--- /dev/null
+From 2fd9911fe2b28f9ad1c5601c99324885063cee03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 00:26:09 +0800
+Subject: ACPI: make remove callback of ACPI driver void
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dawei Li <set_pte_at@outlook.com>
+
+[ Upstream commit 6c0eb5ba3500f6da367351ff3c4452c029cb72fa ]
+
+For bus-based driver, device removal is implemented as:
+1 device_remove()->
+2 bus->remove()->
+3 driver->remove()
+
+Driver core needs no inform from callee(bus driver) about the
+result of remove callback. In that case, commit fc7a6209d571
+("bus: Make remove callback return void") forces bus_type::remove
+be void-returned.
+
+Now we have the situation that both 1 & 2 of calling chain are
+void-returned, so it does not make much sense for 3(driver->remove)
+to return non-void to its caller.
+
+So the basic idea behind this change is making remove() callback of
+any bus-based driver to be void-returned.
+
+This change, for itself, is for device drivers based on acpi-bus.
+
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Lee Jones <lee@kernel.org>
+Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Dawei Li <set_pte_at@outlook.com>
+Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com> # for drivers/platform/surface/*
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: 966cca72ab20 ("platform/x86/dell/dell-rbtn: Fix resources leaking on error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/hp/common/aml_nfw.c | 4 ++--
+ arch/x86/platform/olpc/olpc-xo15-sci.c | 3 +--
+ drivers/acpi/ac.c | 8 +++-----
+ drivers/acpi/acpi_pad.c | 3 +--
+ drivers/acpi/acpi_video.c | 8 +++-----
+ drivers/acpi/battery.c | 5 ++---
+ drivers/acpi/button.c | 5 ++---
+ drivers/acpi/ec.c | 5 ++---
+ drivers/acpi/hed.c | 3 +--
+ drivers/acpi/nfit/core.c | 3 +--
+ drivers/acpi/sbs.c | 9 ++++-----
+ drivers/acpi/sbshc.c | 7 +++----
+ drivers/acpi/thermal.c | 7 +++----
+ drivers/acpi/tiny-power-button.c | 10 +++++++---
+ drivers/char/sonypi.c | 3 +--
+ drivers/char/tpm/tpm_crb.c | 4 +---
+ drivers/hv/vmbus_drv.c | 4 +---
+ drivers/hwmon/acpi_power_meter.c | 5 ++---
+ drivers/hwmon/asus_atk0110.c | 6 ++----
+ drivers/input/misc/atlas_btns.c | 4 +---
+ drivers/net/fjes/fjes_main.c | 4 +---
+ .../platform/chrome/chromeos_privacy_screen.c | 3 +--
+ drivers/platform/chrome/wilco_ec/event.c | 4 +---
+ drivers/platform/surface/surfacepro3_button.c | 3 +--
+ drivers/platform/x86/asus-laptop.c | 3 +--
+ drivers/platform/x86/asus-wireless.c | 3 +--
+ drivers/platform/x86/classmate-laptop.c | 20 +++++++++----------
+ drivers/platform/x86/dell/dell-rbtn.c | 6 ++----
+ drivers/platform/x86/eeepc-laptop.c | 3 +--
+ drivers/platform/x86/fujitsu-laptop.c | 4 +---
+ drivers/platform/x86/fujitsu-tablet.c | 3 +--
+ drivers/platform/x86/intel/rst.c | 4 +---
+ drivers/platform/x86/lg-laptop.c | 4 +---
+ drivers/platform/x86/panasonic-laptop.c | 8 +++-----
+ drivers/platform/x86/sony-laptop.c | 9 +++------
+ drivers/platform/x86/system76_acpi.c | 4 +---
+ drivers/platform/x86/topstar-laptop.c | 3 +--
+ drivers/platform/x86/toshiba_acpi.c | 4 +---
+ drivers/platform/x86/toshiba_bluetooth.c | 6 +++---
+ drivers/platform/x86/toshiba_haps.c | 4 +---
+ drivers/platform/x86/wireless-hotkey.c | 3 +--
