CA_Open after we receive an ACK for a data-packet. This is because
+tcp_ack does not call tcp_fastretrans_alert (and tcp_process_loss) if
+!prior_packets
+
+Note that tcp_process_loss() calls tcp_try_undo_recovery(), so having
+tcp_rcv_synrecv_state_fastopen() decide that if we're in CA_Loss we
+should call tcp_try_undo_recovery() is consistent with that, and
+low risk.
+
+Fixes: dad8cea7add9 ("tcp: fix TFO SYNACK undo to avoid double-timestamp-undo")
+Signed-off-by: Aananth V <aananthv@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index d63942202493d..65dae3d43684f 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -6420,22 +6420,23 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
+
+ static void tcp_rcv_synrecv_state_fastopen(struct sock *sk)
+ {
++ struct tcp_sock *tp = tcp_sk(sk);
+ struct request_sock *req;
+
+ /* If we are still handling the SYNACK RTO, see if timestamp ECR allows
+ * undo. If peer SACKs triggered fast recovery, we can't undo here.
+ */
+- if (inet_csk(sk)->icsk_ca_state == TCP_CA_Loss)
+- tcp_try_undo_loss(sk, false);
++ if (inet_csk(sk)->icsk_ca_state == TCP_CA_Loss && !tp->packets_out)
++ tcp_try_undo_recovery(sk);
+
+ /* Reset rtx states to prevent spurious retransmits_timed_out() */
+- tcp_sk(sk)->retrans_stamp = 0;
++ tp->retrans_stamp = 0;
+ inet_csk(sk)->icsk_retransmits = 0;
+
+ /* Once we leave TCP_SYN_RECV or TCP_FIN_WAIT_1,
+ * we no longer need req so release it.
+ */
+- req = rcu_dereference_protected(tcp_sk(sk)->fastopen_rsk,
++ req = rcu_dereference_protected(tp->fastopen_rsk,
+ lockdep_sock_is_held(sk));
+ reqsk_fastopen_remove(sk, req, false);
+
+--
+2.42.0
+
--- /dev/null
+From db1e5337474deec7ec20ba6a043e676cdc4d7555 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 12:57:37 +0000
+Subject: tcp: fix cookie_init_timestamp() overflows
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 73ed8e03388d16c12fc577e5c700b58a29045a15 ]
+
+cookie_init_timestamp() is supposed to return a 64bit timestamp
+suitable for both TSval determination and setting of skb->tstamp.
+
+Unfortunately it uses 32bit fields and overflows after
+2^32 * 10^6 nsec (~49 days) of uptime.
+
+Generated TSval are still correct, but skb->tstamp might be set
+far away in the past, potentially confusing other layers.
+
+tcp_ns_to_ts() is changed to return a full 64bit value,
+ts and ts_now variables are changed to u64 type,
+and TSMASK is removed in favor of shifts operations.
+
+While we are at it, change this sequence:
+ ts >>= TSBITS;
+ ts--;
+ ts <<= TSBITS;
+ ts |= options;
+to:
+ ts -= (1UL << TSBITS);
+
+Fixes: 9a568de4818d ("tcp: switch TCP TS option (RFC 7323) to 1ms clock")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/tcp.h | 2 +-
+ net/ipv4/syncookies.c | 20 +++++++-------------
+ 2 files changed, 8 insertions(+), 14 deletions(-)
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 548c75c8a34c7..19646fdec23dc 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -810,7 +810,7 @@ static inline u32 tcp_time_stamp(const struct tcp_sock *tp)
+ }
+
+ /* Convert a nsec timestamp into TCP TSval timestamp (ms based currently) */
+-static inline u32 tcp_ns_to_ts(u64 ns)
++static inline u64 tcp_ns_to_ts(u64 ns)
+ {
+ return div_u64(ns, NSEC_PER_SEC / TCP_TS_HZ);
+ }
+diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
+index 26fb97d1d4d9a..f9514cf87649e 100644
+--- a/net/ipv4/syncookies.c
++++ b/net/ipv4/syncookies.c
+@@ -41,7 +41,6 @@ static siphash_aligned_key_t syncookie_secret[2];
+ * requested/supported by the syn/synack exchange.
+ */
+ #define TSBITS 6
+-#define TSMASK (((__u32)1 << TSBITS) - 1)
+
+ static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
+ u32 count, int c)
+@@ -62,27 +61,22 @@ static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
+ */
+ u64 cookie_init_timestamp(struct request_sock *req, u64 now)
+ {
+- struct inet_request_sock *ireq;
+- u32 ts, ts_now = tcp_ns_to_ts(now);
++ const struct inet_request_sock *ireq = inet_rsk(req);
++ u64 ts, ts_now = tcp_ns_to_ts(now);
+ u32 options = 0;
+
+- ireq = inet_rsk(req);
+-
+ options = ireq->wscale_ok ? ireq->snd_wscale : TS_OPT_WSCALE_MASK;
+ if (ireq->sack_ok)
+ options |= TS_OPT_SACK;
+ if (ireq->ecn_ok)
+ options |= TS_OPT_ECN;
+
+- ts = ts_now & ~TSMASK;
++ ts = (ts_now >> TSBITS) << TSBITS;
+ ts |= options;
+- if (ts > ts_now) {
+- ts >>= TSBITS;
+- ts--;
+- ts <<= TSBITS;
+- ts |= options;
+- }
+- return (u64)ts * (NSEC_PER_SEC / TCP_TS_HZ);
++ if (ts > ts_now)
++ ts -= (1UL << TSBITS);
++
++ return ts * (NSEC_PER_SEC / TCP_TS_HZ);
+ }
+
+
+--
+2.42.0
+
--- /dev/null
+From 2eab03cdacad0be2e0761277952085b4be0369fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 22:03:53 +0000
+Subject: tcp_metrics: add missing barriers on delete
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit cbc3a153222805d65f821e10f4f78b6afce06f86 ]
+
+When removing an item from RCU protected list, we must prevent
+store-tearing, using rcu_assign_pointer() or WRITE_ONCE().
+
+Fixes: 04f721c671656 ("tcp_metrics: Rewrite tcp_metrics_flush_all")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_metrics.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
+index 99ac5efe244d3..61c573a72db63 100644
+--- a/net/ipv4/tcp_metrics.c
++++ b/net/ipv4/tcp_metrics.c
+@@ -908,7 +908,7 @@ static void tcp_metrics_flush_all(struct net *net)
+ match = net ? net_eq(tm_net(tm), net) :
+ !refcount_read(&tm_net(tm)->ns.count);
+ if (match) {
+- *pp = tm->tcpm_next;
++ rcu_assign_pointer(*pp, tm->tcpm_next);
+ kfree_rcu(tm, rcu_head);
+ } else {
+ pp = &tm->tcpm_next;
+@@ -949,7 +949,7 @@ static int tcp_metrics_nl_cmd_del(struct sk_buff *skb, struct genl_info *info)
+ if (addr_same(&tm->tcpm_daddr, &daddr) &&
+ (!src || addr_same(&tm->tcpm_saddr, &saddr)) &&
+ net_eq(tm_net(tm), net)) {
+- *pp = tm->tcpm_next;
++ rcu_assign_pointer(*pp, tm->tcpm_next);
+ kfree_rcu(tm, rcu_head);
+ found = true;
+ } else {
+--
+2.42.0
+
--- /dev/null
+From 956b2c5a46a9054660fdc022704e16c00e8065b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 22:03:55 +0000
+Subject: tcp_metrics: do not create an entry from tcp_init_metrics()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit a135798e6e200ecb2f864cecca6d257ba278370c ]
+
+tcp_init_metrics() only wants to get metrics if they were
+previously stored in the cache. Creating an entry is adding
+useless costs, especially when tcp_no_metrics_save is set.
+
+Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_metrics.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
+index 5a08dc46a1130..a7364ff8b558d 100644
+--- a/net/ipv4/tcp_metrics.c
++++ b/net/ipv4/tcp_metrics.c
+@@ -478,7 +478,7 @@ void tcp_init_metrics(struct sock *sk)
+ goto reset;
+
+ rcu_read_lock();
+- tm = tcp_get_metrics(sk, dst, true);
++ tm = tcp_get_metrics(sk, dst, false);
+ if (!tm) {
+ rcu_read_unlock();
+ goto reset;
+--
+2.42.0
+
--- /dev/null
+From 1376395adabb9e6244b4522b0e1565276cf50c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 22:03:54 +0000
+Subject: tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 081480014a64a69d901f8ef1ffdd56d6085cf87e ]
+
+We need to set tp->snd_ssthresh to TCP_INFINITE_SSTHRESH
+in the case tcp_get_metrics() fails for some reason.
+
+Fixes: 9ad7c049f0f7 ("tcp: RFC2988bis + taking RTT sample from 3WHS for the passive open side")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_metrics.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
+index 61c573a72db63..5a08dc46a1130 100644
+--- a/net/ipv4/tcp_metrics.c
++++ b/net/ipv4/tcp_metrics.c
+@@ -470,6 +470,10 @@ void tcp_init_metrics(struct sock *sk)
+ u32 val, crtt = 0; /* cached RTT scaled by 8 */
+
+ sk_dst_confirm(sk);
++ /* ssthresh may have been reduced unnecessarily during.
++ * 3WHS. Restore it back to its initial default.
++ */
++ tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+ if (!dst)
+ goto reset;
+
+@@ -489,11 +493,6 @@ void tcp_init_metrics(struct sock *sk)
+ tp->snd_ssthresh = val;
+ if (tp->snd_ssthresh > tp->snd_cwnd_clamp)
+ tp->snd_ssthresh = tp->snd_cwnd_clamp;
+- } else {
+- /* ssthresh may have been reduced unnecessarily during.
+- * 3WHS. Restore it back to its initial default.
+- */
+- tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+ }
+ val = tcp_metric_get(tm, TCP_METRIC_REORDERING);
+ if (val && tp->reordering != val)
+--
+2.42.0
+
--- /dev/null
+From 35c641e8de5200d15792af53902a4c063c33e198 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Oct 2023 11:59:39 +0300
+Subject: thermal: core: prevent potential string overflow
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit c99626092efca3061b387043d4a7399bf75fbdd5 ]
+
+The dev->id value comes from ida_alloc() so it's a number between zero
+and INT_MAX. If it's too high then these sprintf()s will overflow.
+
+Fixes: 203d3d4aa482 ("the generic thermal sysfs driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/thermal_core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index 1eae4ec719a8f..ebb36b2c72d5d 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -649,7 +649,8 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
+ if (result)
+ goto release_ida;
+
+- sprintf(dev->attr_name, "cdev%d_trip_point", dev->id);
++ snprintf(dev->attr_name, sizeof(dev->attr_name), "cdev%d_trip_point",
++ dev->id);
+ sysfs_attr_init(&dev->attr.attr);
+ dev->attr.attr.name = dev->attr_name;
+ dev->attr.attr.mode = 0444;
+@@ -658,7 +659,8 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
+ if (result)
+ goto remove_symbol_link;
+
+- sprintf(dev->weight_attr_name, "cdev%d_weight", dev->id);
++ snprintf(dev->weight_attr_name, sizeof(dev->weight_attr_name),
++ "cdev%d_weight", dev->id);
+ sysfs_attr_init(&dev->weight_attr.attr);
+ dev->weight_attr.attr.name = dev->weight_attr_name;
+ dev->weight_attr.attr.mode = S_IWUSR | S_IRUGO;
+--
+2.42.0
+
--- /dev/null
+From 723b97050fe236e2b5eebb5c5bfbfc34e9286d06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 13:16:26 -0600
+Subject: tipc: Use size_add() in calls to struct_size()
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit 2506a91734754de690869824fb0d1ac592ec1266 ]
+
+If, for any reason, the open-coded arithmetic causes a wraparound,
+the protection that `struct_size()` adds against potential integer
+overflows is defeated. Fix this by hardening call to `struct_size()`
+with `size_add()`.
+
+Fixes: e034c6d23bc4 ("tipc: Use struct_size() helper")
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/link.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 2eff1c7949cbc..8715c9b05f90d 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1446,7 +1446,7 @@ u16 tipc_get_gap_ack_blks(struct tipc_gap_ack_blks **ga, struct tipc_link *l,
+ p = (struct tipc_gap_ack_blks *)msg_data(hdr);
+ sz = ntohs(p->len);
+ /* Sanity check */
+- if (sz == struct_size(p, gacks, p->ugack_cnt + p->bgack_cnt)) {
++ if (sz == struct_size(p, gacks, size_add(p->ugack_cnt, p->bgack_cnt))) {
+ /* Good, check if the desired type exists */
+ if ((uc && p->ugack_cnt) || (!uc && p->bgack_cnt))
+ goto ok;
+@@ -1533,7 +1533,7 @@ static u16 tipc_build_gap_ack_blks(struct tipc_link *l, struct tipc_msg *hdr)
+ __tipc_build_gap_ack_blks(ga, l, ga->bgack_cnt) : 0;
+
+ /* Total len */
+- len = struct_size(ga, gacks, ga->bgack_cnt + ga->ugack_cnt);
++ len = struct_size(ga, gacks, size_add(ga->bgack_cnt, ga->ugack_cnt));
+ ga->len = htons(len);
+ return len;
+ }
+--
+2.42.0
+
--- /dev/null
+From fc35f18cf716a6b1dbd873b56f97d8a3b97ab5c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 18:22:27 +0800
+Subject: tls: Only use data field in crypto completion function
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 8d338c76f7cfe0eb4bc46078b1c09c8c5fc75353 ]
+
+The crypto_async_request passed to the completion is not guaranteed
+to be the original request object. Only the data field can be relied
+upon.
+
+Fix this by storing the socket pointer with the AEAD request.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: a2713257ee2b ("tls: Use size_add() in call to struct_size()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls.h | 2 ++
+ net/tls/tls_sw.c | 40 +++++++++++++++++++++++++++++-----------
+ 2 files changed, 31 insertions(+), 11 deletions(-)
+
+diff --git a/net/tls/tls.h b/net/tls/tls.h
+index 17737a65c643a..0672acab27731 100644
+--- a/net/tls/tls.h
++++ b/net/tls/tls.h
+@@ -70,6 +70,8 @@ struct tls_rec {
+ char content_type;
+ struct scatterlist sg_content_type;
+
++ struct sock *sk;
++
+ char aad_space[TLS_AAD_SPACE_SIZE];
+ u8 iv_data[MAX_IV_SIZE];
+ struct aead_request aead_req;
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 2af72d349192e..62d25f355d2c0 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -38,6 +38,7 @@
+ #include <linux/bug.h>
+ #include <linux/sched/signal.h>
+ #include <linux/module.h>
++#include <linux/kernel.h>
+ #include <linux/splice.h>
+ #include <crypto/aead.h>
+
+@@ -57,6 +58,7 @@ struct tls_decrypt_arg {
+ };
+
+ struct tls_decrypt_ctx {
++ struct sock *sk;
+ u8 iv[MAX_IV_SIZE];
+ u8 aad[TLS_MAX_AAD_SIZE];
+ u8 tail;
+@@ -179,18 +181,25 @@ static int tls_padding_length(struct tls_prot_info *prot, struct sk_buff *skb,
+ return sub;
+ }
+
+-static void tls_decrypt_done(struct crypto_async_request *req, int err)
++static void tls_decrypt_done(crypto_completion_data_t *data, int err)
+ {
+- struct aead_request *aead_req = (struct aead_request *)req;
++ struct aead_request *aead_req = crypto_get_completion_data(data);
++ struct crypto_aead *aead = crypto_aead_reqtfm(aead_req);
+ struct scatterlist *sgout = aead_req->dst;
+ struct scatterlist *sgin = aead_req->src;
+ struct tls_sw_context_rx *ctx;
++ struct tls_decrypt_ctx *dctx;
+ struct tls_context *tls_ctx;
+ struct scatterlist *sg;
+ unsigned int pages;
+ struct sock *sk;
++ int aead_size;
+
+- sk = (struct sock *)req->data;
++ aead_size = sizeof(*aead_req) + crypto_aead_reqsize(aead);
++ aead_size = ALIGN(aead_size, __alignof__(*dctx));
++ dctx = (void *)((u8 *)aead_req + aead_size);
++
++ sk = dctx->sk;
+ tls_ctx = tls_get_ctx(sk);
+ ctx = tls_sw_ctx_rx(tls_ctx);
+
+@@ -242,7 +251,7 @@ static int tls_do_decryption(struct sock *sk,
+ if (darg->async) {
+ aead_request_set_callback(aead_req,
+ CRYPTO_TFM_REQ_MAY_BACKLOG,
+- tls_decrypt_done, sk);
++ tls_decrypt_done, aead_req);
+ atomic_inc(&ctx->decrypt_pending);
+ } else {
+ aead_request_set_callback(aead_req,
+@@ -338,6 +347,8 @@ static struct tls_rec *tls_get_rec(struct sock *sk)
+ sg_set_buf(&rec->sg_aead_out[0], rec->aad_space, prot->aad_size);
+ sg_unmark_end(&rec->sg_aead_out[1]);
+
++ rec->sk = sk;
++
+ return rec;
+ }
+
+@@ -419,22 +430,27 @@ int tls_tx_records(struct sock *sk, int flags)
+ return rc;
+ }
+
+-static void tls_encrypt_done(struct crypto_async_request *req, int err)
++static void tls_encrypt_done(crypto_completion_data_t *data, int err)
+ {
+- struct aead_request *aead_req = (struct aead_request *)req;
+- struct sock *sk = req->data;
+- struct tls_context *tls_ctx = tls_get_ctx(sk);
+- struct tls_prot_info *prot = &tls_ctx->prot_info;
+- struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
++ struct aead_request *aead_req = crypto_get_completion_data(data);
++ struct tls_sw_context_tx *ctx;
++ struct tls_context *tls_ctx;
++ struct tls_prot_info *prot;
+ struct scatterlist *sge;
+ struct sk_msg *msg_en;
+ struct tls_rec *rec;
+ bool ready = false;
++ struct sock *sk;
+ int pending;
+
+ rec = container_of(aead_req, struct tls_rec, aead_req);
+ msg_en = &rec->msg_encrypted;
+
++ sk = rec->sk;
++ tls_ctx = tls_get_ctx(sk);
++ prot = &tls_ctx->prot_info;
++ ctx = tls_sw_ctx_tx(tls_ctx);
++
+ sge = sk_msg_elem(msg_en, msg_en->sg.curr);
+ sge->offset -= prot->prepend_size;
+ sge->length += prot->prepend_size;
+@@ -522,7 +538,7 @@ static int tls_do_encryption(struct sock *sk,
+ data_len, rec->iv_data);
+
+ aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+- tls_encrypt_done, sk);
++ tls_encrypt_done, aead_req);
+
+ /* Add the record in tx_list */
+ list_add_tail((struct list_head *)&rec->list, &ctx->tx_list);
+@@ -1495,6 +1511,7 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov,
+ * Both structs are variable length.
+ */
+ aead_size = sizeof(*aead_req) + crypto_aead_reqsize(ctx->aead_recv);
++ aead_size = ALIGN(aead_size, __alignof__(*dctx));
+ mem = kmalloc(aead_size + struct_size(dctx, sg, n_sgin + n_sgout),
+ sk->sk_allocation);
+ if (!mem) {
+@@ -1505,6 +1522,7 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov,
+ /* Segment the allocated memory */
+ aead_req = (struct aead_request *)mem;
+ dctx = (struct tls_decrypt_ctx *)(mem + aead_size);
++ dctx->sk = sk;
+ sgin = &dctx->sg[0];
+ sgout = &dctx->sg[n_sgin];
+
+--
+2.42.0
+
--- /dev/null
+From 3fd47dec9d63d4a1888b85d703c5ed4fdaa1c83a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 13:12:38 -0600
+Subject: tls: Use size_add() in call to struct_size()
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit a2713257ee2be22827d7bc248302d408c91bfb95 ]
+
+If, for any reason, the open-coded arithmetic causes a wraparound,
+the protection that `struct_size()` adds against potential integer
+overflows is defeated. Fix this by hardening call to `struct_size()`
+with `size_add()`.
+
+Fixes: b89fec54fd61 ("tls: rx: wrap decrypt params in a struct")
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 62d25f355d2c0..2e60bf06adff0 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1512,7 +1512,7 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov,
+ */
+ aead_size = sizeof(*aead_req) + crypto_aead_reqsize(ctx->aead_recv);
+ aead_size = ALIGN(aead_size, __alignof__(*dctx));
+- mem = kmalloc(aead_size + struct_size(dctx, sg, n_sgin + n_sgout),
++ mem = kmalloc(aead_size + struct_size(dctx, sg, size_add(n_sgin, n_sgout)),
+ sk->sk_allocation);
+ if (!mem) {
+ err = -ENOMEM;
+--
+2.42.0
+
--- /dev/null
+From 88da96d9255b5bd246976001790646bb654bf84a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 12:57:47 +0300
+Subject: tools: iio: iio_generic_buffer ensure alignment
+
+From: Matti Vaittinen <mazziesaccount@gmail.com>
+
+[ Upstream commit 2d3dff577dd0ea8fe9637a13822f7603c4a881c8 ]
+
+The iio_generic_buffer can return garbage values when the total size of
+scan data is not a multiple of the largest element in the scan. This can be
+demonstrated by reading a scan, consisting, for example of one 4-byte and
+one 2-byte element, where the 4-byte element is first in the buffer.
+
+The IIO generic buffer code does not take into account the last two
+padding bytes that are needed to ensure that the 4-byte data for next
+scan is correctly aligned.
+
+Add the padding bytes required to align the next sample with the scan size.
+
+Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Fixes: e58537ccce73 ("staging: iio: update example application.")
+Link: https://lore.kernel.org/r/ZRvlm4ktNLu+qmlf@dc78bmyyyyyyyyyyyyydt-3.rev.dnainternet.fi
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/iio/iio_generic_buffer.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
+index 44bbf80f0cfdd..0d0a7a19d6f95 100644
+--- a/tools/iio/iio_generic_buffer.c
++++ b/tools/iio/iio_generic_buffer.c
+@@ -54,9 +54,12 @@ enum autochan {
+ static unsigned int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
+ {
+ unsigned int bytes = 0;
+- int i = 0;
++ int i = 0, max = 0;
++ unsigned int misalignment;
+
+ while (i < num_channels) {
++ if (channels[i].bytes > max)
++ max = channels[i].bytes;
+ if (bytes % channels[i].bytes == 0)
+ channels[i].location = bytes;
+ else
+@@ -66,6 +69,14 @@ static unsigned int size_from_channelarray(struct iio_channel_info *channels, in
+ bytes = channels[i].location + channels[i].bytes;
+ i++;
+ }
++ /*
++ * We want the data in next sample to also be properly aligned so
++ * we'll add padding at the end if needed. Adding padding only
++ * works for channel data which size is 2^n bytes.