+ drivers/platform/x86/xo15-ebook.c | 3 +--
+ drivers/ptp/ptp_vmw.c | 3 +--
+ drivers/thermal/intel/intel_menlow.c | 8 +++-----
+ drivers/video/backlight/apple_bl.c | 3 +--
+ drivers/watchdog/ni903x_wdt.c | 4 +---
+ drivers/xen/xen-acpi-pad.c | 3 +--
+ include/acpi/acpi_bus.h | 2 +-
+ 48 files changed, 88 insertions(+), 149 deletions(-)
+
+diff --git a/arch/ia64/hp/common/aml_nfw.c b/arch/ia64/hp/common/aml_nfw.c
+index 684667ade5259..901df49461a05 100644
+--- a/arch/ia64/hp/common/aml_nfw.c
++++ b/arch/ia64/hp/common/aml_nfw.c
+@@ -187,9 +187,9 @@ static int aml_nfw_add(struct acpi_device *device)
+ return aml_nfw_add_global_handler();
+ }
+
+-static int aml_nfw_remove(struct acpi_device *device)
++static void aml_nfw_remove(struct acpi_device *device)
+ {
+- return aml_nfw_remove_global_handler();
++ aml_nfw_remove_global_handler();
+ }
+
+ static const struct acpi_device_id aml_nfw_ids[] = {
+diff --git a/arch/x86/platform/olpc/olpc-xo15-sci.c b/arch/x86/platform/olpc/olpc-xo15-sci.c
+index 994a229cb79fe..68244a3422d1d 100644
+--- a/arch/x86/platform/olpc/olpc-xo15-sci.c
++++ b/arch/x86/platform/olpc/olpc-xo15-sci.c
+@@ -183,13 +183,12 @@ static int xo15_sci_add(struct acpi_device *device)
+ return r;
+ }
+
+-static int xo15_sci_remove(struct acpi_device *device)
++static void xo15_sci_remove(struct acpi_device *device)
+ {
+ acpi_disable_gpe(NULL, xo15_sci_gpe);
+ acpi_remove_gpe_handler(NULL, xo15_sci_gpe, xo15_sci_gpe_handler);
+ cancel_work_sync(&sci_work);
+ sysfs_remove_file(&device->dev.kobj, &lid_wake_on_close_attr.attr);
+- return 0;
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
+index bb9fe7984b1a0..1ace70b831cdf 100644
+--- a/drivers/acpi/ac.c
++++ b/drivers/acpi/ac.c
+@@ -33,7 +33,7 @@ MODULE_DESCRIPTION("ACPI AC Adapter Driver");
+ MODULE_LICENSE("GPL");
+
+ static int acpi_ac_add(struct acpi_device *device);
+-static int acpi_ac_remove(struct acpi_device *device);
++static void acpi_ac_remove(struct acpi_device *device);
+ static void acpi_ac_notify(struct acpi_device *device, u32 event);
+
+ static const struct acpi_device_id ac_device_ids[] = {
+@@ -288,12 +288,12 @@ static int acpi_ac_resume(struct device *dev)
+ #define acpi_ac_resume NULL
+ #endif
+
+-static int acpi_ac_remove(struct acpi_device *device)
++static void acpi_ac_remove(struct acpi_device *device)
+ {
+ struct acpi_ac *ac = NULL;
+
+ if (!device || !acpi_driver_data(device))
+- return -EINVAL;
++ return;
+
+ ac = acpi_driver_data(device);
+
+@@ -301,8 +301,6 @@ static int acpi_ac_remove(struct acpi_device *device)
+ unregister_acpi_notifier(&ac->battery_nb);
+
+ kfree(ac);
+-
+- return 0;
+ }
+
+ static int __init acpi_ac_init(void)
+diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
+index ec0e22a1e25d6..edbb28faee2a6 100644
+--- a/drivers/acpi/acpi_pad.c
++++ b/drivers/acpi/acpi_pad.c
+@@ -449,7 +449,7 @@ static int acpi_pad_add(struct acpi_device *device)
+ return 0;
+ }
+
+-static int acpi_pad_remove(struct acpi_device *device)
++static void acpi_pad_remove(struct acpi_device *device)
+ {
+ mutex_lock(&isolated_cpus_lock);
+ acpi_pad_idle_cpus(0);
+@@ -458,7 +458,6 @@ static int acpi_pad_remove(struct acpi_device *device)
+ acpi_remove_notify_handler(device->handle,
+ ACPI_DEVICE_NOTIFY, acpi_pad_notify);
+ acpi_pad_remove_sysfs(device);
+- return 0;
+ }
+
+ static const struct acpi_device_id pad_device_ids[] = {
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index ed318485eb192..c7a6d0b69dabd 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -82,7 +82,7 @@ static DEFINE_MUTEX(register_count_mutex);
+ static DEFINE_MUTEX(video_list_lock);
+ static LIST_HEAD(video_bus_head);
+ static int acpi_video_bus_add(struct acpi_device *device);
+-static int acpi_video_bus_remove(struct acpi_device *device);
++static void acpi_video_bus_remove(struct acpi_device *device);
+ static void acpi_video_bus_notify(struct acpi_device *device, u32 event);
+ static void acpi_video_bus_register_backlight_work(struct work_struct *ignored);
+ static DECLARE_DELAYED_WORK(video_bus_register_backlight_work,
+@@ -2074,13 +2074,13 @@ static int acpi_video_bus_add(struct acpi_device *device)
+ return error;
+ }
+
+-static int acpi_video_bus_remove(struct acpi_device *device)
++static void acpi_video_bus_remove(struct acpi_device *device)
+ {
+ struct acpi_video_bus *video = NULL;
+
+
+ if (!device || !acpi_driver_data(device))
+- return -EINVAL;
++ return;
+
+ video = acpi_driver_data(device);
+
+@@ -2094,8 +2094,6 @@ static int acpi_video_bus_remove(struct acpi_device *device)
+
+ kfree(video->attached_array);
+ kfree(video);
+-
+- return 0;
+ }
+
+ static void acpi_video_bus_register_backlight_work(struct work_struct *ignored)
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 084f156bdfbc4..c705613fa503e 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -1208,12 +1208,12 @@ static int acpi_battery_add(struct acpi_device *device)
+ return result;
+ }
+
+-static int acpi_battery_remove(struct acpi_device *device)
++static void acpi_battery_remove(struct acpi_device *device)
+ {
+ struct acpi_battery *battery = NULL;
+
+ if (!device || !acpi_driver_data(device))
+- return -EINVAL;
++ return;
+ device_init_wakeup(&device->dev, 0);
+ battery = acpi_driver_data(device);
+ unregister_pm_notifier(&battery->pm_nb);
+@@ -1221,7 +1221,6 @@ static int acpi_battery_remove(struct acpi_device *device)
+ mutex_destroy(&battery->lock);
+ mutex_destroy(&battery->sysfs_lock);
+ kfree(battery);
+- return 0;
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index 1f9b9a4c38c7d..475e1eddfa3b4 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -125,7 +125,7 @@ static const struct dmi_system_id dmi_lid_quirks[] = {
+ };
+
+ static int acpi_button_add(struct acpi_device *device);
+-static int acpi_button_remove(struct acpi_device *device);
++static void acpi_button_remove(struct acpi_device *device);
+ static void acpi_button_notify(struct acpi_device *device, u32 event);
+
+ #ifdef CONFIG_PM_SLEEP
+@@ -580,14 +580,13 @@ static int acpi_button_add(struct acpi_device *device)
+ return error;
+ }
+
+-static int acpi_button_remove(struct acpi_device *device)
++static void acpi_button_remove(struct acpi_device *device)
+ {
+ struct acpi_button *button = acpi_driver_data(device);
+
+ acpi_button_remove_fs(device);
+ input_unregister_device(button->input);
+ kfree(button);
+- return 0;
+ }
+
+ static int param_set_lid_init_state(const char *val,