++ */
++ misalignment = bytes % max;
++ if (misalignment)
++ bytes += max - misalignment;
+
+ return bytes;
+ }
+--
+2.42.0
+
--- /dev/null
+From 3b1ae69c482d98b8d543c769f8374b7feffc1709 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Aug 2023 10:33:29 +0800
+Subject: tty: tty_jobctrl: fix pid memleak in disassociate_ctty()
+
+From: Yi Yang <yiyang13@huawei.com>
+
+[ Upstream commit 11e7f27b79757b6586645d87b95d5b78375ecdfc ]
+
+There is a pid leakage:
+------------------------------
+unreferenced object 0xffff88810c181940 (size 224):
+ comm "sshd", pid 8191, jiffies 4294946950 (age 524.570s)
+ hex dump (first 32 bytes):
+ 01 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N..
+ ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff ....kkkk........
+ backtrace:
+ [<ffffffff814774e6>] kmem_cache_alloc+0x5c6/0x9b0
+ [<ffffffff81177342>] alloc_pid+0x72/0x570
+ [<ffffffff81140ac4>] copy_process+0x1374/0x2470
+ [<ffffffff81141d77>] kernel_clone+0xb7/0x900
+ [<ffffffff81142645>] __se_sys_clone+0x85/0xb0
+ [<ffffffff8114269b>] __x64_sys_clone+0x2b/0x30
+ [<ffffffff83965a72>] do_syscall_64+0x32/0x80
+ [<ffffffff83a00085>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
+
+It turns out that there is a race condition between disassociate_ctty() and
+tty_signal_session_leader(), which caused this leakage.
+
+The pid memleak is triggered by the following race:
+task[sshd] task[bash]
+----------------------- -----------------------
+ disassociate_ctty();
+ spin_lock_irq(¤t->sighand->siglock);
+ put_pid(current->signal->tty_old_pgrp);
+ current->signal->tty_old_pgrp = NULL;
+ tty = tty_kref_get(current->signal->tty);
+ spin_unlock_irq(¤t->sighand->siglock);
+tty_vhangup();
+tty_lock(tty);
+...
+tty_signal_session_leader();
+spin_lock_irq(&p->sighand->siglock);
+...
+if (tty->ctrl.pgrp) //tty->ctrl.pgrp is not NULL
+p->signal->tty_old_pgrp = get_pid(tty->ctrl.pgrp); //An extra get
+spin_unlock_irq(&p->sighand->siglock);
+...
+tty_unlock(tty);
+ if (tty) {
+ tty_lock(tty);
+ ...
+ put_pid(tty->ctrl.pgrp);
+ tty->ctrl.pgrp = NULL; //It's too late
+ ...
+ tty_unlock(tty);
+ }
+
+The issue is believed to be introduced by commit c8bcd9c5be24 ("tty:
+Fix ->session locking") who moves the unlock of siglock in
+disassociate_ctty() above "if (tty)", making a small window allowing
+tty_signal_session_leader() to kick in. It can be easily reproduced by
+adding a delay before "if (tty)" and at the entrance of
+tty_signal_session_leader().
+
+To fix this issue, we move "put_pid(current->signal->tty_old_pgrp)" after
+"tty->ctrl.pgrp = NULL".
+
+Fixes: c8bcd9c5be24 ("tty: Fix ->session locking")
+Signed-off-by: Yi Yang <yiyang13@huawei.com>
+Co-developed-by: GUO Zihua <guozihua@huawei.com>
+Signed-off-by: GUO Zihua <guozihua@huawei.com>
+Link: https://lore.kernel.org/r/20230831023329.165737-1-yiyang13@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/tty_jobctrl.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/tty/tty_jobctrl.c b/drivers/tty/tty_jobctrl.c
+index 0d04287da0984..ef8741c3e6629 100644
+--- a/drivers/tty/tty_jobctrl.c
++++ b/drivers/tty/tty_jobctrl.c
+@@ -300,12 +300,7 @@ void disassociate_ctty(int on_exit)
+ return;
+ }
+
+- spin_lock_irq(¤t->sighand->siglock);
+- put_pid(current->signal->tty_old_pgrp);
+- current->signal->tty_old_pgrp = NULL;
+- tty = tty_kref_get(current->signal->tty);
+- spin_unlock_irq(¤t->sighand->siglock);
+-
++ tty = get_current_tty();
+ if (tty) {
+ unsigned long flags;
+
+@@ -320,6 +315,16 @@ void disassociate_ctty(int on_exit)
+ tty_kref_put(tty);
+ }
+
++ /* If tty->ctrl.pgrp is not NULL, it may be assigned to
++ * current->signal->tty_old_pgrp in a race condition, and
++ * cause pid memleak. Release current->signal->tty_old_pgrp
++ * after tty->ctrl.pgrp set to NULL.
++ */
++ spin_lock_irq(¤t->sighand->siglock);
++ put_pid(current->signal->tty_old_pgrp);
++ current->signal->tty_old_pgrp = NULL;
++ spin_unlock_irq(¤t->sighand->siglock);
++
+ /* Now clear signal->tty under the lock */
+ read_lock(&tasklist_lock);
+ session_clear_tty(task_session(current));
+--
+2.42.0
+
--- /dev/null
+From 600519a3f12860a1b6b8d280b0cb38a4216bbb0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 09:17:25 +0000
+Subject: udp: add missing WRITE_ONCE() around up->encap_rcv
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 6d5a12eb91224d707f8691dccb40a5719fe5466d ]
+
+UDP_ENCAP_ESPINUDP_NON_IKE setsockopt() writes over up->encap_rcv
+while other cpus read it.
+
+Fixes: 067b207b281d ("[UDP]: Cleanup UDP encapsulation code")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index b2aa7777521f6..65abc92a81bd0 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2714,10 +2714,12 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
+ case UDP_ENCAP_ESPINUDP_NON_IKE:
+ #if IS_ENABLED(CONFIG_IPV6)
+ if (sk->sk_family == AF_INET6)
+- up->encap_rcv = ipv6_stub->xfrm6_udp_encap_rcv;
++ WRITE_ONCE(up->encap_rcv,
++ ipv6_stub->xfrm6_udp_encap_rcv);
+ else
+ #endif
+- up->encap_rcv = xfrm4_udp_encap_rcv;
++ WRITE_ONCE(up->encap_rcv,
++ xfrm4_udp_encap_rcv);
+ #endif
+ fallthrough;
+ case UDP_ENCAP_L2TPINUDP:
+--
+2.42.0
+
--- /dev/null
+From abace8e4a00e720cd074301e5dfda9a98b8a6467 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 23:06:03 +0200
+Subject: usb: chipidea: Fix DMA overwrite for Tegra
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+[ Upstream commit 7ab8716713c931ac79988f2592e1cf8b2e4fec1b ]
+
+Tegra USB controllers seem to issue DMA in full 32-bit words only and thus
+may overwrite unevenly-sized buffers. One such occurrence is detected by
+SLUB when receiving a reply to a 1-byte buffer (below). Fix this by
+allocating a bounce buffer also for buffers with sizes not a multiple of 4.
+
+=============================================================================
+BUG kmalloc-64 (Tainted: G B ): kmalloc Redzone overwritten
+-----------------------------------------------------------------------------
+
+0x8555cd02-0x8555cd03 @offset=3330. First byte 0x0 instead of 0xcc
+Allocated in usb_get_status+0x2b/0xac age=1 cpu=3 pid=41
+ __kmem_cache_alloc_node+0x12f/0x1e4
+ __kmalloc+0x33/0x8c
+ usb_get_status+0x2b/0xac
+ hub_probe+0x5e9/0xcec
+ usb_probe_interface+0xbf/0x21c
+ really_probe+0xa5/0x2c4
+ __driver_probe_device+0x75/0x174
+ driver_probe_device+0x31/0x94
+ __device_attach_driver+0x65/0xc0
+ bus_for_each_drv+0x4b/0x74
+ __device_attach+0x69/0x120
+ bus_probe_device+0x65/0x6c
+ device_add+0x48b/0x5f8
+ usb_set_configuration+0x37b/0x6b4
+ usb_generic_driver_probe+0x37/0x68
+ usb_probe_device+0x35/0xb4
+Slab 0xbf622b80 objects=21 used=18 fp=0x8555cdc0 flags=0x800(slab|zone=0)
+Object 0x8555cd00 @offset=3328 fp=0x00000000
+
+Redzone 8555ccc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
+Redzone 8555ccd0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
+Redzone 8555cce0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
+Redzone 8555ccf0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
+Object 8555cd00: 01 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc ................
+Object 8555cd10: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
+Object 8555cd20: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
+Object 8555cd30: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
+Redzone 8555cd40: cc cc cc cc ....
+Padding 8555cd74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ
+CPU: 3 PID: 41 Comm: kworker/3:1 Tainted: G B 6.6.0-rc1mq-00118-g59786f827ea1 #1115
+Hardware name: NVIDIA Tegra SoC (Flattened Device Tree)
+Workqueue: usb_hub_wq hub_event
+[<8010ca28>] (unwind_backtrace) from [<801090a5>] (show_stack+0x11/0x14)
+[<801090a5>] (show_stack) from [<805da2fb>] (dump_stack_lvl+0x4d/0x7c)
+[<805da2fb>] (dump_stack_lvl) from [<8026464f>] (check_bytes_and_report+0xb3/0xe4)
+[<8026464f>] (check_bytes_and_report) from [<802648e1>] (check_object+0x261/0x290)
+[<802648e1>] (check_object) from [<802671b1>] (free_to_partial_list+0x105/0x3f8)
+[<802671b1>] (free_to_partial_list) from [<80268613>] (__kmem_cache_free+0x103/0x128)
+[<80268613>] (__kmem_cache_free) from [<80425a67>] (usb_get_status+0x73/0xac)
+[<80425a67>] (usb_get_status) from [<80421b31>] (hub_probe+0x5e9/0xcec)
+[<80421b31>] (hub_probe) from [<80428bbb>] (usb_probe_interface+0xbf/0x21c)
+[<80428bbb>] (usb_probe_interface) from [<803ee13d>] (really_probe+0xa5/0x2c4)
+[<803ee13d>] (really_probe) from [<803ee3d1>] (__driver_probe_device+0x75/0x174)
+[<803ee3d1>] (__driver_probe_device) from [<803ee501>] (driver_probe_device+0x31/0x94)
+usb 1-1: device descriptor read/8, error -71
+
+Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Link: https://lore.kernel.org/r/ef8466b834c1726f5404c95c3e192e90460146f8.1695934946.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/host.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
+index 3b08c5e811707..fae4b2f9b9b21 100644
+--- a/drivers/usb/chipidea/host.c
++++ b/drivers/usb/chipidea/host.c
+@@ -411,12 +411,13 @@ static int ci_hdrc_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
+ const unsigned int ci_hdrc_usb_dma_align = 32;
+ size_t kmalloc_size;
+
+- if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0 ||
+- !((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)))
++ if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0)
++ return 0;
++ if (!((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)) && !(urb->transfer_buffer_length & 3))
+ return 0;
+
+ /* Allocate a buffer with enough padding for alignment */
+- kmalloc_size = urb->transfer_buffer_length +
++ kmalloc_size = ALIGN(urb->transfer_buffer_length, 4) +
+ sizeof(struct ci_hdrc_dma_aligned_buffer) +
+ ci_hdrc_usb_dma_align - 1;
+
+--
+2.42.0
+
--- /dev/null
+From 376a4270491100496b8b807e73d23969e38092cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 23:06:03 +0200
+Subject: usb: chipidea: Simplify Tegra DMA alignment code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+[ Upstream commit 2ae61a2562c0d1720545b0845829a65fb6a9c2c6 ]
+
+The USB host on Tegra3 works with 32-bit alignment. Previous code tried
+to align the buffer, but it did align the wrapper struct instead, so
+the buffer was at a constant offset of 8 bytes (two pointers) from
+expected alignment. Since kmalloc() guarantees at least 8-byte
+alignment already, the alignment-extending is removed.
+
+Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Link: https://lore.kernel.org/r/a0d917d492b1f91ee0019e68b8e8bca9c585393f.1695934946.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/host.c | 45 +++++++++++++++----------------------
+ 1 file changed, 18 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
+index fae4b2f9b9b21..34bbdfadd66f3 100644
+--- a/drivers/usb/chipidea/host.c
++++ b/drivers/usb/chipidea/host.c
+@@ -30,8 +30,7 @@ struct ehci_ci_priv {
+ };
+
+ struct ci_hdrc_dma_aligned_buffer {
+- void *kmalloc_ptr;
+- void *old_xfer_buffer;
++ void *original_buffer;
+ u8 data[];
+ };
+
+@@ -380,60 +379,52 @@ static int ci_ehci_bus_suspend(struct usb_hcd *hcd)
+ return 0;
+ }
+
+-static void ci_hdrc_free_dma_aligned_buffer(struct urb *urb)
++static void ci_hdrc_free_dma_aligned_buffer(struct urb *urb, bool copy_back)
+ {
+ struct ci_hdrc_dma_aligned_buffer *temp;
+- size_t length;
+
+ if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
+ return;
++ urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
+
+ temp = container_of(urb->transfer_buffer,
+ struct ci_hdrc_dma_aligned_buffer, data);
++ urb->transfer_buffer = temp->original_buffer;
++
++ if (copy_back && usb_urb_dir_in(urb)) {
++ size_t length;
+
+- if (usb_urb_dir_in(urb)) {
+ if (usb_pipeisoc(urb->pipe))
+ length = urb->transfer_buffer_length;
+ else
+ length = urb->actual_length;
+
+- memcpy(temp->old_xfer_buffer, temp->data, length);
++ memcpy(temp->original_buffer, temp->data, length);
+ }
+- urb->transfer_buffer = temp->old_xfer_buffer;
+- kfree(temp->kmalloc_ptr);
+
+- urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
++ kfree(temp);
+ }
+
+ static int ci_hdrc_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
+ {
+- struct ci_hdrc_dma_aligned_buffer *temp, *kmalloc_ptr;
+- const unsigned int ci_hdrc_usb_dma_align = 32;
+- size_t kmalloc_size;
++ struct ci_hdrc_dma_aligned_buffer *temp;
+
+ if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0)
+ return 0;
+- if (!((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)) && !(urb->transfer_buffer_length & 3))
++ if (IS_ALIGNED((uintptr_t)urb->transfer_buffer, 4)
++ && IS_ALIGNED(urb->transfer_buffer_length, 4))
+ return 0;
+
+- /* Allocate a buffer with enough padding for alignment */
+- kmalloc_size = ALIGN(urb->transfer_buffer_length, 4) +
+- sizeof(struct ci_hdrc_dma_aligned_buffer) +
+- ci_hdrc_usb_dma_align - 1;
+-
+- kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
+- if (!kmalloc_ptr)
++ temp = kmalloc(sizeof(*temp) + ALIGN(urb->transfer_buffer_length, 4), mem_flags);
++ if (!temp)
+ return -ENOMEM;
+
+- /* Position our struct dma_aligned_buffer such that data is aligned */
+- temp = PTR_ALIGN(kmalloc_ptr + 1, ci_hdrc_usb_dma_align) - 1;
+- temp->kmalloc_ptr = kmalloc_ptr;
+- temp->old_xfer_buffer = urb->transfer_buffer;
+ if (usb_urb_dir_out(urb))
+ memcpy(temp->data, urb->transfer_buffer,
+ urb->transfer_buffer_length);
+- urb->transfer_buffer = temp->data;
+
++ temp->original_buffer = urb->transfer_buffer;
++ urb->transfer_buffer = temp->data;
+ urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER;
+
+ return 0;
+@@ -450,7 +441,7 @@ static int ci_hdrc_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
+
+ ret = usb_hcd_map_urb_for_dma(hcd, urb, mem_flags);
+ if (ret)
+- ci_hdrc_free_dma_aligned_buffer(urb);
++ ci_hdrc_free_dma_aligned_buffer(urb, false);
+
+ return ret;
+ }
+@@ -458,7 +449,7 @@ static int ci_hdrc_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
+ static void ci_hdrc_unmap_urb_for_dma(struct usb_hcd *hcd, struct urb *urb)
+ {
+ usb_hcd_unmap_urb_for_dma(hcd, urb);
+- ci_hdrc_free_dma_aligned_buffer(urb);
++ ci_hdrc_free_dma_aligned_buffer(urb, true);
+ }
+
+ int ci_hdrc_host_init(struct ci_hdrc *ci)
+--
+2.42.0
+
--- /dev/null
+From 2676fc221c10d7b7d0304ca7aa2d9e5aed508c8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Sep 2023 10:44:04 +0800
+Subject: usb: dwc2: fix possible NULL pointer dereference caused by driver
+ concurrency
+
+From: Jia-Ju Bai <baijiaju@buaa.edu.cn>
+
+[ Upstream commit ef307bc6ef04e8c1ea843231db58e3afaafa9fa6 ]
+
+In _dwc2_hcd_urb_enqueue(), "urb->hcpriv = NULL" is executed without
+holding the lock "hsotg->lock". In _dwc2_hcd_urb_dequeue():
+
+ spin_lock_irqsave(&hsotg->lock, flags);
+ ...
+ if (!urb->hcpriv) {
+ dev_dbg(hsotg->dev, "## urb->hcpriv is NULL ##\n");
+ goto out;
+ }
+ rc = dwc2_hcd_urb_dequeue(hsotg, urb->hcpriv); // Use urb->hcpriv
+ ...
+out:
+ spin_unlock_irqrestore(&hsotg->lock, flags);
+
+When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() are
+concurrently executed, the NULL check of "urb->hcpriv" can be executed
+before "urb->hcpriv = NULL". After urb->hcpriv is NULL, it can be used
+in the function call to dwc2_hcd_urb_dequeue(), which can cause a NULL
+pointer dereference.
+
+This possible bug is found by an experimental static analysis tool
+developed by myself. This tool analyzes the locking APIs to extract
+function pairs that can be concurrently executed, and then analyzes the
+instructions in the paired functions to identify possible concurrency
+bugs including data races and atomicity violations. The above possible
+bug is reported, when my tool analyzes the source code of Linux 6.5.
+
+To fix this possible bug, "urb->hcpriv = NULL" should be executed with
+holding the lock "hsotg->lock". After using this patch, my tool never
+reports the possible bug, with the kernelconfiguration allyesconfig for
+x86_64. Because I have no associated hardware, I cannot test the patch
+in runtime testing, and just verify it according to the code logic.
+
+Fixes: 33ad261aa62b ("usb: dwc2: host: spinlock urb_enqueue")
+Signed-off-by: Jia-Ju Bai <baijiaju@buaa.edu.cn>
+Link: https://lore.kernel.org/r/20230926024404.832096-1-baijiaju@buaa.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 657f1f659ffaf..35c7a4df8e717 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -4769,8 +4769,8 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
+ if (qh_allocated && qh->channel && qh->channel->qh == qh)
+ qh->channel->qh = NULL;
+ fail2:
+- spin_unlock_irqrestore(&hsotg->lock, flags);
+ urb->hcpriv = NULL;
++ spin_unlock_irqrestore(&hsotg->lock, flags);
+ kfree(qtd);
+ fail1:
+ if (qh_allocated) {
+--
+2.42.0
+
--- /dev/null
+From c5fc92d57f3c233b57d0f683df47f6f7aed39782 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 13:29:23 +0300
+Subject: usb: host: xhci-plat: fix possible kernel oops while resuming
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit a5f928db59519a15e82ecba4ae3e7cbf5a44715a ]
+
+If this driver enables the xHC clocks while resuming from sleep, it calls
+clk_prepare_enable() without checking for errors and blithely goes on to
+read/write the xHC's registers -- which, with the xHC not being clocked,
+at least on ARM32 usually causes an imprecise external abort exceptions
+which cause kernel oops. Currently, the chips for which the driver does
+the clock dance on suspend/resume seem to be the Broadcom STB SoCs, based
+on ARM32 CPUs, as it seems...
+
+Found by Linux Verification Center (linuxtesting.org) with the Svace static
+analysis tool.
+
+Fixes: 8bd954c56197 ("usb: host: xhci-plat: suspend and resume clocks")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20231019102924.2797346-19-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-plat.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 5fb55bf194931..c9a101f0e8d01 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -456,23 +456,38 @@ static int __maybe_unused xhci_plat_resume(struct device *dev)
+ int ret;
+
+ if (!device_may_wakeup(dev) && (xhci->quirks & XHCI_SUSPEND_RESUME_CLKS)) {
+- clk_prepare_enable(xhci->clk);
+- clk_prepare_enable(xhci->reg_clk);
++ ret = clk_prepare_enable(xhci->clk);
++ if (ret)
++ return ret;
++
++ ret = clk_prepare_enable(xhci->reg_clk);
++ if (ret) {
++ clk_disable_unprepare(xhci->clk);
++ return ret;
++ }
+ }
+
+ ret = xhci_priv_resume_quirk(hcd);
+ if (ret)
+- return ret;
++ goto disable_clks;
+
+ ret = xhci_resume(xhci, 0);
+ if (ret)
+- return ret;
++ goto disable_clks;
+
+ pm_runtime_disable(dev);
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+
+ return 0;
++
++disable_clks:
++ if (!device_may_wakeup(dev) && (xhci->quirks & XHCI_SUSPEND_RESUME_CLKS)) {
++ clk_disable_unprepare(xhci->clk);
++ clk_disable_unprepare(xhci->reg_clk);
++ }
++
++ return ret;
+ }
+
+ static int __maybe_unused xhci_plat_runtime_suspend(struct device *dev)
+--
+2.42.0
+
--- /dev/null
+From d6d491d66b733af35a1cd661aa77c61b329a497f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 11:28:10 +0200
+Subject: USB: usbip: fix stub_dev hub disconnect
+
+From: Jonas Blixt <jonas.blixt@actia.se>
+
+[ Upstream commit 97475763484245916735a1aa9a3310a01d46b008 ]
+
+If a hub is disconnected that has device(s) that's attached to the usbip layer
+the disconnect function might fail because it tries to release the port
+on an already disconnected hub.
+
+Fixes: 6080cd0e9239 ("staging: usbip: claim ports used by shared devices")
+Signed-off-by: Jonas Blixt <jonas.blixt@actia.se>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20230615092810.1215490-1-jonas.blixt@actia.se
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/stub_dev.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
+index 3c6d452e3bf40..4104eea03e806 100644
+--- a/drivers/usb/usbip/stub_dev.c
++++ b/drivers/usb/usbip/stub_dev.c
+@@ -462,8 +462,13 @@ static void stub_disconnect(struct usb_device *udev)
+ /* release port */
+ rc = usb_hub_release_port(udev->parent, udev->portnum,
+ (struct usb_dev_state *) udev);
+- if (rc) {
+- dev_dbg(&udev->dev, "unable to release port\n");
++ /*
++ * NOTE: If a HUB disconnect triggered disconnect of the down stream
++ * device usb_hub_release_port will return -ENODEV so we can safely ignore
++ * that error here.
++ */
++ if (rc && (rc != -ENODEV)) {
++ dev_dbg(&udev->dev, "unable to release port (%i)\n", rc);
+ return;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From c85bc8729b40937684a17b195caf139c35c00129 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Oct 2023 20:57:04 -0500
+Subject: vfs: fix readahead(2) on block devices
+
+From: Reuben Hawkins <reubenhwk@gmail.com>
+
+[ Upstream commit 7116c0af4b8414b2f19fdb366eea213cbd9d91c2 ]
+
+Readahead was factored to call generic_fadvise. That refactor added an
+S_ISREG restriction which broke readahead on block devices.
+
+In addition to S_ISREG, this change checks S_ISBLK to fix block device
+readahead. There is no change in behavior with any file type besides block
+devices in this change.
+
+Fixes: 3d8f7615319b ("vfs: implement readahead(2) using POSIX_FADV_WILLNEED")
+Signed-off-by: Reuben Hawkins <reubenhwk@gmail.com>
+Link: https://lore.kernel.org/r/20231003015704.2415-1-reubenhwk@gmail.com
+Reviewed-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/readahead.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/mm/readahead.c b/mm/readahead.c
+index b10f0cf81d804..ba43428043a35 100644
+--- a/mm/readahead.c
++++ b/mm/readahead.c
+@@ -749,7 +749,8 @@ ssize_t ksys_readahead(int fd, loff_t offset, size_t count)
+ */
+ ret = -EINVAL;
+ if (!f.file->f_mapping || !f.file->f_mapping->a_ops ||
+- !S_ISREG(file_inode(f.file)->i_mode))
++ (!S_ISREG(file_inode(f.file)->i_mode) &&
++ !S_ISBLK(file_inode(f.file)->i_mode)))
+ goto out;
+
+ ret = vfs_fadvise(f.file, offset, count, POSIX_FADV_WILLNEED);
+--
+2.42.0
+
--- /dev/null
+From f34fc85bb804d4ebca5f5997c62335d1219c24ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Oct 2023 12:53:33 -0700
+Subject: virt: sevguest: Fix passing a stack buffer as a scatterlist target
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+[ Upstream commit db10cb9b574675402bfd8fe1a31aafdd45b002df ]
+
+CONFIG_DEBUG_SG highlights that get_{report,ext_report,derived_key)()}
+are passing stack buffers as the @req_buf argument to
+handle_guest_request(), generating a Call Trace of the following form:
+
+ WARNING: CPU: 0 PID: 1175 at include/linux/scatterlist.h:187 enc_dec_message+0x518/0x5b0 [sev_guest]
+ [..]
+ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
+ RIP: 0010:enc_dec_message+0x518/0x5b0 [sev_guest]
+ Call Trace:
+ <TASK>
+ [..]
+ handle_guest_request+0x135/0x520 [sev_guest]
+ get_ext_report+0x1ec/0x3e0 [sev_guest]
+ snp_guest_ioctl+0x157/0x200 [sev_guest]
+
+Note that the above Call Trace was with the DEBUG_SG BUG_ON()s converted
+to WARN_ON()s.
+
+This is benign as long as there are no hardware crypto accelerators
+loaded for the aead cipher, and no subsequent dma_map_sg() is performed
+on the scatterlist. However, sev-guest can not assume the presence of
+an aead accelerator nor can it assume that CONFIG_DEBUG_SG is disabled.
+
+Resolve this bug by allocating virt_addr_valid() memory, similar to the
+other buffers am @snp_dev instance carries, to marshal requests from
+user buffers to kernel buffers.
+
+Reported-by: Peter Gonda <pgonda@google.com>
+Closes: http://lore.kernel.org/r/CAMkAt6r2VPPMZ__SQfJse8qWsUyYW3AgYbOUVM0S_Vtk=KvkxQ@mail.gmail.com
+Fixes: fce96cf04430 ("virt: Add SEV-SNP guest driver")
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Dionna Glaze <dionnaglaze@google.com>
+Cc: Jeremi Piotrowski <jpiotrowski@linux.microsoft.com>
+Tested-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virt/coco/sev-guest/sev-guest.c | 45 ++++++++++++++-----------
+ 1 file changed, 25 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c
+index 5cdc972e5ef4a..c47e54b2a865e 100644
+--- a/drivers/virt/coco/sev-guest/sev-guest.c
++++ b/drivers/virt/coco/sev-guest/sev-guest.c
+@@ -57,6 +57,11 @@ struct snp_guest_dev {
+
+ struct snp_secrets_page_layout *layout;
+ struct snp_req_data input;
++ union {
++ struct snp_report_req report;
++ struct snp_derived_key_req derived_key;
++ struct snp_ext_report_req ext_report;
++ } req;
+ u32 *os_area_msg_seqno;
+ u8 *vmpck;
+ };
+@@ -475,8 +480,8 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code,
+ static int get_report(struct snp_guest_dev *snp_dev, struct snp_guest_request_ioctl *arg)
+ {
+ struct snp_guest_crypto *crypto = snp_dev->crypto;
++ struct snp_report_req *req = &snp_dev->req.report;
+ struct snp_report_resp *resp;
+- struct snp_report_req req;
+ int rc, resp_len;
+
+ lockdep_assert_held(&snp_cmd_mutex);
+@@ -484,7 +489,7 @@ static int get_report(struct snp_guest_dev *snp_dev, struct snp_guest_request_io
+ if (!arg->req_data || !arg->resp_data)
+ return -EINVAL;
+
+- if (copy_from_user(&req, (void __user *)arg->req_data, sizeof(req)))
++ if (copy_from_user(req, (void __user *)arg->req_data, sizeof(*req)))
+ return -EFAULT;
+
+ /*
+@@ -498,7 +503,7 @@ static int get_report(struct snp_guest_dev *snp_dev, struct snp_guest_request_io
+ return -ENOMEM;
+
+ rc = handle_guest_request(snp_dev, SVM_VMGEXIT_GUEST_REQUEST, arg,
+- SNP_MSG_REPORT_REQ, &req, sizeof(req), resp->data,
++ SNP_MSG_REPORT_REQ, req, sizeof(*req), resp->data,
+ resp_len);
+ if (rc)
+ goto e_free;
+@@ -513,9 +518,9 @@ static int get_report(struct snp_guest_dev *snp_dev, struct snp_guest_request_io
+
+ static int get_derived_key(struct snp_guest_dev *snp_dev, struct snp_guest_request_ioctl *arg)
+ {
++ struct snp_derived_key_req *req = &snp_dev->req.derived_key;
+ struct snp_guest_crypto *crypto = snp_dev->crypto;
+ struct snp_derived_key_resp resp = {0};
+- struct snp_derived_key_req req;
+ int rc, resp_len;
+ /* Response data is 64 bytes and max authsize for GCM is 16 bytes. */
+ u8 buf[64 + 16];
+@@ -534,11 +539,11 @@ static int get_derived_key(struct snp_guest_dev *snp_dev, struct snp_guest_reque
+ if (sizeof(buf) < resp_len)
+ return -ENOMEM;
+
+- if (copy_from_user(&req, (void __user *)arg->req_data, sizeof(req)))
++ if (copy_from_user(req, (void __user *)arg->req_data, sizeof(*req)))
+ return -EFAULT;
+
+ rc = handle_guest_request(snp_dev, SVM_VMGEXIT_GUEST_REQUEST, arg,
+- SNP_MSG_KEY_REQ, &req, sizeof(req), buf, resp_len);
++ SNP_MSG_KEY_REQ, req, sizeof(*req), buf, resp_len);
+ if (rc)
+ return rc;
+
+@@ -554,8 +559,8 @@ static int get_derived_key(struct snp_guest_dev *snp_dev, struct snp_guest_reque
+
+ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_request_ioctl *arg)
+ {
++ struct snp_ext_report_req *req = &snp_dev->req.ext_report;
+ struct snp_guest_crypto *crypto = snp_dev->crypto;
+- struct snp_ext_report_req req;
+ struct snp_report_resp *resp;
+ int ret, npages = 0, resp_len;
+
+@@ -564,18 +569,18 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques
+ if (!arg->req_data || !arg->resp_data)
+ return -EINVAL;
+
+- if (copy_from_user(&req, (void __user *)arg->req_data, sizeof(req)))
++ if (copy_from_user(req, (void __user *)arg->req_data, sizeof(*req)))
+ return -EFAULT;
+
+ /* userspace does not want certificate data */
+- if (!req.certs_len || !req.certs_address)
++ if (!req->certs_len || !req->certs_address)
+ goto cmd;
+
+- if (req.certs_len > SEV_FW_BLOB_MAX_SIZE ||
+- !IS_ALIGNED(req.certs_len, PAGE_SIZE))
++ if (req->certs_len > SEV_FW_BLOB_MAX_SIZE ||
++ !IS_ALIGNED(req->certs_len, PAGE_SIZE))
+ return -EINVAL;
+
+- if (!access_ok((const void __user *)req.certs_address, req.certs_len))
++ if (!access_ok((const void __user *)req->certs_address, req->certs_len))
+ return -EFAULT;
+
+ /*
+@@ -584,8 +589,8 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques
+ * the host. If host does not supply any certs in it, then copy
+ * zeros to indicate that certificate data was not provided.
+ */
+- memset(snp_dev->certs_data, 0, req.certs_len);
+- npages = req.certs_len >> PAGE_SHIFT;
++ memset(snp_dev->certs_data, 0, req->certs_len);
++ npages = req->certs_len >> PAGE_SHIFT;
+ cmd:
+ /*
+ * The intermediate response buffer is used while decrypting the
+@@ -599,14 +604,14 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques
+
+ snp_dev->input.data_npages = npages;
+ ret = handle_guest_request(snp_dev, SVM_VMGEXIT_EXT_GUEST_REQUEST, arg,
+- SNP_MSG_REPORT_REQ, &req.data,
+- sizeof(req.data), resp->data, resp_len);
++ SNP_MSG_REPORT_REQ, &req->data,
++ sizeof(req->data), resp->data, resp_len);
+
+ /* If certs length is invalid then copy the returned length */
+ if (arg->vmm_error == SNP_GUEST_VMM_ERR_INVALID_LEN) {
+- req.certs_len = snp_dev->input.data_npages << PAGE_SHIFT;
++ req->certs_len = snp_dev->input.data_npages << PAGE_SHIFT;
+
+- if (copy_to_user((void __user *)arg->req_data, &req, sizeof(req)))
++ if (copy_to_user((void __user *)arg->req_data, req, sizeof(*req)))
+ ret = -EFAULT;
+ }
+
+@@ -614,8 +619,8 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques
+ goto e_free;
+
+ if (npages &&
+- copy_to_user((void __user *)req.certs_address, snp_dev->certs_data,
+- req.certs_len)) {
++ copy_to_user((void __user *)req->certs_address, snp_dev->certs_data,
++ req->certs_len)) {
+ ret = -EFAULT;
+ goto e_free;
+ }
+--
+2.42.0
+
--- /dev/null
+From 1497301de7f725a38465cd7640e13e254c5b94cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Sep 2023 07:54:47 +0300
+Subject: wifi: ath: dfs_pattern_detector: Fix a memory initialization issue
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 79bd60ee87e1136718a686d6617ced5de88ee350 ]
+
+If an error occurs and channel_detector_exit() is called, it relies on
+entries of the 'detectors' array to be NULL.
+Otherwise, it may access to un-initialized memory.
+
+Fix it and initialize the memory, as what was done before the commit in
+Fixes.
+
+Fixes: a063b650ce5d ("ath: dfs_pattern_detector: Avoid open coded arithmetic in memory allocation")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/ad8c55b97ee4b330cb053ce2c448123c309cc91c.1695538105.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/dfs_pattern_detector.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
+index 27f4d74a41c80..2788a1b06c17c 100644
+--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
++++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
+@@ -206,7 +206,7 @@ channel_detector_create(struct dfs_pattern_detector *dpd, u16 freq)
+
+ INIT_LIST_HEAD(&cd->head);
+ cd->freq = freq;
+- cd->detectors = kmalloc_array(dpd->num_radar_types,
++ cd->detectors = kcalloc(dpd->num_radar_types,
+ sizeof(*cd->detectors), GFP_ATOMIC);
+ if (cd->detectors == NULL)
+ goto fail;
+--
+2.42.0
+
--- /dev/null
+From f888d14c412e74fe9582b62b51fa1d6d35223112 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 09:56:06 +0800
+Subject: wifi: ath11k: fix boot failure with one MSI vector
+
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+
+[ Upstream commit 39564b475ac5a589e6c22c43a08cbd283c295d2c ]
+
+Commit 5b32b6dd96633 ("ath11k: Remove core PCI references from
+PCI common code") breaks with one MSI vector because it moves
+affinity setting after IRQ request, see below log:
+
+[ 1417.278835] ath11k_pci 0000:02:00.0: failed to receive control response completion, polling..
+[ 1418.302829] ath11k_pci 0000:02:00.0: Service connect timeout
+[ 1418.302833] ath11k_pci 0000:02:00.0: failed to connect to HTT: -110
+[ 1418.303669] ath11k_pci 0000:02:00.0: failed to start core: -110
+
+The detail is, if do affinity request after IRQ activated,
+which is done in request_irq(), kernel caches that request and
+returns success directly. Later when a subsequent MHI interrupt is
+fired, kernel will do the real affinity setting work, as a result,
+changs the MSI vector. However at that time host has configured
+old vector to hardware, so host never receives CE or DP interrupts.
+
+Fix it by setting affinity before registering MHI controller
+where host is, for the first time, doing IRQ request.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1
+
+Fixes: 5b32b6dd9663 ("ath11k: Remove core PCI references from PCI common code")
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230907015606.16297-1-quic_bqiang@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/pci.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/pci.c b/drivers/net/wireless/ath/ath11k/pci.c
+index 3953ebd551bf8..79d2876a46b53 100644
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -853,10 +853,16 @@ static int ath11k_pci_probe(struct pci_dev *pdev,
+ if (ret)
+ goto err_pci_disable_msi;
+
++ ret = ath11k_pci_set_irq_affinity_hint(ab_pci, cpumask_of(0));
++ if (ret) {
++ ath11k_err(ab, "failed to set irq affinity %d\n", ret);
++ goto err_pci_disable_msi;
++ }
++
+ ret = ath11k_mhi_register(ab_pci);
+ if (ret) {
+ ath11k_err(ab, "failed to register mhi: %d\n", ret);
+- goto err_pci_disable_msi;
++ goto err_irq_affinity_cleanup;
+ }
+
+ ret = ath11k_hal_srng_init(ab);
+@@ -877,12 +883,6 @@ static int ath11k_pci_probe(struct pci_dev *pdev,
+ goto err_ce_free;
+ }
+
+- ret = ath11k_pci_set_irq_affinity_hint(ab_pci, cpumask_of(0));
+- if (ret) {
+- ath11k_err(ab, "failed to set irq affinity %d\n", ret);
+- goto err_free_irq;
+- }
+-
+ /* kernel may allocate a dummy vector before request_irq and
+ * then allocate a real vector when request_irq is called.
+ * So get msi_data here again to avoid spurious interrupt
+@@ -891,19 +891,16 @@ static int ath11k_pci_probe(struct pci_dev *pdev,
+ ret = ath11k_pci_config_msi_data(ab_pci);
+ if (ret) {
+ ath11k_err(ab, "failed to config msi_data: %d\n", ret);
+- goto err_irq_affinity_cleanup;
++ goto err_free_irq;
+ }
+
+ ret = ath11k_core_init(ab);
+ if (ret) {
+ ath11k_err(ab, "failed to init core: %d\n", ret);
+- goto err_irq_affinity_cleanup;
++ goto err_free_irq;
+ }
+ return 0;
+
+-err_irq_affinity_cleanup:
+- ath11k_pci_set_irq_affinity_hint(ab_pci, NULL);
+-
+ err_free_irq:
+ ath11k_pcic_free_irq(ab);
+
+@@ -916,6 +913,9 @@ static int ath11k_pci_probe(struct pci_dev *pdev,
+ err_mhi_unregister:
+ ath11k_mhi_unregister(ab_pci);
+
++err_irq_affinity_cleanup:
++ ath11k_pci_set_irq_affinity_hint(ab_pci, NULL);
++
+ err_pci_disable_msi:
+ ath11k_pci_free_msi(ab_pci);
+
+--
+2.42.0
+
--- /dev/null
+From a1d930be6e107e4bebd6e1996b86d7726f600dbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 17:26:54 +0300
+Subject: wifi: ath11k: fix Tx power value during active CAC
+
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+
+[ Upstream commit 77f1ee6fd8b6e470f721d05a2e269039d5cafcb7 ]
+
+Tx power is fetched from firmware's pdev stats. However, during active
+CAC, firmware does not fill the current Tx power and sends the max
+initialised value filled during firmware init. If host sends this power
+to user space, this is wrong since in certain situations, the Tx power
+could be greater than the max allowed by the regulatory. Hence, host
+should not be fetching the Tx power during an active CAC.
+
+Fix this issue by returning -EAGAIN error so that user space knows that there's
+no valid value available.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Fixes: 9a2aa68afe3d ("wifi: ath11k: add get_txpower mac ops")
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230912051857.2284-4-quic_adisi@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
+index cb77dd6ce9665..21c6b36dc6ebb 100644
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -8549,6 +8549,14 @@ static int ath11k_mac_op_get_txpower(struct ieee80211_hw *hw,
+ if (ar->state != ATH11K_STATE_ON)
+ goto err_fallback;
+
++ /* Firmware doesn't provide Tx power during CAC hence no need to fetch
++ * the stats.
++ */
++ if (test_bit(ATH11K_CAC_RUNNING, &ar->dev_flags)) {
++ mutex_unlock(&ar->conf_mutex);
++ return -EAGAIN;
++ }
++
+ req_param.pdev_id = ar->pdev->pdev_id;
+ req_param.stats_id = WMI_REQUEST_PDEV_STAT;
+
+--
+2.42.0
+
--- /dev/null
+From 773b88118cbd380aadf7c23a643f77774ed07ad0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 13:59:33 +0200
+Subject: wifi: cfg80211: add flush functions for wiphy work
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 56cfb8ce1f7f6c4e5ca571a2ec0880e131cd0311 ]
+
+There may be sometimes reasons to actually run the work
+if it's pending, add flush functions for both regular and
+delayed wiphy work that will do this.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Stable-dep-of: eadfb54756ae ("wifi: mac80211: move sched-scan stop work to wiphy work")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cfg80211.h | 21 +++++++++++++++++++++
+ net/wireless/core.c | 34 ++++++++++++++++++++++++++++++++--
+ net/wireless/core.h | 3 ++-
+ net/wireless/sysfs.c | 4 ++--
+ 4 files changed, 57 insertions(+), 5 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 7a6c3059d50b5..a6d7f05fd0145 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -5690,6 +5690,16 @@ void wiphy_work_queue(struct wiphy *wiphy, struct wiphy_work *work);
+ */
+ void wiphy_work_cancel(struct wiphy *wiphy, struct wiphy_work *work);
+
++/**
++ * wiphy_work_flush - flush previously queued work
++ * @wiphy: the wiphy, for debug purposes
++ * @work: the work to flush, this can be %NULL to flush all work
++ *
++ * Flush the work (i.e. run it if pending). This must be called
++ * under the wiphy mutex acquired by wiphy_lock().
++ */
++void wiphy_work_flush(struct wiphy *wiphy, struct wiphy_work *work);
++
+ struct wiphy_delayed_work {
+ struct wiphy_work work;
+ struct wiphy *wiphy;
+@@ -5733,6 +5743,17 @@ void wiphy_delayed_work_queue(struct wiphy *wiphy,
+ void wiphy_delayed_work_cancel(struct wiphy *wiphy,
+ struct wiphy_delayed_work *dwork);
+
++/**
++ * wiphy_delayed work_flush - flush previously queued delayed work
++ * @wiphy: the wiphy, for debug purposes
++ * @work: the work to flush
++ *
++ * Flush the work (i.e. run it if pending). This must be called
++ * under the wiphy mutex acquired by wiphy_lock().
++ */
++void wiphy_delayed_work_flush(struct wiphy *wiphy,
++ struct wiphy_delayed_work *dwork);
++
+ /**
+ * struct wireless_dev - wireless device state
+ *
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index bf2f1f583fb12..63d75fecc2c53 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -1042,7 +1042,8 @@ void wiphy_rfkill_start_polling(struct wiphy *wiphy)
+ }
+ EXPORT_SYMBOL(wiphy_rfkill_start_polling);
+
+-void cfg80211_process_wiphy_works(struct cfg80211_registered_device *rdev)
++void cfg80211_process_wiphy_works(struct cfg80211_registered_device *rdev,
++ struct wiphy_work *end)
+ {
+ unsigned int runaway_limit = 100;
+ unsigned long flags;
+@@ -1061,6 +1062,10 @@ void cfg80211_process_wiphy_works(struct cfg80211_registered_device *rdev)
+ wk->func(&rdev->wiphy, wk);
+
+ spin_lock_irqsave(&rdev->wiphy_work_lock, flags);
++
++ if (wk == end)
++ break;
++
+ if (WARN_ON(--runaway_limit == 0))
+ INIT_LIST_HEAD(&rdev->wiphy_work_list);
+ }
+@@ -1111,7 +1116,7 @@ void wiphy_unregister(struct wiphy *wiphy)
+ #endif
+
+ /* surely nothing is reachable now, clean up work */
+- cfg80211_process_wiphy_works(rdev);
++ cfg80211_process_wiphy_works(rdev, NULL);
+ wiphy_unlock(&rdev->wiphy);
+ rtnl_unlock();
+
+@@ -1636,6 +1641,21 @@ void wiphy_work_cancel(struct wiphy *wiphy, struct wiphy_work *work)
+ }
+ EXPORT_SYMBOL_GPL(wiphy_work_cancel);
+
++void wiphy_work_flush(struct wiphy *wiphy, struct wiphy_work *work)
++{
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++ unsigned long flags;
++ bool run;
++
++ spin_lock_irqsave(&rdev->wiphy_work_lock, flags);
++ run = !work || !list_empty(&work->entry);
++ spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags);
++
++ if (run)
++ cfg80211_process_wiphy_works(rdev, work);
++}
++EXPORT_SYMBOL_GPL(wiphy_work_flush);
++
+ void wiphy_delayed_work_timer(struct timer_list *t)
+ {
+ struct wiphy_delayed_work *dwork = from_timer(dwork, t, timer);
+@@ -1668,6 +1688,16 @@ void wiphy_delayed_work_cancel(struct wiphy *wiphy,
+ }
+ EXPORT_SYMBOL_GPL(wiphy_delayed_work_cancel);
+
++void wiphy_delayed_work_flush(struct wiphy *wiphy,
++ struct wiphy_delayed_work *dwork)
++{
++ lockdep_assert_held(&wiphy->mtx);
++
++ del_timer_sync(&dwork->timer);
++ wiphy_work_flush(wiphy, &dwork->work);
++}
++EXPORT_SYMBOL_GPL(wiphy_delayed_work_flush);
++
+ static int __init cfg80211_init(void)
+ {
+ int err;
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index 86fd79912254d..e1accacc6f233 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -461,7 +461,8 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
+ struct net_device *dev, enum nl80211_iftype ntype,
+ struct vif_params *params);
+ void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
+-void cfg80211_process_wiphy_works(struct cfg80211_registered_device *rdev);
++void cfg80211_process_wiphy_works(struct cfg80211_registered_device *rdev,
++ struct wiphy_work *end);
+ void cfg80211_process_wdev_events(struct wireless_dev *wdev);
+
+ bool cfg80211_does_bw_fit_range(const struct ieee80211_freq_range *freq_range,
+diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
+index 4d3b658030105..a88f338c61d31 100644
+--- a/net/wireless/sysfs.c
++++ b/net/wireless/sysfs.c
+@@ -105,14 +105,14 @@ static int wiphy_suspend(struct device *dev)
+ cfg80211_leave_all(rdev);
+ cfg80211_process_rdev_events(rdev);
+ }
+- cfg80211_process_wiphy_works(rdev);
++ cfg80211_process_wiphy_works(rdev, NULL);
+ if (rdev->ops->suspend)
+ ret = rdev_suspend(rdev, rdev->wiphy.wowlan_config);
+ if (ret == 1) {
+ /* Driver refuse to configure wowlan */
+ cfg80211_leave_all(rdev);
+ cfg80211_process_rdev_events(rdev);
+- cfg80211_process_wiphy_works(rdev);
++ cfg80211_process_wiphy_works(rdev, NULL);
+ ret = rdev_suspend(rdev, NULL);
+ }
+ if (ret == 0)
+--
+2.42.0
+
--- /dev/null
+From ade3f68e8e622c752b91e8e91f122a07efba3220 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 15:47:26 +0300
+Subject: wifi: iwlwifi: call napi_synchronize() before freeing rx/tx queues
+
+From: Gregory Greenman <gregory.greenman@intel.com>
+
+[ Upstream commit 5af2bb3168db6b0af9988eb25cccf2e3bc4455e2 ]
+
+When rx/tx queues are being freed, on a different CPU there could be
+still rx flow running. Call napi_synchronize() to prevent such a race.