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index ee4c812c8f6cc..612a308f3ff0e 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -1664,12 +1664,12 @@ static int acpi_ec_add(struct acpi_device *device)
+ return ret;
+ }
+
+-static int acpi_ec_remove(struct acpi_device *device)
++static void acpi_ec_remove(struct acpi_device *device)
+ {
+ struct acpi_ec *ec;
+
+ if (!device)
+- return -EINVAL;
++ return;
+
+ ec = acpi_driver_data(device);
+ release_region(ec->data_addr, 1);
+@@ -1679,7 +1679,6 @@ static int acpi_ec_remove(struct acpi_device *device)
+ ec_remove_handlers(ec);
+ acpi_ec_free(ec);
+ }
+- return 0;
+ }
+
+ static acpi_status
+diff --git a/drivers/acpi/hed.c b/drivers/acpi/hed.c
+index 60a2939cde6c5..78d44e3fe1295 100644
+--- a/drivers/acpi/hed.c
++++ b/drivers/acpi/hed.c
+@@ -56,10 +56,9 @@ static int acpi_hed_add(struct acpi_device *device)
+ return 0;
+ }
+
+-static int acpi_hed_remove(struct acpi_device *device)
++static void acpi_hed_remove(struct acpi_device *device)
+ {
+ hed_handle = NULL;
+- return 0;
+ }
+
+ static struct acpi_driver acpi_hed_driver = {
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 6d4ac934cd499..4e48d6db05eb1 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3371,10 +3371,9 @@ static int acpi_nfit_add(struct acpi_device *adev)
+ return devm_add_action_or_reset(dev, acpi_nfit_shutdown, acpi_desc);
+ }
+
+-static int acpi_nfit_remove(struct acpi_device *adev)
++static void acpi_nfit_remove(struct acpi_device *adev)
+ {
+ /* see acpi_nfit_unregister */
+- return 0;
+ }
+
+ static void acpi_nfit_update_notify(struct device *dev, acpi_handle handle)
+diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
+index e6a01a8df1b81..e90752d4f488e 100644
+--- a/drivers/acpi/sbs.c
++++ b/drivers/acpi/sbs.c
+@@ -96,7 +96,7 @@ struct acpi_sbs {
+
+ #define to_acpi_sbs(x) power_supply_get_drvdata(x)
+
+-static int acpi_sbs_remove(struct acpi_device *device);
++static void acpi_sbs_remove(struct acpi_device *device);
+ static int acpi_battery_get_state(struct acpi_battery *battery);
+
+ static inline int battery_scale(int log)
+@@ -664,16 +664,16 @@ static int acpi_sbs_add(struct acpi_device *device)
+ return result;
+ }
+
+-static int acpi_sbs_remove(struct acpi_device *device)
++static void acpi_sbs_remove(struct acpi_device *device)
+ {
+ struct acpi_sbs *sbs;
+ int id;
+
+ if (!device)
+- return -EINVAL;
++ return;
+ sbs = acpi_driver_data(device);
+ if (!sbs)
+- return -EINVAL;
++ return;
+ mutex_lock(&sbs->lock);
+ acpi_smbus_unregister_callback(sbs->hc);
+ for (id = 0; id < MAX_SBS_BAT; ++id)
+@@ -682,7 +682,6 @@ static int acpi_sbs_remove(struct acpi_device *device)
+ mutex_unlock(&sbs->lock);
+ mutex_destroy(&sbs->lock);
+ kfree(sbs);
+- return 0;
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
+index 340e0b61587e0..16f2daaa2c454 100644
+--- a/drivers/acpi/sbshc.c
++++ b/drivers/acpi/sbshc.c
+@@ -30,7 +30,7 @@ struct acpi_smb_hc {
+ };
+
+ static int acpi_smbus_hc_add(struct acpi_device *device);
+-static int acpi_smbus_hc_remove(struct acpi_device *device);
++static void acpi_smbus_hc_remove(struct acpi_device *device);
+
+ static const struct acpi_device_id sbs_device_ids[] = {
+ {"ACPI0001", 0},
+@@ -280,19 +280,18 @@ static int acpi_smbus_hc_add(struct acpi_device *device)
+
+ extern void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit);