+
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Co-developed-by: Benjamin Berg <benjamin.berg@intel.com>
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Link: https://lore.kernel.org/r/20230416154301.5171ee44dcc1.Iff18718540da412e084e7d8266447d40730600ed@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Stable-dep-of: 37fb29bd1f90 ("wifi: iwlwifi: pcie: synchronize IRQs before NAPI")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/pcie/internal.h | 1 +
+ drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 18 +++++++++++++++++-
+ .../wireless/intel/iwlwifi/pcie/trans-gen2.c | 1 +
+ .../net/wireless/intel/iwlwifi/pcie/trans.c | 1 +
+ 4 files changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+index f7e4f868363df..69b95ad5993b0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+@@ -497,6 +497,7 @@ int iwl_pcie_rx_stop(struct iwl_trans *trans);
+ void iwl_pcie_rx_free(struct iwl_trans *trans);
+ void iwl_pcie_free_rbs_pool(struct iwl_trans *trans);
+ void iwl_pcie_rx_init_rxb_lists(struct iwl_rxq *rxq);
++void iwl_pcie_rx_napi_sync(struct iwl_trans *trans);
+ void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans, gfp_t priority,
+ struct iwl_rxq *rxq);
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index b455e981faa1f..90a46faaaffdf 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
+ /*
+- * Copyright (C) 2003-2014, 2018-2022 Intel Corporation
++ * Copyright (C) 2003-2014, 2018-2023 Intel Corporation
+ * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
+ * Copyright (C) 2016-2017 Intel Deutschland GmbH
+ */
+@@ -1053,6 +1053,22 @@ static int iwl_pcie_napi_poll_msix(struct napi_struct *napi, int budget)
+ return ret;
+ }
+
++void iwl_pcie_rx_napi_sync(struct iwl_trans *trans)
++{
++ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++ int i;
++
++ if (unlikely(!trans_pcie->rxq))
++ return;
++
++ for (i = 0; i < trans->num_rx_queues; i++) {
++ struct iwl_rxq *rxq = &trans_pcie->rxq[i];
++
++ if (rxq && rxq->napi.poll)
++ napi_synchronize(&rxq->napi);
++ }
++}
++
+ static int _iwl_pcie_rx_init(struct iwl_trans *trans)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+index 94f40c4d24217..6d2cbbd256064 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+@@ -156,6 +156,7 @@ void _iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans)
+ if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+ IWL_DEBUG_INFO(trans,
+ "DEVICE_ENABLED bit was set and is now cleared\n");
++ iwl_pcie_rx_napi_sync(trans);
+ iwl_txq_gen2_tx_free(trans);
+ iwl_pcie_rx_stop(trans);
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 8e95225cdd605..e6a3dfd550257 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1261,6 +1261,7 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans)
+ if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+ IWL_DEBUG_INFO(trans,
+ "DEVICE_ENABLED bit was set and is now cleared\n");
++ iwl_pcie_rx_napi_sync(trans);
+ iwl_pcie_tx_stop(trans);
+ iwl_pcie_rx_stop(trans);
+
+--
+2.42.0
+
--- /dev/null
+From e93ea1720097c9da7cd68479cae6b49e0407e51c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Oct 2023 17:55:51 +0300
+Subject: wifi: iwlwifi: empty overflow queue during flush
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 658939fc68d3241f9a0019e224cd7154438c23f2 ]
+
+If a TX queue has no space for new TX frames, the driver will keep
+these frames in the overflow queue, and during reclaim flow it
+will retry to send the frames from that queue.
+But if the reclaim flow was invoked from TX queue flush, we will also
+TX these frames, which is wrong as we don't want to TX anything
+after flush.
+This might also cause assert 0x125F when removing the queue,
+saying that the driver removes a non-empty queue
+Fix this by TXing the overflow queue's frames only if we are
+not in flush queue flow.
+
+Fixes: a44509805895 ("iwlwifi: move reclaim flows to the queue file")
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20231022173519.caf06c8709d9.Ibf664ccb3f952e836f8fa461ea58fc08e5c46e88@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/dvm/tx.c | 5 +++--
+ drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 7 ++++---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 4 ++--
+ drivers/net/wireless/intel/iwlwifi/queue/tx.c | 9 +++++----
+ drivers/net/wireless/intel/iwlwifi/queue/tx.h | 2 +-
+ 5 files changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+index 60a7b61d59aa3..ca1daec641c4f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+@@ -3,6 +3,7 @@
+ *
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+ * Copyright (C) 2019 Intel Corporation
++ * Copyright (C) 2023 Intel Corporation
+ *****************************************************************************/
+
+ #include <linux/kernel.h>
+@@ -1169,7 +1170,7 @@ void iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb)
+ iwlagn_check_ratid_empty(priv, sta_id, tid);
+ }
+
+- iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
++ iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs, false);
+
+ freed = 0;
+
+@@ -1315,7 +1316,7 @@ void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
+ * block-ack window (we assume that they've been successfully
+ * transmitted ... if not, it's too late anyway). */
+ iwl_trans_reclaim(priv->trans, scd_flow, ba_resp_scd_ssn,
+- &reclaimed_skbs);
++ &reclaimed_skbs, false);
+
+ IWL_DEBUG_TX_REPLY(priv, "REPLY_COMPRESSED_BA [%d] Received from %pM, "
+ "sta_id = %d\n",
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+index c9729e2718dc0..70022cadee35b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+@@ -567,7 +567,7 @@ struct iwl_trans_ops {
+ int (*tx)(struct iwl_trans *trans, struct sk_buff *skb,
+ struct iwl_device_tx_cmd *dev_cmd, int queue);
+ void (*reclaim)(struct iwl_trans *trans, int queue, int ssn,
+- struct sk_buff_head *skbs);
++ struct sk_buff_head *skbs, bool is_flush);
+
+ void (*set_q_ptrs)(struct iwl_trans *trans, int queue, int ptr);
+
+@@ -1191,14 +1191,15 @@ static inline int iwl_trans_tx(struct iwl_trans *trans, struct sk_buff *skb,
+ }
+
+ static inline void iwl_trans_reclaim(struct iwl_trans *trans, int queue,
+- int ssn, struct sk_buff_head *skbs)
++ int ssn, struct sk_buff_head *skbs,
++ bool is_flush)
+ {
+ if (WARN_ON_ONCE(trans->state != IWL_TRANS_FW_ALIVE)) {
+ IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
+ return;
+ }
+
+- trans->ops->reclaim(trans, queue, ssn, skbs);
++ trans->ops->reclaim(trans, queue, ssn, skbs, is_flush);
+ }
+
+ static inline void iwl_trans_set_q_ptrs(struct iwl_trans *trans, int queue,
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 9804112ea4f79..caaf4d52e2c64 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -1576,7 +1576,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ seq_ctl = le16_to_cpu(tx_resp->seq_ctl);
+
+ /* we can free until ssn % q.n_bd not inclusive */
+- iwl_trans_reclaim(mvm->trans, txq_id, ssn, &skbs);
++ iwl_trans_reclaim(mvm->trans, txq_id, ssn, &skbs, false);
+
+ while (!skb_queue_empty(&skbs)) {
+ struct sk_buff *skb = __skb_dequeue(&skbs);
+@@ -1927,7 +1927,7 @@ static void iwl_mvm_tx_reclaim(struct iwl_mvm *mvm, int sta_id, int tid,
+ * block-ack window (we assume that they've been successfully
+ * transmitted ... if not, it's too late anyway).
+ */
+- iwl_trans_reclaim(mvm->trans, txq, index, &reclaimed_skbs);
++ iwl_trans_reclaim(mvm->trans, txq, index, &reclaimed_skbs, is_flush);
+
+ skb_queue_walk(&reclaimed_skbs, skb) {
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+diff --git a/drivers/net/wireless/intel/iwlwifi/queue/tx.c b/drivers/net/wireless/intel/iwlwifi/queue/tx.c
+index 726185d6fab8b..8cf206837eeea 100644
+--- a/drivers/net/wireless/intel/iwlwifi/queue/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/queue/tx.c
+@@ -1551,7 +1551,7 @@ void iwl_txq_progress(struct iwl_txq *txq)
+
+ /* Frees buffers until index _not_ inclusive */
+ void iwl_txq_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
+- struct sk_buff_head *skbs)
++ struct sk_buff_head *skbs, bool is_flush)
+ {
+ struct iwl_txq *txq = trans->txqs.txq[txq_id];
+ int tfd_num = iwl_txq_get_cmd_index(txq, ssn);
+@@ -1622,9 +1622,11 @@ void iwl_txq_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
+ if (iwl_txq_space(trans, txq) > txq->low_mark &&
+ test_bit(txq_id, trans->txqs.queue_stopped)) {
+ struct sk_buff_head overflow_skbs;
++ struct sk_buff *skb;
+
+ __skb_queue_head_init(&overflow_skbs);
+- skb_queue_splice_init(&txq->overflow_q, &overflow_skbs);
++ skb_queue_splice_init(&txq->overflow_q,
++ is_flush ? skbs : &overflow_skbs);
+
+ /*
+ * We are going to transmit from the overflow queue.
+@@ -1644,8 +1646,7 @@ void iwl_txq_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
+ */
+ spin_unlock_bh(&txq->lock);
+
+- while (!skb_queue_empty(&overflow_skbs)) {
+- struct sk_buff *skb = __skb_dequeue(&overflow_skbs);
++ while ((skb = __skb_dequeue(&overflow_skbs))) {
+ struct iwl_device_tx_cmd *dev_cmd_ptr;
+
+ dev_cmd_ptr = *(void **)((u8 *)skb->cb +
+diff --git a/drivers/net/wireless/intel/iwlwifi/queue/tx.h b/drivers/net/wireless/intel/iwlwifi/queue/tx.h
+index eca53bfd326d1..ceb6812fe20b2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/queue/tx.h
++++ b/drivers/net/wireless/intel/iwlwifi/queue/tx.h
+@@ -173,7 +173,7 @@ void iwl_txq_gen1_update_byte_cnt_tbl(struct iwl_trans *trans,
+ struct iwl_txq *txq, u16 byte_cnt,
+ int num_tbs);
+ void iwl_txq_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
+- struct sk_buff_head *skbs);
++ struct sk_buff_head *skbs, bool is_flush);
+ void iwl_txq_set_q_ptrs(struct iwl_trans *trans, int txq_id, int ptr);
+ void iwl_trans_txq_freeze_timer(struct iwl_trans *trans, unsigned long txqs,
+ bool freeze);
+--
+2.42.0
+
--- /dev/null
+From 817f1a57e38c76a549d9f3a3ff0b3b32710d7985 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Aug 2023 11:30:52 +0300
+Subject: wifi: iwlwifi: honor the enable_ini value
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit e0c1ca236e28e4263fba76d47a108ed95dcae33e ]
+
+In case the user sets the enable_ini to some preset, we want to honor
+the value.
+
+Remove the ops to set the value of the module parameter is runtime, we
+don't want to allow to modify the value in runtime since we configure
+the firmware once at the beginning on its life.
+
+Fixes: b49c2b252b58 ("iwlwifi: Configure FW debug preset via module param.")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230830112059.5734e0f374bb.I6698eda8ed2112378dd47ac5d62866ebe7a94f77@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/intel/iwlwifi/fw/api/dbg-tlv.h | 1 +
+ .../net/wireless/intel/iwlwifi/iwl-dbg-tlv.h | 5 +-
+ drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 51 +++++++------------
+ .../net/wireless/intel/iwlwifi/iwl-trans.h | 4 ++
+ 4 files changed, 25 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h b/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h
+index ba538d70985f4..39bee9c00e071 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h
+@@ -13,6 +13,7 @@
+ #define IWL_FW_INI_DOMAIN_ALWAYS_ON 0
+ #define IWL_FW_INI_REGION_ID_MASK GENMASK(15, 0)
+ #define IWL_FW_INI_REGION_DUMP_POLICY_MASK GENMASK(31, 16)
++#define IWL_FW_INI_PRESET_DISABLE 0xff
+
+ /**
+ * struct iwl_fw_ini_hcmd
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.h b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.h
+index 128059ca77e60..06fb7d6653905 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
+ /*
+- * Copyright (C) 2018-2022 Intel Corporation
++ * Copyright (C) 2018-2023 Intel Corporation
+ */
+ #ifndef __iwl_dbg_tlv_h__
+ #define __iwl_dbg_tlv_h__
+@@ -10,7 +10,8 @@
+ #include <fw/file.h>
+ #include <fw/api/dbg-tlv.h>
+
+-#define IWL_DBG_TLV_MAX_PRESET 15
++#define IWL_DBG_TLV_MAX_PRESET 15
++#define ENABLE_INI (IWL_DBG_TLV_MAX_PRESET + 1)
+
+ /**
+ * struct iwl_dbg_tlv_node - debug TLV node
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+index a2203f661321c..5eba1a355f043 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+@@ -1722,6 +1722,22 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans)
+ #endif
+
+ drv->trans->dbg.domains_bitmap = IWL_TRANS_FW_DBG_DOMAIN(drv->trans);
++ if (iwlwifi_mod_params.enable_ini != ENABLE_INI) {
++ /* We have a non-default value in the module parameter,
++ * take its value
++ */
++ drv->trans->dbg.domains_bitmap &= 0xffff;
++ if (iwlwifi_mod_params.enable_ini != IWL_FW_INI_PRESET_DISABLE) {
++ if (iwlwifi_mod_params.enable_ini > ENABLE_INI) {
++ IWL_ERR(trans,
++ "invalid enable_ini module parameter value: max = %d, using 0 instead\n",
++ ENABLE_INI);
++ iwlwifi_mod_params.enable_ini = 0;
++ }
++ drv->trans->dbg.domains_bitmap =
++ BIT(IWL_FW_DBG_DOMAIN_POS + iwlwifi_mod_params.enable_ini);
++ }
++ }
+
+ ret = iwl_request_firmware(drv, true);
+ if (ret) {
+@@ -1770,8 +1786,6 @@ void iwl_drv_stop(struct iwl_drv *drv)
+ kfree(drv);
+ }
+
+-#define ENABLE_INI (IWL_DBG_TLV_MAX_PRESET + 1)
+-
+ /* shared module parameters */
+ struct iwl_mod_params iwlwifi_mod_params = {
+ .fw_restart = true,
+@@ -1891,38 +1905,7 @@ module_param_named(uapsd_disable, iwlwifi_mod_params.uapsd_disable, uint, 0644);
+ MODULE_PARM_DESC(uapsd_disable,
+ "disable U-APSD functionality bitmap 1: BSS 2: P2P Client (default: 3)");
+
+-static int enable_ini_set(const char *arg, const struct kernel_param *kp)
+-{
+- int ret = 0;
+- bool res;
+- __u32 new_enable_ini;
+-
+- /* in case the argument type is a number */
+- ret = kstrtou32(arg, 0, &new_enable_ini);
+- if (!ret) {
+- if (new_enable_ini > ENABLE_INI) {
+- pr_err("enable_ini cannot be %d, in range 0-16\n", new_enable_ini);
+- return -EINVAL;
+- }
+- goto out;
+- }
+-
+- /* in case the argument type is boolean */
+- ret = kstrtobool(arg, &res);
+- if (ret)
+- return ret;
+- new_enable_ini = (res ? ENABLE_INI : 0);
+-
+-out:
+- iwlwifi_mod_params.enable_ini = new_enable_ini;
+- return 0;
+-}
+-
+-static const struct kernel_param_ops enable_ini_ops = {
+- .set = enable_ini_set
+-};
+-
+-module_param_cb(enable_ini, &enable_ini_ops, &iwlwifi_mod_params.enable_ini, 0644);
++module_param_named(enable_ini, iwlwifi_mod_params.enable_ini, uint, 0444);
+ MODULE_PARM_DESC(enable_ini,
+ "0:disable, 1-15:FW_DBG_PRESET Values, 16:enabled without preset value defined,"
+ "Debug INI TLV FW debug infrastructure (default: 16)");
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+index d659ccd065f78..c9729e2718dc0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+@@ -56,6 +56,10 @@
+ * 6) Eventually, the free function will be called.
+ */
+
++/* default preset 0 (start from bit 16)*/
++#define IWL_FW_DBG_DOMAIN_POS 16
++#define IWL_FW_DBG_DOMAIN BIT(IWL_FW_DBG_DOMAIN_POS)
++
+ #define IWL_TRANS_FW_DBG_DOMAIN(trans) IWL_FW_INI_DOMAIN_ALWAYS_ON
+
+ #define FH_RSCSR_FRAME_SIZE_MSK 0x00003FFF /* bits 0-13 */
+--
+2.42.0
+
--- /dev/null
+From af7895d90c7c7320eeea499f3e2013f25fa132d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 12:16:43 +0300
+Subject: wifi: iwlwifi: pcie: synchronize IRQs before NAPI
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 37fb29bd1f90f16d1abc95c0e9f0ff8eec9829ad ]
+
+When we want to synchronize the NAPI, which was added in
+commit 5af2bb3168db ("wifi: iwlwifi: call napi_synchronize()
+before freeing rx/tx queues"), we also need to make sure we
+can't actually reschedule the NAPI. Yes, this happens while
+interrupts are disabled, but interrupts may still be running
+or pending. Also call iwl_pcie_synchronize_irqs() to ensure
+we won't reschedule the NAPI.
+
+Fixes: 4cf2f5904d97 ("iwlwifi: queue: avoid memory leak in reset flow")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20231017115047.a0f4104b479a.Id5c50a944f709092aa6256e32d8c63b2b8d8d3ac@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 1 +
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+index 6d2cbbd256064..8b9e4b9c5a2e9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+@@ -156,6 +156,7 @@ void _iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans)
+ if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+ IWL_DEBUG_INFO(trans,
+ "DEVICE_ENABLED bit was set and is now cleared\n");
++ iwl_pcie_synchronize_irqs(trans);
+ iwl_pcie_rx_napi_sync(trans);
+ iwl_txq_gen2_tx_free(trans);
+ iwl_pcie_rx_stop(trans);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index e6a3dfd550257..39ab6526e6b85 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1261,6 +1261,7 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans)
+ if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+ IWL_DEBUG_INFO(trans,
+ "DEVICE_ENABLED bit was set and is now cleared\n");
++ iwl_pcie_synchronize_irqs(trans);
+ iwl_pcie_rx_napi_sync(trans);
+ iwl_pcie_tx_stop(trans);
+ iwl_pcie_rx_stop(trans);
+--
+2.42.0
+
--- /dev/null
+From a886066cf838d993cf98867a6da57bb00c41c3c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 14:56:45 +0300
+Subject: wifi: iwlwifi: Use FW rate for non-data frames
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 499d02790495958506a64f37ceda7e97345a50a8 ]
+
+Currently we are setting the rate in the tx cmd for
+mgmt frames (e.g. during connection establishment).
+This was problematic when sending mgmt frames in eSR mode,
+as we don't know what link this frame will be sent on
+(This is decided by the FW), so we don't know what is the
+lowest rate.
+Fix this by not setting the rate in tx cmd and rely
+on FW to choose the right one.
+Set rate only for injected frames with fixed rate,
+or when no sta is given.
+Also set for important frames (EAPOL etc.) the High Priority flag.
+
+Fixes: 055b22e770dd ("iwlwifi: mvm: Set Tx rate and flags when there is not station")
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230913145231.6c7e59620ee0.I6eaed3ccdd6dd62b9e664facc484081fc5275843@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 2d01f6226b7c6..9804112ea4f79 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -524,16 +524,20 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb,
+ flags |= IWL_TX_FLAGS_ENCRYPT_DIS;
+
+ /*
+- * For data packets rate info comes from the fw. Only
+- * set rate/antenna during connection establishment or in case
+- * no station is given.
++ * For data and mgmt packets rate info comes from the fw. Only
++ * set rate/antenna for injected frames with fixed rate, or
++ * when no sta is given.
+ */
+- if (!sta || !ieee80211_is_data(hdr->frame_control) ||
+- mvmsta->sta_state < IEEE80211_STA_AUTHORIZED) {
++ if (unlikely(!sta ||
++ info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)) {
+ flags |= IWL_TX_FLAGS_CMD_RATE;
+ rate_n_flags =
+ iwl_mvm_get_tx_rate_n_flags(mvm, info, sta,
+ hdr->frame_control);
++ } else if (!ieee80211_is_data(hdr->frame_control) ||
++ mvmsta->sta_state < IEEE80211_STA_AUTHORIZED) {
++ /* These are important frames */
++ flags |= IWL_TX_FLAGS_HIGH_PRI;
+ }
+
+ if (mvm->trans->trans_cfg->device_family >=
+--
+2.42.0
+
--- /dev/null
+From d8fbcceb2831210a63acbaf2c30abf2f38778794 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Aug 2023 14:05:28 +0300
+Subject: wifi: mac80211: fix # of MSDU in A-MSDU calculation
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 428e8976a15f849ad92b1c1e38dda2a684350ff7 ]
+
+During my refactoring I wanted to get rid of the switch,
+but replaced it with the wrong calculation. Fix that.
+
+Fixes: 175ad2ec89fe ("wifi: mac80211: limit A-MSDU subframes for client too")
+Reported-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230827135854.51bf1b8b0adb.Iffbd337fdad2b86ae12f5a39c69fb82b517f7486@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index b8c6f6a668fc9..49b71453dec37 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2918,7 +2918,7 @@ void ieee80211_sta_set_max_amsdu_subframes(struct sta_info *sta,
+ WLAN_EXT_CAPA9_MAX_MSDU_IN_AMSDU_MSB) << 1;
+
+ if (val)
+- sta->sta.max_amsdu_subframes = 4 << val;
++ sta->sta.max_amsdu_subframes = 4 << (4 - val);
+ }
+
+ #ifdef CONFIG_LOCKDEP
+--
+2.42.0
+
--- /dev/null
+From 9e6537282106be7c49655ce0db95074a89820460 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 13:59:42 +0200
+Subject: wifi: mac80211: move offchannel works to wiphy work
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 97c19e42b264e6b71a9ff9deea04c19f621805b9 ]
+
+Make the offchannel works wiphy works to have the
+wiphy locked for executing them.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Stable-dep-of: eadfb54756ae ("wifi: mac80211: move sched-scan stop work to wiphy work")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/ieee80211_i.h | 4 ++--
+ net/mac80211/main.c | 6 +++---
+ net/mac80211/offchannel.c | 36 ++++++++++++++++++------------------
+ 3 files changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index ab759b3b2e88e..2bf63908a35e9 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1538,9 +1538,9 @@ struct ieee80211_local {
+ /*
+ * Remain-on-channel support
+ */
+- struct delayed_work roc_work;
++ struct wiphy_delayed_work roc_work;
+ struct list_head roc_list;
+- struct work_struct hw_roc_start, hw_roc_done;
++ struct wiphy_work hw_roc_start, hw_roc_done;
+ unsigned long hw_roc_start_time;
+ u64 roc_cookie_counter;
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 5422476eb1a1c..71c1b4603623e 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -374,8 +374,8 @@ static void ieee80211_restart_work(struct work_struct *work)
+ ieee80211_scan_cancel(local);
+
+ /* make sure any new ROC will consider local->in_reconfig */
+- flush_delayed_work(&local->roc_work);
+- flush_work(&local->hw_roc_done);
++ wiphy_delayed_work_flush(local->hw.wiphy, &local->roc_work);
++ wiphy_work_flush(local->hw.wiphy, &local->hw_roc_done);
+
+ /* wait for all packet processing to be done */
+ synchronize_net();
+@@ -1469,11 +1469,11 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
+ ieee80211_remove_interfaces(local);
+
+ wiphy_lock(local->hw.wiphy);
++ wiphy_delayed_work_cancel(local->hw.wiphy, &local->roc_work);
+ wiphy_work_cancel(local->hw.wiphy, &local->radar_detected_work);
+ wiphy_unlock(local->hw.wiphy);
+ rtnl_unlock();
+
+- cancel_delayed_work_sync(&local->roc_work);
+ cancel_work_sync(&local->restart_work);
+ cancel_work_sync(&local->reconfig_filter);
+ flush_work(&local->sched_scan_stopped_work);
+diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
+index d78c82d6b6966..50dc379ca097e 100644
+--- a/net/mac80211/offchannel.c
++++ b/net/mac80211/offchannel.c
+@@ -230,7 +230,7 @@ static bool ieee80211_recalc_sw_work(struct ieee80211_local *local,
+ if (dur == LONG_MAX)
+ return false;
+
+- mod_delayed_work(local->workqueue, &local->roc_work, dur);
++ wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, dur);
+ return true;
+ }
+
+@@ -258,7 +258,7 @@ static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc,
+ roc->notified = true;
+ }
+
+-static void ieee80211_hw_roc_start(struct work_struct *work)
++static void ieee80211_hw_roc_start(struct wiphy *wiphy, struct wiphy_work *work)
+ {
+ struct ieee80211_local *local =
+ container_of(work, struct ieee80211_local, hw_roc_start);
+@@ -285,7 +285,7 @@ void ieee80211_ready_on_channel(struct ieee80211_hw *hw)
+
+ trace_api_ready_on_channel(local);
+
+- ieee80211_queue_work(hw, &local->hw_roc_start);
++ wiphy_work_queue(hw->wiphy, &local->hw_roc_start);
+ }
+ EXPORT_SYMBOL_GPL(ieee80211_ready_on_channel);
+
+@@ -338,7 +338,7 @@ static void _ieee80211_start_next_roc(struct ieee80211_local *local)
+ tmp->started = true;
+ tmp->abort = true;
+ }
+- ieee80211_queue_work(&local->hw, &local->hw_roc_done);
++ wiphy_work_queue(local->hw.wiphy, &local->hw_roc_done);
+ return;
+ }
+
+@@ -368,8 +368,8 @@ static void _ieee80211_start_next_roc(struct ieee80211_local *local)
+ ieee80211_hw_config(local, 0);
+ }
+
+- ieee80211_queue_delayed_work(&local->hw, &local->roc_work,
+- msecs_to_jiffies(min_dur));
++ wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work,
++ msecs_to_jiffies(min_dur));
+
+ /* tell userspace or send frame(s) */
+ list_for_each_entry(tmp, &local->roc_list, list) {
+@@ -407,8 +407,8 @@ void ieee80211_start_next_roc(struct ieee80211_local *local)
+ _ieee80211_start_next_roc(local);
+ } else {
+ /* delay it a bit */
+- ieee80211_queue_delayed_work(&local->hw, &local->roc_work,
+- round_jiffies_relative(HZ/2));
++ wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work,
++ round_jiffies_relative(HZ / 2));
+ }
+ }
+
+@@ -451,7 +451,7 @@ static void __ieee80211_roc_work(struct ieee80211_local *local)
+ }
+ }
+
+-static void ieee80211_roc_work(struct work_struct *work)
++static void ieee80211_roc_work(struct wiphy *wiphy, struct wiphy_work *work)
+ {
+ struct ieee80211_local *local =
+ container_of(work, struct ieee80211_local, roc_work.work);
+@@ -461,7 +461,7 @@ static void ieee80211_roc_work(struct work_struct *work)
+ mutex_unlock(&local->mtx);
+ }
+
+-static void ieee80211_hw_roc_done(struct work_struct *work)
++static void ieee80211_hw_roc_done(struct wiphy *wiphy, struct wiphy_work *work)
+ {
+ struct ieee80211_local *local =
+ container_of(work, struct ieee80211_local, hw_roc_done);
+@@ -482,7 +482,7 @@ void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw)
+
+ trace_api_remain_on_channel_expired(local);
+
+- ieee80211_queue_work(hw, &local->hw_roc_done);
++ wiphy_work_queue(hw->wiphy, &local->hw_roc_done);
+ }
+ EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired);
+
+@@ -586,8 +586,8 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
+ /* if not HW assist, just queue & schedule work */
+ if (!local->ops->remain_on_channel) {
+ list_add_tail(&roc->list, &local->roc_list);
+- ieee80211_queue_delayed_work(&local->hw,
+- &local->roc_work, 0);
++ wiphy_delayed_work_queue(local->hw.wiphy,
++ &local->roc_work, 0);
+ } else {
+ /* otherwise actually kick it off here
+ * (for error handling)
+@@ -695,7 +695,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
+ if (!cookie)
+ return -ENOENT;
+
+- flush_work(&local->hw_roc_start);
++ wiphy_work_flush(local->hw.wiphy, &local->hw_roc_start);
+
+ mutex_lock(&local->mtx);
+ list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
+@@ -745,7 +745,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
+ } else {
+ /* go through work struct to return to the operating channel */
+ found->abort = true;
+- mod_delayed_work(local->workqueue, &local->roc_work, 0);
++ wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 0);
+ }
+
+ out_unlock:
+@@ -994,9 +994,9 @@ int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
+
+ void ieee80211_roc_setup(struct ieee80211_local *local)
+ {
+- INIT_WORK(&local->hw_roc_start, ieee80211_hw_roc_start);
+- INIT_WORK(&local->hw_roc_done, ieee80211_hw_roc_done);
+- INIT_DELAYED_WORK(&local->roc_work, ieee80211_roc_work);
++ wiphy_work_init(&local->hw_roc_start, ieee80211_hw_roc_start);
++ wiphy_work_init(&local->hw_roc_done, ieee80211_hw_roc_done);
++ wiphy_delayed_work_init(&local->roc_work, ieee80211_roc_work);
+ INIT_LIST_HEAD(&local->roc_list);
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 0269fcf5577b34ee4c34381fd360732a75cd2b77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 13:59:38 +0200
+Subject: wifi: mac80211: move radar detect work to wiphy work
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 228e4f931b0e630dacca8dd867ddd863aea53913 ]
+
+Move the radar detect work to wiphy work in order
+to lock the wiphy for it without doing it manually.
+
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Stable-dep-of: eadfb54756ae ("wifi: mac80211: move sched-scan stop work to wiphy work")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/ieee80211_i.h | 5 +++--
+ net/mac80211/main.c | 9 +++++----
+ net/mac80211/util.c | 7 +++----
+ 3 files changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 99a976ea17498..3960f40c9da99 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1361,7 +1361,7 @@ struct ieee80211_local {
+ /* wowlan is enabled -- don't reconfig on resume */
+ bool wowlan;
+
+- struct work_struct radar_detected_work;
++ struct wiphy_work radar_detected_work;
+
+ /* number of RX chains the hardware has */
+ u8 rx_chains;
+@@ -2483,7 +2483,8 @@ bool ieee80211_is_radar_required(struct ieee80211_local *local);
+ void ieee80211_dfs_cac_timer(unsigned long data);
+ void ieee80211_dfs_cac_timer_work(struct work_struct *work);
+ void ieee80211_dfs_cac_cancel(struct ieee80211_local *local);
+-void ieee80211_dfs_radar_detected_work(struct work_struct *work);
++void ieee80211_dfs_radar_detected_work(struct wiphy *wiphy,
++ struct wiphy_work *work);
+ int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
+ struct cfg80211_csa_settings *csa_settings);
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 02b5abc7326bc..444a0d6021f35 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -337,7 +337,6 @@ static void ieee80211_restart_work(struct work_struct *work)
+ /* wait for scan work complete */
+ flush_workqueue(local->workqueue);
+ flush_work(&local->sched_scan_stopped_work);
+- flush_work(&local->radar_detected_work);
+
+ rtnl_lock();
+ /* we might do interface manipulations, so need both */
+@@ -811,8 +810,8 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+
+ INIT_WORK(&local->restart_work, ieee80211_restart_work);
+
+- INIT_WORK(&local->radar_detected_work,
+- ieee80211_dfs_radar_detected_work);
++ wiphy_work_init(&local->radar_detected_work,
++ ieee80211_dfs_radar_detected_work);
+
+ INIT_WORK(&local->reconfig_filter, ieee80211_reconfig_filter);
+ local->smps_mode = IEEE80211_SMPS_OFF;
+@@ -1471,13 +1470,15 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
+ */
+ ieee80211_remove_interfaces(local);
+
++ wiphy_lock(local->hw.wiphy);
++ wiphy_work_cancel(local->hw.wiphy, &local->radar_detected_work);
++ wiphy_unlock(local->hw.wiphy);
+ rtnl_unlock();
+
+ cancel_delayed_work_sync(&local->roc_work);
+ cancel_work_sync(&local->restart_work);
+ cancel_work_sync(&local->reconfig_filter);
+ flush_work(&local->sched_scan_stopped_work);
+- flush_work(&local->radar_detected_work);
+
+ ieee80211_clear_tx_pending(local);
+ rate_control_deinitialize(local);
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 98806c359b173..114956ef17fc3 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -4069,7 +4069,8 @@ void ieee80211_dfs_cac_cancel(struct ieee80211_local *local)
+ mutex_unlock(&local->mtx);
+ }
+
+-void ieee80211_dfs_radar_detected_work(struct work_struct *work)
++void ieee80211_dfs_radar_detected_work(struct wiphy *wiphy,
++ struct wiphy_work *work)
+ {
+ struct ieee80211_local *local =
+ container_of(work, struct ieee80211_local, radar_detected_work);
+@@ -4087,9 +4088,7 @@ void ieee80211_dfs_radar_detected_work(struct work_struct *work)
+ }
+ mutex_unlock(&local->chanctx_mtx);
+
+- wiphy_lock(local->hw.wiphy);
+ ieee80211_dfs_cac_cancel(local);
+- wiphy_unlock(local->hw.wiphy);
+
+ if (num_chanctx > 1)
+ /* XXX: multi-channel is not supported yet */
+@@ -4104,7 +4103,7 @@ void ieee80211_radar_detected(struct ieee80211_hw *hw)
+
+ trace_api_radar_detected(local);
+
+- schedule_work(&local->radar_detected_work);
++ wiphy_work_queue(hw->wiphy, &local->radar_detected_work);
+ }
+ EXPORT_SYMBOL(ieee80211_radar_detected);
+
+--
+2.42.0
+
--- /dev/null
+From 682ae9f846cae4287181ff4d82b212c1031ab39b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 13:59:39 +0200
+Subject: wifi: mac80211: move scan work to wiphy work
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 201712512cbbda360f62c222a4bab260350462a0 ]
+
+Move the scan work to wiphy work, which also simplifies
+the way we handle the work vs. the scan configuration.
+
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Stable-dep-of: eadfb54756ae ("wifi: mac80211: move sched-scan stop work to wiphy work")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/ieee80211_i.h | 4 ++--
+ net/mac80211/iface.c | 2 +-
+ net/mac80211/main.c | 4 +---
+ net/mac80211/scan.c | 29 ++++++++++++-----------------
+ net/mac80211/util.c | 4 ++--
+ 5 files changed, 18 insertions(+), 25 deletions(-)
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 3960f40c9da99..ab759b3b2e88e 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1445,7 +1445,7 @@ struct ieee80211_local {
+
+ unsigned long leave_oper_channel_time;
+ enum mac80211_scan_state next_scan_state;
+- struct delayed_work scan_work;
++ struct wiphy_delayed_work scan_work;
+ struct ieee80211_sub_if_data __rcu *scan_sdata;
+ /* For backward compatibility only -- do not use */
+ struct cfg80211_chan_def _oper_chandef;
+@@ -1862,7 +1862,7 @@ int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
+ int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata);
+
+ /* scan/BSS handling */
+-void ieee80211_scan_work(struct work_struct *work);
++void ieee80211_scan_work(struct wiphy *wiphy, struct wiphy_work *work);
+ int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
+ const u8 *ssid, u8 ssid_len,
+ struct ieee80211_channel **channels,
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 8dd3c10a99e0b..e00e1bf0f754a 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -697,7 +697,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
+ ieee80211_recalc_ps(local);
+
+ if (cancel_scan)
+- flush_delayed_work(&local->scan_work);
++ wiphy_delayed_work_flush(local->hw.wiphy, &local->scan_work);
+
+ if (local->open_count == 0) {
+ ieee80211_stop_device(local);
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 444a0d6021f35..5422476eb1a1c 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -334,9 +334,7 @@ static void ieee80211_restart_work(struct work_struct *work)
+ struct ieee80211_sub_if_data *sdata;
+ int ret;
+
+- /* wait for scan work complete */
+ flush_workqueue(local->workqueue);
+- flush_work(&local->sched_scan_stopped_work);
+
+ rtnl_lock();
+ /* we might do interface manipulations, so need both */
+@@ -806,7 +804,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+ INIT_LIST_HEAD(&local->chanctx_list);
+ mutex_init(&local->chanctx_mtx);
+
+- INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
++ wiphy_delayed_work_init(&local->scan_work, ieee80211_scan_work);
+
+ INIT_WORK(&local->restart_work, ieee80211_restart_work);
+
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index dc3cdee51e660..445b789e0e9bf 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -291,8 +291,8 @@ void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
+ * the beacon/proberesp rx gives us an opportunity to upgrade
+ * to active scan
+ */
+- set_bit(SCAN_BEACON_DONE, &local->scanning);
+- ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0);
++ set_bit(SCAN_BEACON_DONE, &local->scanning);
++ wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
+ }
+
+ if (ieee80211_is_probe_resp(mgmt->frame_control)) {
+@@ -522,7 +522,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw,
+
+ memcpy(&local->scan_info, info, sizeof(*info));
+
+- ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0);
++ wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
+ }
+ EXPORT_SYMBOL(ieee80211_scan_completed);
+
+@@ -562,8 +562,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local,
+ /* We need to set power level at maximum rate for scanning. */
+ ieee80211_hw_config(local, 0);
+
+- ieee80211_queue_delayed_work(&local->hw,
+- &local->scan_work, 0);
++ wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
+
+ return 0;
+ }
+@@ -620,8 +619,8 @@ void ieee80211_run_deferred_scan(struct ieee80211_local *local)
+ lockdep_is_held(&local->mtx))))
+ return;
+
+- ieee80211_queue_delayed_work(&local->hw, &local->scan_work,
+- round_jiffies_relative(0));
++ wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work,
++ round_jiffies_relative(0));
+ }
+
+ static void ieee80211_send_scan_probe_req(struct ieee80211_sub_if_data *sdata,
+@@ -812,8 +811,8 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
+ }
+
+ /* Now, just wait a bit and we are all done! */
+- ieee80211_queue_delayed_work(&local->hw, &local->scan_work,
+- next_delay);
++ wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work,
++ next_delay);
+ return 0;
+ } else {
+ /* Do normal software scan */
+@@ -1060,7 +1059,7 @@ static void ieee80211_scan_state_resume(struct ieee80211_local *local,
+ local->next_scan_state = SCAN_SET_CHANNEL;
+ }
+
+-void ieee80211_scan_work(struct work_struct *work)
++void ieee80211_scan_work(struct wiphy *wiphy, struct wiphy_work *work)
+ {
+ struct ieee80211_local *local =
+ container_of(work, struct ieee80211_local, scan_work.work);
+@@ -1154,7 +1153,8 @@ void ieee80211_scan_work(struct work_struct *work)
+ }
+ } while (next_delay == 0);
+
+- ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay);
++ wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work,
++ next_delay);
+ goto out;
+
+ out_complete:
+@@ -1297,12 +1297,7 @@ void ieee80211_scan_cancel(struct ieee80211_local *local)
+ goto out;
+ }
+
+- /*
+- * If the work is currently running, it must be blocked on
+- * the mutex, but we'll set scan_sdata = NULL and it'll
+- * simply exit once it acquires the mutex.
+- */
+- cancel_delayed_work(&local->scan_work);
++ wiphy_delayed_work_cancel(local->hw.wiphy, &local->scan_work);
+ /* and clean up */
+ memset(&local->scan_info, 0, sizeof(local->scan_info));
+ __ieee80211_scan_completed(&local->hw, true);
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 114956ef17fc3..1088d90e355ba 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -2234,8 +2234,8 @@ static void ieee80211_flush_completed_scan(struct ieee80211_local *local,
+ */
+ if (aborted)
+ set_bit(SCAN_ABORTED, &local->scanning);
+- ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0);
+- flush_delayed_work(&local->scan_work);
++ wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
++ wiphy_delayed_work_flush(local->hw.wiphy, &local->scan_work);
+ }
+ }
+
+--
+2.42.0
+
--- /dev/null
+From d0a2060e76e62796052aab65ebf658341ed17a4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 13:59:45 +0200
+Subject: wifi: mac80211: move sched-scan stop work to wiphy work
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit eadfb54756aea5610d8d0a467f66305f777c85dd ]
+
+This also has the wiphy locked here then. We need to use
+the _locked version of cfg80211_sched_scan_stopped() now,
+which also fixes an old deadlock there.
+
+Fixes: a05829a7222e ("cfg80211: avoid holding the RTNL when calling the driver")
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/ieee80211_i.h | 5 +++--
+ net/mac80211/main.c | 6 +++---
+ net/mac80211/scan.c | 7 ++++---
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 2bf63908a35e9..d5dd2d9e89b48 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1438,7 +1438,7 @@ struct ieee80211_local {
+ int hw_scan_ies_bufsize;
+ struct cfg80211_scan_info scan_info;
+
+- struct work_struct sched_scan_stopped_work;
++ struct wiphy_work sched_scan_stopped_work;
+ struct ieee80211_sub_if_data __rcu *sched_scan_sdata;
+ struct cfg80211_sched_scan_request __rcu *sched_scan_req;
+ u8 scan_addr[ETH_ALEN];
+@@ -1892,7 +1892,8 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
+ struct cfg80211_sched_scan_request *req);
+ int ieee80211_request_sched_scan_stop(struct ieee80211_local *local);
+ void ieee80211_sched_scan_end(struct ieee80211_local *local);
+-void ieee80211_sched_scan_stopped_work(struct work_struct *work);
++void ieee80211_sched_scan_stopped_work(struct wiphy *wiphy,
++ struct wiphy_work *work);
+
+ /* off-channel/mgmt-tx */
+ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local);
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 71c1b4603623e..6faba47b7b0ea 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -820,8 +820,8 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+ ieee80211_dynamic_ps_disable_work);
+ timer_setup(&local->dynamic_ps_timer, ieee80211_dynamic_ps_timer, 0);
+
+- INIT_WORK(&local->sched_scan_stopped_work,
+- ieee80211_sched_scan_stopped_work);
++ wiphy_work_init(&local->sched_scan_stopped_work,
++ ieee80211_sched_scan_stopped_work);
+
+ spin_lock_init(&local->ack_status_lock);
+ idr_init(&local->ack_status_frames);
+@@ -1470,13 +1470,13 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
+
+ wiphy_lock(local->hw.wiphy);
+ wiphy_delayed_work_cancel(local->hw.wiphy, &local->roc_work);
++ wiphy_work_cancel(local->hw.wiphy, &local->sched_scan_stopped_work);
+ wiphy_work_cancel(local->hw.wiphy, &local->radar_detected_work);
+ wiphy_unlock(local->hw.wiphy);
+ rtnl_unlock();
+
+ cancel_work_sync(&local->restart_work);
+ cancel_work_sync(&local->reconfig_filter);
+- flush_work(&local->sched_scan_stopped_work);
+
+ ieee80211_clear_tx_pending(local);
+ rate_control_deinitialize(local);
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index 445b789e0e9bf..c37e2576f1c13 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -1439,10 +1439,11 @@ void ieee80211_sched_scan_end(struct ieee80211_local *local)
+
+ mutex_unlock(&local->mtx);
+
+- cfg80211_sched_scan_stopped(local->hw.wiphy, 0);
++ cfg80211_sched_scan_stopped_locked(local->hw.wiphy, 0);
+ }
+
+-void ieee80211_sched_scan_stopped_work(struct work_struct *work)
++void ieee80211_sched_scan_stopped_work(struct wiphy *wiphy,
++ struct wiphy_work *work)
+ {
+ struct ieee80211_local *local =
+ container_of(work, struct ieee80211_local,
+@@ -1465,6 +1466,6 @@ void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
+ if (local->in_reconfig)
+ return;
+
+- schedule_work(&local->sched_scan_stopped_work);
++ wiphy_work_queue(hw->wiphy, &local->sched_scan_stopped_work);
+ }
+ EXPORT_SYMBOL(ieee80211_sched_scan_stopped);
+--
+2.42.0
+
--- /dev/null
+From 18cce93957e63f44299f6d009401536e445f0f57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jul 2023 16:21:18 +0200
+Subject: wifi: mt76: mt7603: improve stuck beacon handling
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 3176205933494bd184c6acd70e796c382bc729b5 ]
+
+Before preparing the new beacon, check the queue status, flush out all
+previous beacons and buffered multicast packets, then (if necessary)
+try to recover more gracefully from a stuck beacon condition by making a
+less invasive attempt at getting the MAC un-stuck.
+
+Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/mediatek/mt76/mt7603/beacon.c | 76 ++++++++++++++-----
+ .../net/wireless/mediatek/mt76/mt7603/regs.h | 5 ++
+ 2 files changed, 60 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/beacon.c b/drivers/net/wireless/mediatek/mt76/mt7603/beacon.c
+index b65b0a88c1ded..808466b7de472 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/beacon.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/beacon.c
+@@ -9,6 +9,23 @@ struct beacon_bc_data {
+ int count[MT7603_MAX_INTERFACES];
+ };
+
++static void
++mt7603_mac_stuck_beacon_recovery(struct mt7603_dev *dev)
++{
++ if (dev->beacon_check % 5 != 4)
++ return;
++
++ mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_TX_DMA_EN);
++ mt76_set(dev, MT_SCH_4, MT_SCH_4_RESET);
++ mt76_clear(dev, MT_SCH_4, MT_SCH_4_RESET);
++ mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_TX_DMA_EN);
++
++ mt76_set(dev, MT_WF_CFG_OFF_WOCCR, MT_WF_CFG_OFF_WOCCR_TMAC_GC_DIS);
++ mt76_set(dev, MT_ARB_SCR, MT_ARB_SCR_TX_DISABLE);
++ mt76_clear(dev, MT_ARB_SCR, MT_ARB_SCR_TX_DISABLE);
++ mt76_clear(dev, MT_WF_CFG_OFF_WOCCR, MT_WF_CFG_OFF_WOCCR_TMAC_GC_DIS);
++}
++
+ static void
+ mt7603_update_beacon_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
+ {
+@@ -16,6 +33,8 @@ mt7603_update_beacon_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
+ struct mt76_dev *mdev = &dev->mt76;
+ struct mt7603_vif *mvif = (struct mt7603_vif *)vif->drv_priv;
+ struct sk_buff *skb = NULL;
++ u32 om_idx = mvif->idx;
++ u32 val;
+
+ if (!(mdev->beacon_mask & BIT(mvif->idx)))
+ return;
+@@ -24,20 +43,33 @@ mt7603_update_beacon_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
+ if (!skb)
+ return;
+
+- mt76_tx_queue_skb(dev, dev->mphy.q_tx[MT_TXQ_BEACON],
+- MT_TXQ_BEACON, skb, &mvif->sta.wcid, NULL);
++ if (om_idx)
++ om_idx |= 0x10;
++ val = MT_DMA_FQCR0_BUSY | MT_DMA_FQCR0_MODE |
++ FIELD_PREP(MT_DMA_FQCR0_TARGET_BSS, om_idx) |
++ FIELD_PREP(MT_DMA_FQCR0_DEST_PORT_ID, 3) |
++ FIELD_PREP(MT_DMA_FQCR0_DEST_QUEUE_ID, 8);
+
+ spin_lock_bh(&dev->ps_lock);
+- mt76_wr(dev, MT_DMA_FQCR0, MT_DMA_FQCR0_BUSY |
+- FIELD_PREP(MT_DMA_FQCR0_TARGET_WCID, mvif->sta.wcid.idx) |
+- FIELD_PREP(MT_DMA_FQCR0_TARGET_QID,
+- dev->mphy.q_tx[MT_TXQ_CAB]->hw_idx) |
+- FIELD_PREP(MT_DMA_FQCR0_DEST_PORT_ID, 3) |
+- FIELD_PREP(MT_DMA_FQCR0_DEST_QUEUE_ID, 8));
+
+- if (!mt76_poll(dev, MT_DMA_FQCR0, MT_DMA_FQCR0_BUSY, 0, 5000))
++ mt76_wr(dev, MT_DMA_FQCR0, val |
++ FIELD_PREP(MT_DMA_FQCR0_TARGET_QID, MT_TX_HW_QUEUE_BCN));
++ if (!mt76_poll(dev, MT_DMA_FQCR0, MT_DMA_FQCR0_BUSY, 0, 5000)) {
+ dev->beacon_check = MT7603_WATCHDOG_TIMEOUT;
++ goto out;
++ }
++
++ mt76_wr(dev, MT_DMA_FQCR0, val |
++ FIELD_PREP(MT_DMA_FQCR0_TARGET_QID, MT_TX_HW_QUEUE_BMC));
++ if (!mt76_poll(dev, MT_DMA_FQCR0, MT_DMA_FQCR0_BUSY, 0, 5000)) {
++ dev->beacon_check = MT7603_WATCHDOG_TIMEOUT;
++ goto out;
++ }
+
++ mt76_tx_queue_skb(dev, dev->mphy.q_tx[MT_TXQ_BEACON],
++ MT_TXQ_BEACON, skb, &mvif->sta.wcid, NULL);
++
++out:
+ spin_unlock_bh(&dev->ps_lock);
+ }
+
+@@ -81,6 +113,18 @@ void mt7603_pre_tbtt_tasklet(struct tasklet_struct *t)
+ data.dev = dev;
+ __skb_queue_head_init(&data.q);
+
++ /* Flush all previous CAB queue packets and beacons */
++ mt76_wr(dev, MT_WF_ARB_CAB_FLUSH, GENMASK(30, 16) | BIT(0));
++
++ mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_CAB], false);
++ mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_BEACON], false);
++
++ if (dev->mphy.q_tx[MT_TXQ_BEACON]->queued > 0)
++ dev->beacon_check++;
++ else
++ dev->beacon_check = 0;
++ mt7603_mac_stuck_beacon_recovery(dev);
++
+ q = dev->mphy.q_tx[MT_TXQ_BEACON];
+ spin_lock(&q->lock);
+ ieee80211_iterate_active_interfaces_atomic(mt76_hw(dev),
+@@ -89,14 +133,9 @@ void mt7603_pre_tbtt_tasklet(struct tasklet_struct *t)
+ mt76_queue_kick(dev, q);
+ spin_unlock(&q->lock);
+
+- /* Flush all previous CAB queue packets */
+- mt76_wr(dev, MT_WF_ARB_CAB_FLUSH, GENMASK(30, 16) | BIT(0));
+-
+- mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_CAB], false);
+-
+ mt76_csa_check(mdev);
+ if (mdev->csa_complete)
+- goto out;
++ return;
+
+ q = dev->mphy.q_tx[MT_TXQ_CAB];
+ do {
+@@ -108,7 +147,7 @@ void mt7603_pre_tbtt_tasklet(struct tasklet_struct *t)
+ skb_queue_len(&data.q) < 8);
+
+ if (skb_queue_empty(&data.q))
+- goto out;
++ return;
+
+ for (i = 0; i < ARRAY_SIZE(data.tail); i++) {
+ if (!data.tail[i])
+@@ -136,11 +175,6 @@ void mt7603_pre_tbtt_tasklet(struct tasklet_struct *t)
+ MT_WF_ARB_CAB_START_BSSn(0) |
+ (MT_WF_ARB_CAB_START_BSS0n(1) *
+ ((1 << (MT7603_MAX_INTERFACES - 1)) - 1)));
+-
+-out:
+- mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_BEACON], false);
+- if (dev->mphy.q_tx[MT_TXQ_BEACON]->queued > hweight8(mdev->beacon_mask))
+- dev->beacon_check++;
+ }
+
+ void mt7603_beacon_set_timer(struct mt7603_dev *dev, int idx, int intval)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/regs.h b/drivers/net/wireless/mediatek/mt76/mt7603/regs.h
+index 3b901090b29c6..9b84db233aceb 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/regs.h
+@@ -462,6 +462,11 @@ enum {
+ #define MT_WF_SEC_BASE 0x21a00
+ #define MT_WF_SEC(ofs) (MT_WF_SEC_BASE + (ofs))
+
++#define MT_WF_CFG_OFF_BASE 0x21e00
++#define MT_WF_CFG_OFF(ofs) (MT_WF_CFG_OFF_BASE + (ofs))
++#define MT_WF_CFG_OFF_WOCCR MT_WF_CFG_OFF(0x004)
++#define MT_WF_CFG_OFF_WOCCR_TMAC_GC_DIS BIT(4)
++
+ #define MT_SEC_SCR MT_WF_SEC(0x004)
+ #define MT_SEC_SCR_MASK_ORDER GENMASK(1, 0)
+
+--
+2.42.0
+
--- /dev/null
+From 135a2f8b2d14da9b167875db8908437282e637d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jul 2023 16:04:40 +0200
+Subject: wifi: mt76: mt7603: improve watchdog reset reliablity
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit c677dda165231c3efffb9de4bace249d5d2a51b9 ]
+
+Only trigger PSE reset if PSE was stuck, otherwise it can cause DMA issues.
+Trigger the PSE reset while DMA is fully stopped in order to improve
+reliabilty.
+
+Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7603/mac.c | 29 ++++++++-----------
+ 1 file changed, 12 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+index 541dc1da94c00..2980e1234d13f 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+@@ -1430,15 +1430,6 @@ static void mt7603_mac_watchdog_reset(struct mt7603_dev *dev)
+
+ mt7603_beacon_set_timer(dev, -1, 0);
+
+- if (dev->reset_cause[RESET_CAUSE_RESET_FAILED] ||
+- dev->cur_reset_cause == RESET_CAUSE_RX_PSE_BUSY ||
+- dev->cur_reset_cause == RESET_CAUSE_BEACON_STUCK ||
+- dev->cur_reset_cause == RESET_CAUSE_TX_HANG)
+- mt7603_pse_reset(dev);
+-
+- if (dev->reset_cause[RESET_CAUSE_RESET_FAILED])
+- goto skip_dma_reset;
+-
+ mt7603_mac_stop(dev);
+
+ mt76_clear(dev, MT_WPDMA_GLO_CFG,
+@@ -1448,28 +1439,32 @@ static void mt7603_mac_watchdog_reset(struct mt7603_dev *dev)
+
+ mt7603_irq_disable(dev, mask);
+
+- mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_FORCE_TX_EOF);
+-
+ mt7603_pse_client_reset(dev);
+
+ mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_WM], true);
+ for (i = 0; i < __MT_TXQ_MAX; i++)
+ mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
+
++ mt7603_dma_sched_reset(dev);
++
++ mt76_tx_status_check(&dev->mt76, true);
++
+ mt76_for_each_q_rx(&dev->mt76, i) {
+ mt76_queue_rx_reset(dev, i);
+ }
+
+- mt76_tx_status_check(&dev->mt76, true);
++ if (dev->reset_cause[RESET_CAUSE_RESET_FAILED] ||
++ dev->cur_reset_cause == RESET_CAUSE_RX_PSE_BUSY)
++ mt7603_pse_reset(dev);
+
+- mt7603_dma_sched_reset(dev);
++ if (!dev->reset_cause[RESET_CAUSE_RESET_FAILED]) {
++ mt7603_mac_dma_start(dev);
+
+- mt7603_mac_dma_start(dev);
++ mt7603_irq_enable(dev, mask);
+
+- mt7603_irq_enable(dev, mask);
++ clear_bit(MT76_RESET, &dev->mphy.state);
++ }
+
+-skip_dma_reset:
+- clear_bit(MT76_RESET, &dev->mphy.state);
+ mutex_unlock(&dev->mt76.mutex);
+
+ mt76_worker_enable(&dev->mt76.tx_worker);
+--
+2.42.0
+
--- /dev/null
+From 5999108e8a956546e088bf0db544dc2e440d85d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jul 2023 09:51:01 +0200
+Subject: wifi: mt76: mt7603: rework/fix rx pse hang check
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit baa19b2e4b7bbb509a7ca7939c8785477dcd40ee ]
+
+It turns out that the code in mt7603_rx_pse_busy() does not detect actual
+hardware hangs, it only checks for busy conditions in PSE.
+A reset should only be performed if these conditions are true and if there
+is no rx activity as well.
+Reset the counter whenever a rx interrupt occurs. In order to also deal with
+a fully loaded CPU that leaves interrupts disabled with continuous NAPI
+polling, also check for pending rx interrupts in the function itself.
+
+Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7603/core.c | 2 ++
+ .../net/wireless/mediatek/mt76/mt7603/mac.c | 23 +++++++++++++------
+ 2 files changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/core.c b/drivers/net/wireless/mediatek/mt76/mt7603/core.c
+index 60a996b63c0c0..915b8349146af 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/core.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/core.c
+@@ -42,11 +42,13 @@ irqreturn_t mt7603_irq_handler(int irq, void *dev_instance)
+ }
+
+ if (intr & MT_INT_RX_DONE(0)) {
++ dev->rx_pse_check = 0;
+ mt7603_irq_disable(dev, MT_INT_RX_DONE(0));
+ napi_schedule(&dev->mt76.napi[0]);
+ }
+
+ if (intr & MT_INT_RX_DONE(1)) {
++ dev->rx_pse_check = 0;
+ mt7603_irq_disable(dev, MT_INT_RX_DONE(1));
+ napi_schedule(&dev->mt76.napi[1]);
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+index 6cff346d57a78..541dc1da94c00 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+@@ -1559,20 +1559,29 @@ static bool mt7603_rx_pse_busy(struct mt7603_dev *dev)
+ {
+ u32 addr, val;
+
+- if (mt76_rr(dev, MT_MCU_DEBUG_RESET) & MT_MCU_DEBUG_RESET_QUEUES)
+- return true;
+-
+ if (mt7603_rx_fifo_busy(dev))
+- return false;
++ goto out;
+
+ addr = mt7603_reg_map(dev, MT_CLIENT_BASE_PHYS_ADDR + MT_CLIENT_STATUS);
+ mt76_wr(dev, addr, 3);
+ val = mt76_rr(dev, addr) >> 16;
+
+- if (is_mt7628(dev) && (val & 0x4001) == 0x4001)
+- return true;
++ if (!(val & BIT(0)))
++ return false;
++
++ if (is_mt7628(dev))
++ val &= 0xa000;
++ else
++ val &= 0x8000;
++ if (!val)
++ return false;
++
++out:
++ if (mt76_rr(dev, MT_INT_SOURCE_CSR) &
++ (MT_INT_RX_DONE(0) | MT_INT_RX_DONE(1)))
++ return false;
+
+- return (val & 0x8001) == 0x8001 || (val & 0xe001) == 0xe001;
++ return true;
+ }
+
+ static bool
+--
+2.42.0
+
--- /dev/null
+From d8386284feabc865bb15a4a050a3039375080a0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Aug 2023 14:22:21 +0800
+Subject: wifi: mt76: mt7915: fix beamforming availability check
+
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+
+[ Upstream commit ced1a0b8f3944e44e7f4eb3772dea1bada25d38a ]
+
+Without this patch, when ap sets the tx stream number to 2,
+ap won't send any beamforming packet.
+
+Fixes: f89f297aef28 ("mt76: mt7915: fix txbf starec TLV issues")
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index bcfc30d669c20..b2ea539f697f7 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -988,13 +988,13 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta, bool bfee)
+ {
+ struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+- int tx_ant = hweight8(phy->mt76->chainmask) - 1;
++ int sts = hweight16(phy->mt76->chainmask);
+
+ if (vif->type != NL80211_IFTYPE_STATION &&
+ vif->type != NL80211_IFTYPE_AP)
+ return false;
+
+- if (!bfee && tx_ant < 2)
++ if (!bfee && sts < 2)
+ return false;
+
+ if (sta->deflink.he_cap.has_he) {
+--
+2.42.0
+
--- /dev/null
+From 29fc5e3036232f8bc2514286d5645dd6340659fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 08:23:19 +0300
+Subject: wifi: rtlwifi: fix EDCA limit set by BT coexistence
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 3391ee7f9ea508c375d443cd712c2e699be235b4 ]
+
+In 'rtl92c_dm_check_edca_turbo()', 'rtl88e_dm_check_edca_turbo()',
+and 'rtl8723e_dm_check_edca_turbo()', the DL limit should be set
+from the corresponding field of 'rtlpriv->btcoexist' rather than
+UL. Compile tested only.
+
+Fixes: 0529c6b81761 ("rtlwifi: rtl8723ae: Update driver to match 06/28/14 Realtek version")
+Fixes: c151aed6aa14 ("rtlwifi: rtl8188ee: Update driver to match Realtek release of 06282014")
+Fixes: beb5bc402043 ("rtlwifi: rtl8192c-common: Convert common dynamic management routines for addition of rtl8192se and rtl8192de")
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230928052327.120178-1-dmantipov@yandex.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8188ee/dm.c | 2 +-
+ drivers/net/wireless/realtek/rtlwifi/rtl8192c/dm_common.c | 2 +-
+ drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/dm.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/dm.c
+index 6f61d6a106272..5a34894a533be 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/dm.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/dm.c
+@@ -799,7 +799,7 @@ static void rtl88e_dm_check_edca_turbo(struct ieee80211_hw *hw)
+ }
+
+ if (rtlpriv->btcoexist.bt_edca_dl != 0) {
+- edca_be_ul = rtlpriv->btcoexist.bt_edca_dl;
++ edca_be_dl = rtlpriv->btcoexist.bt_edca_dl;
+ bt_change_edca = true;
+ }
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/dm_common.c
+index 0b6a15c2e5ccd..d92aad60edfe9 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/dm_common.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/dm_common.c
+@@ -640,7 +640,7 @@ static void rtl92c_dm_check_edca_turbo(struct ieee80211_hw *hw)
+ }
+
+ if (rtlpriv->btcoexist.bt_edca_dl != 0) {
+- edca_be_ul = rtlpriv->btcoexist.bt_edca_dl;
++ edca_be_dl = rtlpriv->btcoexist.bt_edca_dl;
+ bt_change_edca = true;
+ }
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c
+index 8ada31380efa4..0ff8e355c23a4 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c
+@@ -466,7 +466,7 @@ static void rtl8723e_dm_check_edca_turbo(struct ieee80211_hw *hw)
+ }
+
+ if (rtlpriv->btcoexist.bt_edca_dl != 0) {
+- edca_be_ul = rtlpriv->btcoexist.bt_edca_dl;
++ edca_be_dl = rtlpriv->btcoexist.bt_edca_dl;
+ bt_change_edca = true;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 88b0037c6222292c128dd5b8b51418cf499ef7cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Sep 2023 13:06:50 +0800
+Subject: wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for
+ debugfs_create_file()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 74f7957c9b1b95553faaf146a2553e023a9d1720 ]
+
+Since debugfs_create_file() return ERR_PTR and never return NULL, so use
+IS_ERR() to check it instead of checking NULL.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230919050651.962694-1-ruanjinjie@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/debug.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
+index 9ebe544e51d0d..abd750c3c28e5 100644
+--- a/drivers/net/wireless/realtek/rtw88/debug.c
++++ b/drivers/net/wireless/realtek/rtw88/debug.c
+@@ -1191,9 +1191,9 @@ static struct rtw_debugfs_priv rtw_debug_priv_dm_cap = {
+ #define rtw_debugfs_add_core(name, mode, fopname, parent) \
+ do { \
+ rtw_debug_priv_ ##name.rtwdev = rtwdev; \
+- if (!debugfs_create_file(#name, mode, \
++ if (IS_ERR(debugfs_create_file(#name, mode, \
+ parent, &rtw_debug_priv_ ##name,\
+- &file_ops_ ##fopname)) \
++ &file_ops_ ##fopname))) \
+ pr_debug("Unable to initialize debugfs:%s\n", \
+ #name); \
+ } while (0)
+--
+2.42.0
+
--- /dev/null
+From d571c89651db866d234bb5f127b2286b88eecf40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 14:30:39 +0200
+Subject: wifi: wfx: fix case where rates are out of order
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felipe Negrelli Wolter <felipe.negrelliwolter@silabs.com>
+
+[ Upstream commit ea2274ab0b18549dbf0e755e41d8c5e8b5232dc3 ]
+
+When frames are sent over the air, the device always applies the data
+rates in descending order. The driver assumed Minstrel also provided
+rate in descending order.
+
+However, in some cases, Minstrel can a choose a fallback rate greater
+than the primary rate. In this case, the two rates was inverted, the
+device try highest rate first and we get many retries.
+
+Since the device always applies rates in descending order, the
+workaround is to drop the rate when it higher than its predecessor in
+the rate list. Thus [ 4, 5, 3 ] becomes [ 4, 3 ].
+
+This patch has been tested in isolated room with a series of
+attenuators. Here are the Minstrel statistics with 80dBm of attenuation:
+
+ Without the fix:
+
+ best ____________rate__________ ____statistics___ _____last____ ______sum-of________
+ mode guard # rate [name idx airtime max_tp] [avg(tp) avg(prob)] [retry|suc|att] [#success | #attempts]
+ HT20 LGI 1 S MCS0 0 1477 5.6 5.2 82.7 3 0 0 3 4
+ HT20 LGI 1 MCS1 1 738 10.6 0.0 0.0 0 0 0 0 1
+ HT20 LGI 1 D MCS2 2 492 14.9 13.5 81.5 5 0 0 5 9
+ HT20 LGI 1 C MCS3 3 369 18.8 17.6 84.3 5 0 0 76 96
+ HT20 LGI 1 A P MCS4 4 246 25.4 22.4 79.5 5 0 0 11268 14026
+ HT20 LGI 1 B S MCS5 5 185 30.7 19.7 57.7 5 8 9 3918 9793
+ HT20 LGI 1 MCS6 6 164 33.0 0.0 0.0 5 0 0 6 102
+ HT20 LGI 1 MCS7 7 148 35.1 0.0 0.0 0 0 0 0 44
+
+ With the fix:
+
+ best ____________rate__________ ____statistics___ _____last____ ______sum-of________
+ mode guard # rate [name idx airtime max_tp] [avg(tp) avg(prob)] [retry|suc|att] [#success | #attempts]
+ HT20 LGI 1 S MCS0 0 1477 5.6 1.8 28.6 1 0 0 1 5
+ HT20 LGI 1 DP MCS1 1 738 10.6 9.7 82.6 4 0 0 14 34
+ HT20 LGI 1 MCS2 2 492 14.9 9.2 55.4 5 0 0 52 77
+ HT20 LGI 1 B S MCS3 3 369 18.8 15.6 74.9 5 1 1 417 554
+ HT20 LGI 1 A MCS4 4 246 25.4 16.7 59.2 5 1 1 13812 17951
+ HT20 LGI 1 C S MCS5 5 185 30.7 14.0 41.0 5 1 5 57 640
+ HT20 LGI 1 MCS6 6 164 33.0 0.0 0.0 0 0 1 0 48
+ HT20 LGI 1 S MCS7 7 148 35.1 0.0 0.0 0 0 0 0 36
+
+We can notice the device try now to send with lower rates (and high
+success rates). At the end, we measured 20-25% better throughput with
+this patch.
+
+Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames")
+Tested-by: Olivier Souloumiac <olivier.souloumiac@silabs.com>
+Tested-by: Alexandr Suslenko <suslenko.o@ajax.systems>
+Reported-by: Alexandr Suslenko <suslenko.o@ajax.systems>
+Co-developed-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
+Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
+Signed-off-by: Felipe Negrelli Wolter <felipe.negrelliwolter@silabs.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20231004123039.157112-1-jerome.pouiller@silabs.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/silabs/wfx/data_tx.c | 71 +++++++++--------------
+ 1 file changed, 29 insertions(+), 42 deletions(-)
+
+diff --git a/drivers/net/wireless/silabs/wfx/data_tx.c b/drivers/net/wireless/silabs/wfx/data_tx.c
+index 6a5e52a96d183..caa22226b01bc 100644
+--- a/drivers/net/wireless/silabs/wfx/data_tx.c
++++ b/drivers/net/wireless/silabs/wfx/data_tx.c
+@@ -226,53 +226,40 @@ static u8 wfx_tx_get_link_id(struct wfx_vif *wvif, struct ieee80211_sta *sta,
+
+ static void wfx_tx_fixup_rates(struct ieee80211_tx_rate *rates)
+ {
+- int i;
+- bool finished;
++ bool has_rate0 = false;
++ int i, j;
+
+- /* Firmware is not able to mix rates with different flags */
+- for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+- if (rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
+- rates[i].flags |= IEEE80211_TX_RC_SHORT_GI;
+- if (!(rates[0].flags & IEEE80211_TX_RC_SHORT_GI))
++ for (i = 1, j = 1; j < IEEE80211_TX_MAX_RATES; j++) {
++ if (rates[j].idx == -1)
++ break;
++ /* The device use the rates in descending order, whatever the request from minstrel.
++ * We have to trade off here. Most important is to respect the primary rate
++ * requested by minstrel. So, we drops the entries with rate higher than the
++ * previous.
++ */
++ if (rates[j].idx >= rates[i - 1].idx) {
++ rates[i - 1].count += rates[j].count;
++ rates[i - 1].count = min_t(u16, 15, rates[i - 1].count);
++ } else {
++ memcpy(rates + i, rates + j, sizeof(rates[i]));
++ if (rates[i].idx == 0)
++ has_rate0 = true;
++ /* The device apply Short GI only on the first rate */
+ rates[i].flags &= ~IEEE80211_TX_RC_SHORT_GI;
+- if (!(rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS))
+- rates[i].flags &= ~IEEE80211_TX_RC_USE_RTS_CTS;
+- }
+-
+- /* Sort rates and remove duplicates */
+- do {
+- finished = true;
+- for (i = 0; i < IEEE80211_TX_MAX_RATES - 1; i++) {
+- if (rates[i + 1].idx == rates[i].idx &&
+- rates[i].idx != -1) {
+- rates[i].count += rates[i + 1].count;
+- if (rates[i].count > 15)
+- rates[i].count = 15;
+- rates[i + 1].idx = -1;
+- rates[i + 1].count = 0;
+-
+- finished = false;
+- }
+- if (rates[i + 1].idx > rates[i].idx) {
+- swap(rates[i + 1], rates[i]);
+- finished = false;
+- }
++ i++;
+ }
+- } while (!finished);
++ }
+ /* Ensure that MCS0 or 1Mbps is present at the end of the retry list */
+- for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+- if (rates[i].idx == 0)
+- break;
+- if (rates[i].idx == -1) {
+- rates[i].idx = 0;
+- rates[i].count = 8; /* == hw->max_rate_tries */
+- rates[i].flags = rates[i - 1].flags & IEEE80211_TX_RC_MCS;
+- break;
+- }
++ if (!has_rate0 && i < IEEE80211_TX_MAX_RATES) {
++ rates[i].idx = 0;
++ rates[i].count = 8; /* == hw->max_rate_tries */
++ rates[i].flags = rates[0].flags & IEEE80211_TX_RC_MCS;
++ i++;
++ }
++ for (; i < IEEE80211_TX_MAX_RATES; i++) {
++ memset(rates + i, 0, sizeof(rates[i]));
++ rates[i].idx = -1;
+ }
+- /* All retries use long GI */
+- for (i = 1; i < IEEE80211_TX_MAX_RATES; i++)
+- rates[i].flags &= ~IEEE80211_TX_RC_SHORT_GI;
+ }
+
+ static u8 wfx_tx_get_retry_policy_id(struct wfx_vif *wvif, struct ieee80211_tx_info *tx_info)
+--
+2.42.0
+
--- /dev/null
+From 470420c0afc579cc3840268f0c556f6fde0b26bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Oct 2023 20:55:11 +0800
+Subject: writeback, cgroup: switch inodes with dirty timestamps to release
+ dying cgwbs
+
+From: Jingbo Xu <jefflexu@linux.alibaba.com>
+
+[ Upstream commit 6654408a33e6297d8e1d2773409431d487399b95 ]
+
+The cgwb cleanup routine will try to release the dying cgwb by switching
+the attached inodes. It fetches the attached inodes from wb->b_attached
+list, omitting the fact that inodes only with dirty timestamps reside in
+wb->b_dirty_time list, which is the case when lazytime is enabled. This
+causes enormous zombie memory cgroup when lazytime is enabled, as inodes
+with dirty timestamps can not be switched to a live cgwb for a long time.
+
+It is reasonable not to switch cgwb for inodes with dirty data, as
+otherwise it may break the bandwidth restrictions. However since the
+writeback of inode metadata is not accounted for, let's also switch
+inodes with dirty timestamps to avoid zombie memory and block cgroups
+when laztytime is enabled.
+
+Fixes: c22d70a162d3 ("writeback, cgroup: release dying cgwbs by switching attached inodes")
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20231014125511.102978-1-jefflexu@linux.alibaba.com
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fs-writeback.c | 41 +++++++++++++++++++++++++++++------------
+ 1 file changed, 29 insertions(+), 12 deletions(-)
+
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index a5c31a479aacc..be2d329843d44 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -611,6 +611,24 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
+ kfree(isw);
+ }
+
++static bool isw_prepare_wbs_switch(struct inode_switch_wbs_context *isw,
++ struct list_head *list, int *nr)
++{
++ struct inode *inode;
++
++ list_for_each_entry(inode, list, i_io_list) {
++ if (!inode_prepare_wbs_switch(inode, isw->new_wb))
++ continue;
++
++ isw->inodes[*nr] = inode;
++ (*nr)++;
++
++ if (*nr >= WB_MAX_INODES_PER_ISW - 1)
++ return true;
++ }
++ return false;
++}
++
+ /**
+ * cleanup_offline_cgwb - detach associated inodes
+ * @wb: target wb
+@@ -623,7 +641,6 @@ bool cleanup_offline_cgwb(struct bdi_writeback *wb)
+ {
+ struct cgroup_subsys_state *memcg_css;
+ struct inode_switch_wbs_context *isw;
+- struct inode *inode;
+ int nr;
+ bool restart = false;
+
+@@ -645,17 +662,17 @@ bool cleanup_offline_cgwb(struct bdi_writeback *wb)
+
+ nr = 0;
+ spin_lock(&wb->list_lock);
+- list_for_each_entry(inode, &wb->b_attached, i_io_list) {
+- if (!inode_prepare_wbs_switch(inode, isw->new_wb))
+- continue;
+-
+- isw->inodes[nr++] = inode;
+-
+- if (nr >= WB_MAX_INODES_PER_ISW - 1) {
+- restart = true;
+- break;
+- }
+- }
++ /*
++ * In addition to the inodes that have completed writeback, also switch
++ * cgwbs for those inodes only with dirty timestamps. Otherwise, those
++ * inodes won't be written back for a long time when lazytime is
++ * enabled, and thus pinning the dying cgwbs. It won't break the
++ * bandwidth restrictions, as writeback of inode metadata is not
++ * accounted for.
++ */
++ restart = isw_prepare_wbs_switch(isw, &wb->b_attached, &nr);
++ if (!restart)
++ restart = isw_prepare_wbs_switch(isw, &wb->b_dirty_time, &nr);
+ spin_unlock(&wb->list_lock);
+
+ /* no attached inodes? bail out */
+--
+2.42.0
+
--- /dev/null
+From 75f1960eaba4655df7fa0966e4440038860efda3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Aug 2023 16:45:47 +0800
+Subject: x86/boot: Fix incorrect startup_gdt_descr.size
+
+From: Yuntao Wang <ytcoode@gmail.com>
+
+[ Upstream commit 001470fed5959d01faecbd57fcf2f60294da0de1 ]
+
+Since the size value is added to the base address to yield the last valid
+byte address of the GDT, the current size value of startup_gdt_descr is
+incorrect (too large by one), fix it.
+
+[ mingo: This probably never mattered, because startup_gdt[] is only used
+ in a very controlled fashion - but make it consistent nevertheless. ]
+
+Fixes: 866b556efa12 ("x86/head/64: Install startup GDT")
+Signed-off-by: Yuntao Wang <ytcoode@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Link: https://lore.kernel.org/r/20230807084547.217390-1-ytcoode@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/head64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
+index 6a3cfaf6b72ad..84adf12a76d3c 100644
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -80,7 +80,7 @@ static struct desc_struct startup_gdt[GDT_ENTRIES] = {
+ * while the kernel still uses a direct mapping.
+ */
+ static struct desc_ptr startup_gdt_descr = {
+- .size = sizeof(startup_gdt),
++ .size = sizeof(startup_gdt)-1,
+ .address = 0,
+ };
+
+--
+2.42.0
+
--- /dev/null
+From 629df80a4e8756382550c7d79b24c4801c0b62ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jul 2023 13:02:58 -0700
+Subject: x86/numa: Introduce numa_fill_memblks()
+
+From: Alison Schofield <alison.schofield@intel.com>
+
+[ Upstream commit 8f012db27c9516be1a7aca93ea4a6ca9c75056c9 ]
+
+numa_fill_memblks() fills in the gaps in numa_meminfo memblks
+over an physical address range.
+
+The ACPI driver will use numa_fill_memblks() to implement a new Linux
+policy that prescribes extending proximity domains in a portion of a
+CFMWS window to the entire window.
+
+Dan Williams offered this explanation of the policy:
+A CFWMS is an ACPI data structure that indicates *potential* locations
+where CXL memory can be placed. It is the playground where the CXL
+driver has free reign to establish regions. That space can be populated
+by BIOS created regions, or driver created regions, after hotplug or
+other reconfiguration.
+
+When BIOS creates a region in a CXL Window it additionally describes
+that subset of the Window range in the other typical ACPI tables SRAT,
+SLIT, and HMAT. The rationale for BIOS not pre-describing the entire
+CXL Window in SRAT, SLIT, and HMAT is that it can not predict the
+future. I.e. there is nothing stopping higher or lower performance
+devices being placed in the same Window. Compare that to ACPI memory
+hotplug that just onlines additional capacity in the proximity domain
+with little freedom for dynamic performance differentiation.
+
+That leaves the OS with a choice, should unpopulated window capacity
+match the proximity domain of an existing region, or should it allocate
+a new one? This patch takes the simple position of minimizing proximity
+domain proliferation by reusing any proximity domain intersection for
+the entire Window. If the Window has no intersections then allocate a
+new proximity domain. Note that SRAT, SLIT and HMAT information can be
+enumerated dynamically in a standard way from device provided data.
+Think of CXL as the end of ACPI needing to describe memory attributes,
+CXL offers a standard discovery model for performance attributes, but
+Linux still needs to interoperate with the old regime.
+
+Reported-by: Derick Marks <derick.w.marks@intel.com>
+Suggested-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Alison Schofield <alison.schofield@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Tested-by: Derick Marks <derick.w.marks@intel.com>
+Link: https://lore.kernel.org/all/ef078a6f056ca974e5af85997013c0fda9e3326d.1689018477.git.alison.schofield%40intel.com
+Stable-dep-of: 8f1004679987 ("ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/sparsemem.h | 2 +
+ arch/x86/mm/numa.c | 80 ++++++++++++++++++++++++++++++++
+ include/linux/numa.h | 7 +++
+ 3 files changed, 89 insertions(+)
+
+diff --git a/arch/x86/include/asm/sparsemem.h b/arch/x86/include/asm/sparsemem.h
+index 64df897c0ee30..1be13b2dfe8bf 100644
+--- a/arch/x86/include/asm/sparsemem.h
++++ b/arch/x86/include/asm/sparsemem.h
+@@ -37,6 +37,8 @@ extern int phys_to_target_node(phys_addr_t start);
+ #define phys_to_target_node phys_to_target_node
+ extern int memory_add_physaddr_to_nid(u64 start);
+ #define memory_add_physaddr_to_nid memory_add_physaddr_to_nid
++extern int numa_fill_memblks(u64 start, u64 end);
++#define numa_fill_memblks numa_fill_memblks
+ #endif
+ #endif /* __ASSEMBLY__ */
+
+diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
+index 2aadb2019b4f2..c01c5506fd4ae 100644
+--- a/arch/x86/mm/numa.c
++++ b/arch/x86/mm/numa.c
+@@ -11,6 +11,7 @@
+ #include <linux/nodemask.h>
+ #include <linux/sched.h>
+ #include <linux/topology.h>
++#include <linux/sort.h>
+
+ #include <asm/e820/api.h>
+ #include <asm/proto.h>
+@@ -961,4 +962,83 @@ int memory_add_physaddr_to_nid(u64 start)
+ return nid;
+ }
+ EXPORT_SYMBOL_GPL(memory_add_physaddr_to_nid);
++
++static int __init cmp_memblk(const void *a, const void *b)
++{
++ const struct numa_memblk *ma = *(const struct numa_memblk **)a;
++ const struct numa_memblk *mb = *(const struct numa_memblk **)b;
++
++ return ma->start - mb->start;
++}
++
++static struct numa_memblk *numa_memblk_list[NR_NODE_MEMBLKS] __initdata;
++
++/**
++ * numa_fill_memblks - Fill gaps in numa_meminfo memblks
++ * @start: address to begin fill
++ * @end: address to end fill
++ *
++ * Find and extend numa_meminfo memblks to cover the @start-@end
++ * physical address range, such that the first memblk includes
++ * @start, the last memblk includes @end, and any gaps in between
++ * are filled.
++ *
++ * RETURNS:
++ * 0 : Success
++ * NUMA_NO_MEMBLK : No memblk exists in @start-@end range
++ */
++
++int __init numa_fill_memblks(u64 start, u64 end)
++{
++ struct numa_memblk **blk = &numa_memblk_list[0];
++ struct numa_meminfo *mi = &numa_meminfo;
++ int count = 0;
++ u64 prev_end;
++
++ /*
++ * Create a list of pointers to numa_meminfo memblks that
++ * overlap start, end. Exclude (start == bi->end) since
++ * end addresses in both a CFMWS range and a memblk range
++ * are exclusive.
++ *
++ * This list of pointers is used to make in-place changes
++ * that fill out the numa_meminfo memblks.
++ */
++ for (int i = 0; i < mi->nr_blks; i++) {
++ struct numa_memblk *bi = &mi->blk[i];
++
++ if (start < bi->end && end >= bi->start) {
++ blk[count] = &mi->blk[i];
++ count++;
++ }
++ }
++ if (!count)
++ return NUMA_NO_MEMBLK;
++
++ /* Sort the list of pointers in memblk->start order */
++ sort(&blk[0], count, sizeof(blk[0]), cmp_memblk, NULL);
++
++ /* Make sure the first/last memblks include start/end */
++ blk[0]->start = min(blk[0]->start, start);
++ blk[count - 1]->end = max(blk[count - 1]->end, end);
++
++ /*
++ * Fill any gaps by tracking the previous memblks
++ * end address and backfilling to it if needed.
++ */
++ prev_end = blk[0]->end;
++ for (int i = 1; i < count; i++) {
++ struct numa_memblk *curr = blk[i];
++
++ if (prev_end >= curr->start) {
++ if (prev_end < curr->end)
++ prev_end = curr->end;
++ } else {
++ curr->start = prev_end;
++ prev_end = curr->end;
++ }
++ }
++ return 0;
++}
++
+ #endif
+diff --git a/include/linux/numa.h b/include/linux/numa.h
+index 59df211d051fa..0f512c0aba54b 100644
+--- a/include/linux/numa.h
++++ b/include/linux/numa.h
+@@ -12,6 +12,7 @@
+ #define MAX_NUMNODES (1 << NODES_SHIFT)
+
+ #define NUMA_NO_NODE (-1)
++#define NUMA_NO_MEMBLK (-1)
+
+ /* optionally keep NUMA memory info available post init */
+ #ifdef CONFIG_NUMA_KEEP_MEMINFO
+@@ -43,6 +44,12 @@ static inline int phys_to_target_node(u64 start)
+ return 0;
+ }
+ #endif
++#ifndef numa_fill_memblks
++static inline int __init numa_fill_memblks(u64 start, u64 end)
++{
++ return NUMA_NO_MEMBLK;
++}
++#endif
+ #else /* !CONFIG_NUMA */
+ static inline int numa_map_to_online_node(int node)
+ {
+--
+2.42.0
+
--- /dev/null
+From f6ed1ba81105bcff95b3d628872d111d530d988e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 20:24:49 +0100
+Subject: x86/sev: Change snp_guest_issue_request()'s fw_err argument
+
+From: Dionna Glaze <dionnaglaze@google.com>
+
+[ Upstream commit 0144e3b85d7b42e8a4cda991c0e81f131897457a ]
+
+The GHCB specification declares that the firmware error value for
+a guest request will be stored in the lower 32 bits of EXIT_INFO_2. The
+upper 32 bits are for the VMM's own error code. The fw_err argument to
+snp_guest_issue_request() is thus a misnomer, and callers will need
+access to all 64 bits.
+
+The type of unsigned long also causes problems, since sw_exit_info2 is
+u64 (unsigned long long) vs the argument's unsigned long*. Change this
+type for issuing the guest request. Pass the ioctl command struct's error
+field directly instead of in a local variable, since an incomplete guest
+request may not set the error code, and uninitialized stack memory would
+be written back to user space.
+
+The firmware might not even be called, so bookend the call with the no
+firmware call error and clear the error.
+
+Since the "fw_err" field is really exitinfo2 split into the upper bits'
+vmm error code and lower bits' firmware error code, convert the 64 bit
+value to a union.
+
+ [ bp:
+ - Massage commit message
+ - adjust code
+ - Fix a build issue as
+ Reported-by: kernel test robot <lkp@intel.com>
+ Link: https://lore.kernel.org/oe-kbuild-all/202303070609.vX6wp2Af-lkp@intel.com
+ - print exitinfo2 in hex
+ Tom:
+ - Correct -EIO exit case. ]
+
+Signed-off-by: Dionna Glaze <dionnaglaze@google.com>
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230214164638.1189804-5-dionnaglaze@google.com
+Link: https://lore.kernel.org/r/20230307192449.24732-12-bp@alien8.de
+Stable-dep-of: db10cb9b5746 ("virt: sevguest: Fix passing a stack buffer as a scatterlist target")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/virt/coco/sev-guest.rst | 20 ++++---
+ arch/x86/include/asm/sev-common.h | 4 --
+ arch/x86/include/asm/sev.h | 10 ++--
+ arch/x86/kernel/sev.c | 15 +++---
+ drivers/virt/coco/sev-guest/sev-guest.c | 72 +++++++++++++------------
+ include/uapi/linux/sev-guest.h | 18 ++++++-
+ 6 files changed, 83 insertions(+), 56 deletions(-)
+
+diff --git a/Documentation/virt/coco/sev-guest.rst b/Documentation/virt/coco/sev-guest.rst
+index aa3e4c6a1f90c..68b0d2363af82 100644
+--- a/Documentation/virt/coco/sev-guest.rst
++++ b/Documentation/virt/coco/sev-guest.rst
+@@ -37,11 +37,11 @@ along with a description:
+ the return value. General error numbers (-ENOMEM, -EINVAL)
+ are not detailed, but errors with specific meanings are.
+
+-The guest ioctl should be issued on a file descriptor of the /dev/sev-guest device.
+-The ioctl accepts struct snp_user_guest_request. The input and output structure is
+-specified through the req_data and resp_data field respectively. If the ioctl fails
+-to execute due to a firmware error, then fw_err code will be set. Otherwise, fw_err
+-will be set to 0x00000000ffffffff, i.e., the lower 32-bits are -1.
++The guest ioctl should be issued on a file descriptor of the /dev/sev-guest
++device. The ioctl accepts struct snp_user_guest_request. The input and
++output structure is specified through the req_data and resp_data field
++respectively. If the ioctl fails to execute due to a firmware error, then
++the fw_error code will be set, otherwise fw_error will be set to -1.
+
+ The firmware checks that the message sequence counter is one greater than
+ the guests message sequence counter. If guest driver fails to increment message
+@@ -57,8 +57,14 @@ counter (e.g. counter overflow), then -EIO will be returned.
+ __u64 req_data;
+ __u64 resp_data;
+
+- /* firmware error code on failure (see psp-sev.h) */
+- __u64 fw_err;
++ /* bits[63:32]: VMM error code, bits[31:0] firmware error code (see psp-sev.h) */
++ union {
++ __u64 exitinfo2;
++ struct {
++ __u32 fw_error;
++ __u32 vmm_error;
++ };
++ };
+ };
+
+ 2.1 SNP_GET_REPORT
+diff --git a/arch/x86/include/asm/sev-common.h b/arch/x86/include/asm/sev-common.h
+index b63be696b776a..0759af9b1acfc 100644
+--- a/arch/x86/include/asm/sev-common.h
++++ b/arch/x86/include/asm/sev-common.h
+@@ -128,10 +128,6 @@ struct snp_psc_desc {
+ struct psc_entry entries[VMGEXIT_PSC_MAX_ENTRY];
+ } __packed;
+
+-/* Guest message request error codes */
+-#define SNP_GUEST_REQ_INVALID_LEN BIT_ULL(32)
+-#define SNP_GUEST_REQ_ERR_BUSY BIT_ULL(33)
+-
+ #define GHCB_MSR_TERM_REQ 0x100
+ #define GHCB_MSR_TERM_REASON_SET_POS 12
+ #define GHCB_MSR_TERM_REASON_SET_MASK 0xf
+diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h
+index a0a58c4122ec3..7ca5c9ec8b52e 100644
+--- a/arch/x86/include/asm/sev.h
++++ b/arch/x86/include/asm/sev.h
+@@ -9,6 +9,8 @@
+ #define __ASM_ENCRYPTED_STATE_H
+
+ #include <linux/types.h>
++#include <linux/sev-guest.h>
++
+ #include <asm/insn.h>
+ #include <asm/sev-common.h>
+ #include <asm/bootparam.h>
+@@ -185,6 +187,9 @@ static inline int pvalidate(unsigned long vaddr, bool rmp_psize, bool validate)
+
+ return rc;
+ }
++
++struct snp_guest_request_ioctl;
++
+ void setup_ghcb(void);
+ void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr,
+ unsigned long npages);
+@@ -196,7 +201,7 @@ void snp_set_memory_private(unsigned long vaddr, unsigned long npages);
+ void snp_set_wakeup_secondary_cpu(void);
+ bool snp_init(struct boot_params *bp);
+ void __init __noreturn snp_abort(void);
+-int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, unsigned long *fw_err);
++int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, struct snp_guest_request_ioctl *rio);
+ #else
+ static inline void sev_es_ist_enter(struct pt_regs *regs) { }
+ static inline void sev_es_ist_exit(void) { }
+@@ -216,8 +221,7 @@ static inline void snp_set_memory_private(unsigned long vaddr, unsigned long npa
+ static inline void snp_set_wakeup_secondary_cpu(void) { }
+ static inline bool snp_init(struct boot_params *bp) { return false; }
+ static inline void snp_abort(void) { }
+-static inline int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input,
+- unsigned long *fw_err)
++static inline int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, struct snp_guest_request_ioctl *rio)
+ {
+ return -ENOTTY;
+ }
+diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c
+index e7968c41ecf57..68b2a9d3dbc6b 100644
+--- a/arch/x86/kernel/sev.c
++++ b/arch/x86/kernel/sev.c
+@@ -22,6 +22,8 @@
+ #include <linux/efi.h>
+ #include <linux/platform_device.h>
+ #include <linux/io.h>
++#include <linux/psp-sev.h>
++#include <uapi/linux/sev-guest.h>
+
+ #include <asm/cpu_entry_area.h>
+ #include <asm/stacktrace.h>
+@@ -2205,7 +2207,7 @@ static int __init init_sev_config(char *str)
+ }
+ __setup("sev=", init_sev_config);
+
+-int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, unsigned long *fw_err)
++int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, struct snp_guest_request_ioctl *rio)
+ {
+ struct ghcb_state state;
+ struct es_em_ctxt ctxt;
+@@ -2213,8 +2215,7 @@ int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, unsigned
+ struct ghcb *ghcb;
+ int ret;
+
+- if (!fw_err)
+- return -EINVAL;
++ rio->exitinfo2 = SEV_RET_NO_FW_CALL;
+
+ /*
+ * __sev_get_ghcb() needs to run with IRQs disabled because it is using
+@@ -2239,16 +2240,16 @@ int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, unsigned
+ if (ret)
+ goto e_put;
+
+- *fw_err = ghcb->save.sw_exit_info_2;
+- switch (*fw_err) {
++ rio->exitinfo2 = ghcb->save.sw_exit_info_2;
++ switch (rio->exitinfo2) {
+ case 0:
+ break;
+
+- case SNP_GUEST_REQ_ERR_BUSY:
++ case SNP_GUEST_VMM_ERR(SNP_GUEST_VMM_ERR_BUSY):
+ ret = -EAGAIN;
+ break;
+
+- case SNP_GUEST_REQ_INVALID_LEN:
++ case SNP_GUEST_VMM_ERR(SNP_GUEST_VMM_ERR_INVALID_LEN):
+ /* Number of expected pages are returned in RBX */
+ if (exit_code == SVM_VMGEXIT_EXT_GUEST_REQUEST) {
+ input->data_npages = ghcb_get_rbx(ghcb);
+diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c
+index 9e172f66a8edb..5cdc972e5ef4a 100644
+--- a/drivers/virt/coco/sev-guest/sev-guest.c
++++ b/drivers/virt/coco/sev-guest/sev-guest.c
+@@ -334,11 +334,12 @@ static int enc_payload(struct snp_guest_dev *snp_dev, u64 seqno, int version, u8
+ return __enc_payload(snp_dev, req, payload, sz);
+ }
+
+-static int __handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, __u64 *fw_err)
++static int __handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code,
++ struct snp_guest_request_ioctl *rio)
+ {
+- unsigned long err = 0xff, override_err = 0;
+ unsigned long req_start = jiffies;
+ unsigned int override_npages = 0;
++ u64 override_err = 0;
+ int rc;
+
+ retry_request:
+@@ -348,7 +349,7 @@ static int __handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code,
+ * sequence number must be incremented or the VMPCK must be deleted to
+ * prevent reuse of the IV.
+ */
+- rc = snp_issue_guest_request(exit_code, &snp_dev->input, &err);
++ rc = snp_issue_guest_request(exit_code, &snp_dev->input, rio);
+ switch (rc) {
+ case -ENOSPC:
+ /*
+@@ -366,7 +367,7 @@ static int __handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code,
+ * request buffer size was too small and give the caller the
+ * required buffer size.
+ */
+- override_err = SNP_GUEST_REQ_INVALID_LEN;
++ override_err = SNP_GUEST_VMM_ERR(SNP_GUEST_VMM_ERR_INVALID_LEN);
+
+ /*
+ * If this call to the firmware succeeds, the sequence number can
+@@ -379,7 +380,7 @@ static int __handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code,
+ goto retry_request;
+
+ /*
+- * The host may return SNP_GUEST_REQ_ERR_EBUSY if the request has been
++ * The host may return SNP_GUEST_VMM_ERR_BUSY if the request has been
+ * throttled. Retry in the driver to avoid returning and reusing the
+ * message sequence number on a different message.
+ */
+@@ -400,27 +401,29 @@ static int __handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code,
+ */
+ snp_inc_msg_seqno(snp_dev);
+
+- if (fw_err)
+- *fw_err = override_err ?: err;
++ if (override_err) {
++ rio->exitinfo2 = override_err;
++
++ /*
++ * If an extended guest request was issued and the supplied certificate
++ * buffer was not large enough, a standard guest request was issued to
++ * prevent IV reuse. If the standard request was successful, return -EIO
++ * back to the caller as would have originally been returned.
++ */
++ if (!rc && override_err == SNP_GUEST_VMM_ERR(SNP_GUEST_VMM_ERR_INVALID_LEN))
++ rc = -EIO;
++ }
+
+ if (override_npages)
+ snp_dev->input.data_npages = override_npages;
+
+- /*
+- * If an extended guest request was issued and the supplied certificate
+- * buffer was not large enough, a standard guest request was issued to
+- * prevent IV reuse. If the standard request was successful, return -EIO
+- * back to the caller as would have originally been returned.
+- */
+- if (!rc && override_err == SNP_GUEST_REQ_INVALID_LEN)
+- return -EIO;
+-
+ return rc;
+ }
+
+-static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, int msg_ver,
+- u8 type, void *req_buf, size_t req_sz, void *resp_buf,
+- u32 resp_sz, __u64 *fw_err)
++static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code,
++ struct snp_guest_request_ioctl *rio, u8 type,
++ void *req_buf, size_t req_sz, void *resp_buf,
++ u32 resp_sz)
+ {
+ u64 seqno;
+ int rc;
+@@ -434,7 +437,7 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in
+ memset(snp_dev->response, 0, sizeof(struct snp_guest_msg));
+
+ /* Encrypt the userspace provided payload in snp_dev->secret_request. */
+- rc = enc_payload(snp_dev, seqno, msg_ver, type, req_buf, req_sz);
++ rc = enc_payload(snp_dev, seqno, rio->msg_version, type, req_buf, req_sz);
+ if (rc)
+ return rc;
+
+@@ -445,12 +448,16 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in
+ memcpy(snp_dev->request, &snp_dev->secret_request,
+ sizeof(snp_dev->secret_request));
+
+- rc = __handle_guest_request(snp_dev, exit_code, fw_err);
++ rc = __handle_guest_request(snp_dev, exit_code, rio);
+ if (rc) {
+- if (rc == -EIO && *fw_err == SNP_GUEST_REQ_INVALID_LEN)
++ if (rc == -EIO &&
++ rio->exitinfo2 == SNP_GUEST_VMM_ERR(SNP_GUEST_VMM_ERR_INVALID_LEN))
+ return rc;
+
+- dev_alert(snp_dev->dev, "Detected error from ASP request. rc: %d, fw_err: %llu\n", rc, *fw_err);
++ dev_alert(snp_dev->dev,
++ "Detected error from ASP request. rc: %d, exitinfo2: 0x%llx\n",
++ rc, rio->exitinfo2);
++
+ snp_disable_vmpck(snp_dev);
+ return rc;
+ }
+@@ -490,9 +497,9 @@ static int get_report(struct snp_guest_dev *snp_dev, struct snp_guest_request_io
+ if (!resp)
+ return -ENOMEM;
+
+- rc = handle_guest_request(snp_dev, SVM_VMGEXIT_GUEST_REQUEST, arg->msg_version,
++ rc = handle_guest_request(snp_dev, SVM_VMGEXIT_GUEST_REQUEST, arg,
+ SNP_MSG_REPORT_REQ, &req, sizeof(req), resp->data,
+- resp_len, &arg->fw_err);
++ resp_len);
+ if (rc)
+ goto e_free;
+
+@@ -530,9 +537,8 @@ static int get_derived_key(struct snp_guest_dev *snp_dev, struct snp_guest_reque
+ if (copy_from_user(&req, (void __user *)arg->req_data, sizeof(req)))
+ return -EFAULT;
+
+- rc = handle_guest_request(snp_dev, SVM_VMGEXIT_GUEST_REQUEST, arg->msg_version,
+- SNP_MSG_KEY_REQ, &req, sizeof(req), buf, resp_len,
+- &arg->fw_err);
++ rc = handle_guest_request(snp_dev, SVM_VMGEXIT_GUEST_REQUEST, arg,
++ SNP_MSG_KEY_REQ, &req, sizeof(req), buf, resp_len);
+ if (rc)
+ return rc;
+
+@@ -592,12 +598,12 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques
+ return -ENOMEM;
+
+ snp_dev->input.data_npages = npages;
+- ret = handle_guest_request(snp_dev, SVM_VMGEXIT_EXT_GUEST_REQUEST, arg->msg_version,
++ ret = handle_guest_request(snp_dev, SVM_VMGEXIT_EXT_GUEST_REQUEST, arg,
+ SNP_MSG_REPORT_REQ, &req.data,
+- sizeof(req.data), resp->data, resp_len, &arg->fw_err);
++ sizeof(req.data), resp->data, resp_len);
+
+ /* If certs length is invalid then copy the returned length */
+- if (arg->fw_err == SNP_GUEST_REQ_INVALID_LEN) {
++ if (arg->vmm_error == SNP_GUEST_VMM_ERR_INVALID_LEN) {
+ req.certs_len = snp_dev->input.data_npages << PAGE_SHIFT;
+
+ if (copy_to_user((void __user *)arg->req_data, &req, sizeof(req)))
+@@ -632,7 +638,7 @@ static long snp_guest_ioctl(struct file *file, unsigned int ioctl, unsigned long
+ if (copy_from_user(&input, argp, sizeof(input)))
+ return -EFAULT;
+
+- input.fw_err = 0xff;
++ input.exitinfo2 = 0xff;
+
+ /* Message version must be non-zero */
+ if (!input.msg_version)
+@@ -663,7 +669,7 @@ static long snp_guest_ioctl(struct file *file, unsigned int ioctl, unsigned long
+
+ mutex_unlock(&snp_cmd_mutex);
+
+- if (input.fw_err && copy_to_user(argp, &input, sizeof(input)))
++ if (input.exitinfo2 && copy_to_user(argp, &input, sizeof(input)))
+ return -EFAULT;
+
+ return ret;
+diff --git a/include/uapi/linux/sev-guest.h b/include/uapi/linux/sev-guest.h
+index 256aaeff7e654..2aa39112cf8dd 100644
+--- a/include/uapi/linux/sev-guest.h
++++ b/include/uapi/linux/sev-guest.h
+@@ -52,8 +52,14 @@ struct snp_guest_request_ioctl {
+ __u64 req_data;
+ __u64 resp_data;
+
+- /* firmware error code on failure (see psp-sev.h) */
+- __u64 fw_err;
++ /* bits[63:32]: VMM error code, bits[31:0] firmware error code (see psp-sev.h) */
++ union {
++ __u64 exitinfo2;
++ struct {
++ __u32 fw_error;
++ __u32 vmm_error;
++ };
++ };
+ };
+
+ struct snp_ext_report_req {
+@@ -77,4 +83,12 @@ struct snp_ext_report_req {
+ /* Get SNP extended report as defined in the GHCB specification version 2. */
+ #define SNP_GET_EXT_REPORT _IOWR(SNP_GUEST_REQ_IOC_TYPE, 0x2, struct snp_guest_request_ioctl)
+
++/* Guest message request EXIT_INFO_2 constants */
++#define SNP_GUEST_FW_ERR_MASK GENMASK_ULL(31, 0)
++#define SNP_GUEST_VMM_ERR_SHIFT 32
++#define SNP_GUEST_VMM_ERR(x) (((u64)x) << SNP_GUEST_VMM_ERR_SHIFT)
++
++#define SNP_GUEST_VMM_ERR_INVALID_LEN 1
++#define SNP_GUEST_VMM_ERR_BUSY 2
++
+ #endif /* __UAPI_LINUX_SEV_GUEST_H_ */
+--
+2.42.0
+
--- /dev/null
+From ea17b69e0c4203d588c30bc3f02290af9d542236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 17:27:02 -0700
+Subject: x86/sev-es: Allow copy_from_kernel_nofault() in earlier boot
+
+From: Adam Dunlap <acdunlap@google.com>
+
+[ Upstream commit f79936545fb122856bd78b189d3c7ee59928c751 ]
+
+Previously, if copy_from_kernel_nofault() was called before
+boot_cpu_data.x86_virt_bits was set up, then it would trigger undefined
+behavior due to a shift by 64.
+
+This ended up causing boot failures in the latest version of ubuntu2204
+in the gcp project when using SEV-SNP.
+
+Specifically, this function is called during an early #VC handler which
+is triggered by a CPUID to check if NX is implemented.
+
+Fixes: 1aa9aa8ee517 ("x86/sev-es: Setup GHCB-based boot #VC handler")
+Suggested-by: Dave Hansen <dave.hansen@linux.intel.com>
+Signed-off-by: Adam Dunlap <acdunlap@google.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Jacob Xu <jacobhxu@google.com>
+Link: https://lore.kernel.org/r/20230912002703.3924521-2-acdunlap@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/maccess.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/mm/maccess.c b/arch/x86/mm/maccess.c
+index 5a53c2cc169cc..6993f026adec9 100644
+--- a/arch/x86/mm/maccess.c
++++ b/arch/x86/mm/maccess.c
+@@ -9,12 +9,21 @@ bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)
+ unsigned long vaddr = (unsigned long)unsafe_src;
+
+ /*
+- * Range covering the highest possible canonical userspace address
+- * as well as non-canonical address range. For the canonical range
+- * we also need to include the userspace guard page.
++ * Do not allow userspace addresses. This disallows
++ * normal userspace and the userspace guard page:
+ */
+- return vaddr >= TASK_SIZE_MAX + PAGE_SIZE &&
+- __is_canonical_address(vaddr, boot_cpu_data.x86_virt_bits);
++ if (vaddr < TASK_SIZE_MAX + PAGE_SIZE)
++ return false;
++
++ /*
++ * Allow everything during early boot before 'x86_virt_bits'
++ * is initialized. Needed for instruction decoding in early
++ * exception handlers.
++ */
++ if (!boot_cpu_data.x86_virt_bits)
++ return true;
++
++ return __is_canonical_address(vaddr, boot_cpu_data.x86_virt_bits);
+ }
+ #else
+ bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)
+--
+2.42.0
+
--- /dev/null
+From 3d57e08f933720076069112f723b6fab75a8a509 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Sep 2023 22:04:49 -0700
+Subject: x86/srso: Fix SBPB enablement for (possible) future fixed HW
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit 1d1142ac51307145dbb256ac3535a1d43a1c9800 ]
+
+Make the SBPB check more robust against the (possible) case where future
+HW has SRSO fixed but doesn't have the SRSO_NO bit set.
+
+Fixes: 1b5277c0ea0b ("x86/srso: Add SRSO_NO support")
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/cee5050db750b391c9f35f5334f8ff40e66c01b9.1693889988.git.jpoimboe@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/bugs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 263df737d5cd5..13dffc43ded02 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -2477,7 +2477,7 @@ static void __init srso_select_mitigation(void)
+ pr_info("%s%s\n", srso_strings[srso_mitigation], (has_microcode ? "" : ", no microcode"));
+
+ pred_cmd:
+- if ((boot_cpu_has(X86_FEATURE_SRSO_NO) || srso_cmd == SRSO_CMD_OFF) &&
++ if ((!boot_cpu_has_bug(X86_BUG_SRSO) || srso_cmd == SRSO_CMD_OFF) &&
+ boot_cpu_has(X86_FEATURE_SBPB))
+ x86_pred_cmd = PRED_CMD_SBPB;
+ }
+--
+2.42.0
+
--- /dev/null
+From f0dbf20cc4dc935044bcd094d40dc6c8c66305b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 15:13:25 +0200
+Subject: xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+
+[ Upstream commit 2c269f42d0f382743ab230308b836ffe5ae9b2ae ]
+
+Linux enables MSI-X before disabling INTx, but keeps MSI-X masked until
+the table is filled. Then it disables INTx just before clearing MASKALL
+bit. Currently this approach is rejected by xen-pciback.
+According to the PCIe spec, device cannot use INTx when MSI/MSI-X is
+enabled (in other words: enabling MSI/MSI-X implicitly disables INTx).
+
+Change the logic to consider INTx disabled if MSI/MSI-X is enabled. This
+applies to three places:
+ - checking currently enabled interrupts type,
+ - transition to MSI/MSI-X - where INTx would be implicitly disabled,
+ - clearing INTx disable bit - which can be allowed even if MSI/MSI-X is
+ enabled, as device should consider INTx disabled anyway in that case
+
+Fixes: 5e29500eba2a ("xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too")
+Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Acked-by: Juergen Gross <jgross@suse.com>
+Link: https://lore.kernel.org/r/20231016131348.1734721-1-marmarek@invisiblethingslab.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xen-pciback/conf_space.c | 19 +++++++++++------
+ .../xen/xen-pciback/conf_space_capability.c | 8 ++++++-
+ drivers/xen/xen-pciback/conf_space_header.c | 21 +++----------------
+ 3 files changed, 23 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
+index 059de92aea7d0..d47eee6c51435 100644
+--- a/drivers/xen/xen-pciback/conf_space.c
++++ b/drivers/xen/xen-pciback/conf_space.c
+@@ -288,12 +288,6 @@ int xen_pcibk_get_interrupt_type(struct pci_dev *dev)
+ u16 val;
+ int ret = 0;
+
+- err = pci_read_config_word(dev, PCI_COMMAND, &val);
+- if (err)
+- return err;
+- if (!(val & PCI_COMMAND_INTX_DISABLE))
+- ret |= INTERRUPT_TYPE_INTX;
+-
+ /*
+ * Do not trust dev->msi(x)_enabled here, as enabling could be done
+ * bypassing the pci_*msi* functions, by the qemu.
+@@ -316,6 +310,19 @@ int xen_pcibk_get_interrupt_type(struct pci_dev *dev)
+ if (val & PCI_MSIX_FLAGS_ENABLE)
+ ret |= INTERRUPT_TYPE_MSIX;
+ }
++
++ /*
++ * PCIe spec says device cannot use INTx if MSI/MSI-X is enabled,
++ * so check for INTx only when both are disabled.
++ */
++ if (!ret) {
++ err = pci_read_config_word(dev, PCI_COMMAND, &val);
++ if (err)
++ return err;
++ if (!(val & PCI_COMMAND_INTX_DISABLE))
++ ret |= INTERRUPT_TYPE_INTX;
++ }
++
+ return ret ?: INTERRUPT_TYPE_NONE;
+ }
+
+diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c
+index 097316a741268..1948a9700c8fa 100644
+--- a/drivers/xen/xen-pciback/conf_space_capability.c
++++ b/drivers/xen/xen-pciback/conf_space_capability.c
+@@ -236,10 +236,16 @@ static int msi_msix_flags_write(struct pci_dev *dev, int offset, u16 new_value,
+ return PCIBIOS_SET_FAILED;
+
+ if (new_value & field_config->enable_bit) {
+- /* don't allow enabling together with other interrupt types */
++ /*
++ * Don't allow enabling together with other interrupt type, but do
++ * allow enabling MSI(-X) while INTx is still active to please Linuxes
++ * MSI(-X) startup sequence. It is safe to do, as according to PCI
++ * spec, device with enabled MSI(-X) shouldn't use INTx.
++ */
+ int int_type = xen_pcibk_get_interrupt_type(dev);
+
+ if (int_type == INTERRUPT_TYPE_NONE ||
++ int_type == INTERRUPT_TYPE_INTX ||
+ int_type == field_config->int_type)
+ goto write;
+ return PCIBIOS_SET_FAILED;
+diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
+index 981435103af1a..fc03326459664 100644
+--- a/drivers/xen/xen-pciback/conf_space_header.c
++++ b/drivers/xen/xen-pciback/conf_space_header.c
+@@ -104,24 +104,9 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
+ pci_clear_mwi(dev);
+ }
+
+- if (dev_data && dev_data->allow_interrupt_control) {
+- if ((cmd->val ^ value) & PCI_COMMAND_INTX_DISABLE) {
+- if (value & PCI_COMMAND_INTX_DISABLE) {
+- pci_intx(dev, 0);
+- } else {
+- /* Do not allow enabling INTx together with MSI or MSI-X. */
+- switch (xen_pcibk_get_interrupt_type(dev)) {
+- case INTERRUPT_TYPE_NONE:
+- pci_intx(dev, 1);
+- break;
+- case INTERRUPT_TYPE_INTX:
+- break;
+- default:
+- return PCIBIOS_SET_FAILED;
+- }
+- }
+- }
+- }
++ if (dev_data && dev_data->allow_interrupt_control &&
++ ((cmd->val ^ value) & PCI_COMMAND_INTX_DISABLE))
++ pci_intx(dev, !(value & PCI_COMMAND_INTX_DISABLE));
+
+ cmd->val = value;
+
+--
+2.42.0
+
--- /dev/null
+From 0e0c915355f98d196e2b211edba4b9ae7b5317b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Aug 2023 11:11:38 +0200
+Subject: xenbus: fix error exit in xenbus_init()
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit 44961b81a9e9059b5c0443643915386db7035227 ]
+
+In case an error occurs in xenbus_init(), xen_store_domain_type should
+be set to XS_UNKNOWN.
+
+Fix one instance where this action is missing.
+
+Fixes: 5b3353949e89 ("xen: add support for initializing xenstore later as HVM domain")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/202304200845.w7m4kXZr-lkp@intel.com/
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
+Link: https://lore.kernel.org/r/20230822091138.4765-1-jgross@suse.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_probe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
+index 639bf628389ba..3205e5d724c8c 100644
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -1025,7 +1025,7 @@ static int __init xenbus_init(void)
+ if (err < 0) {
+ pr_err("xenstore_late_init couldn't bind irq err=%d\n",
+ err);
+- return err;
++ goto out_error;
+ }
+
+ xs_init_irq = err;
+--
+2.42.0
+
--- /dev/null
+From 95268653105a914d44b86dec3db3e0f119d2a9ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 13:29:19 +0300
+Subject: xhci: Loosen RPM as default policy to cover for AMD xHC 1.1
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 4baf1218150985ee3ab0a27220456a1f027ea0ac ]
+
+The AMD USB host controller (1022:43f7) isn't going into PCI D3 by default
+without anything connected. This is because the policy that was introduced
+by commit a611bf473d1f ("xhci-pci: Set runtime PM as default policy on all
+xHC 1.2 or later devices") only covered 1.2 or later.
+
+The 1.1 specification also has the same requirement as the 1.2
+specification for D3 support. So expand the runtime PM as default policy
+to all AMD 1.1 devices as well.
+
+Fixes: a611bf473d1f ("xhci-pci: Set runtime PM as default policy on all xHC 1.2 or later devices")
+Link: https://composter.com.ua/documents/xHCI_Specification_for_USB.pdf
+Co-developed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20231019102924.2797346-15-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 2aed88c28ef69..c4dd648710ae0 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -348,6 +348,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ /* xHC spec requires PCI devices to support D3hot and D3cold */
+ if (xhci->hci_version >= 0x120)
+ xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
++ else if (pdev->vendor == PCI_VENDOR_ID_AMD && xhci->hci_version >= 0x110)
++ xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
+
+ if (xhci->quirks & XHCI_RESET_ON_RESUME)
+ xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
+--
+2.42.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