+
+-static int acpi_smbus_hc_remove(struct acpi_device *device)
++static void acpi_smbus_hc_remove(struct acpi_device *device)
+ {
+ struct acpi_smb_hc *hc;
+
+ if (!device)
+- return -EINVAL;
++ return;
+
+ hc = acpi_driver_data(device);
+ acpi_ec_remove_query_handler(hc->ec, hc->query_bit);
+ acpi_os_wait_events_complete();
+ kfree(hc);
+ device->driver_data = NULL;
+- return 0;
+ }
+
+ module_acpi_driver(acpi_smb_hc_driver);
+diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
+index 40b07057983e0..0c4bdef4d09ca 100644
+--- a/drivers/acpi/thermal.c
++++ b/drivers/acpi/thermal.c
+@@ -74,7 +74,7 @@ MODULE_PARM_DESC(psv, "Disable or override all passive trip points.");
+ static struct workqueue_struct *acpi_thermal_pm_queue;
+
+ static int acpi_thermal_add(struct acpi_device *device);
+-static int acpi_thermal_remove(struct acpi_device *device);
++static void acpi_thermal_remove(struct acpi_device *device);
+ static void acpi_thermal_notify(struct acpi_device *device, u32 event);
+
+ static const struct acpi_device_id thermal_device_ids[] = {
+@@ -1059,19 +1059,18 @@ static int acpi_thermal_add(struct acpi_device *device)
+ return result;
+ }
+
+-static int acpi_thermal_remove(struct acpi_device *device)
++static void acpi_thermal_remove(struct acpi_device *device)
+ {
+ struct acpi_thermal *tz;
+
+ if (!device || !acpi_driver_data(device))
+- return -EINVAL;
++ return;
+
+ flush_workqueue(acpi_thermal_pm_queue);
+ tz = acpi_driver_data(device);
+
+ acpi_thermal_unregister_thermal_zone(tz);
+ kfree(tz);
+- return 0;
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/acpi/tiny-power-button.c b/drivers/acpi/tiny-power-button.c
+index a19f0e4e69f76..598f548b21f36 100644
+--- a/drivers/acpi/tiny-power-button.c
++++ b/drivers/acpi/tiny-power-button.c
+@@ -19,11 +19,15 @@ static const struct acpi_device_id tiny_power_button_device_ids[] = {
+ };
+ MODULE_DEVICE_TABLE(acpi, tiny_power_button_device_ids);
+
+-static int acpi_noop_add_remove(struct acpi_device *device)
++static int acpi_noop_add(struct acpi_device *device)
+ {
+ return 0;
+ }
+
++static void acpi_noop_remove(struct acpi_device *device)
++{
++}
++
+ static void acpi_tiny_power_button_notify(struct acpi_device *device, u32 event)
+ {
+ kill_cad_pid(power_signal, 1);
+@@ -34,8 +38,8 @@ static struct acpi_driver acpi_tiny_power_button_driver = {
+ .class = "tiny-power-button",
+ .ids = tiny_power_button_device_ids,
+ .ops = {
+- .add = acpi_noop_add_remove,
+- .remove = acpi_noop_add_remove,
++ .add = acpi_noop_add,
++ .remove = acpi_noop_remove,
+ .notify = acpi_tiny_power_button_notify,
+ },
+ };
+diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
+index 27e301a6bb7a3..9211531689b28 100644
+--- a/drivers/char/sonypi.c
++++ b/drivers/char/sonypi.c
+@@ -1123,10 +1123,9 @@ static int sonypi_acpi_add(struct acpi_device *device)
+ return 0;
+ }
+
+-static int sonypi_acpi_remove(struct acpi_device *device)
++static void sonypi_acpi_remove(struct acpi_device *device)
+ {
+ sonypi_acpi_device = NULL;
+- return 0;
+ }
+
+ static const struct acpi_device_id sonypi_device_ids[] = {
+diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
+index 916f4ff246c14..d43a0d7b97a89 100644
+--- a/drivers/char/tpm/tpm_crb.c
++++ b/drivers/char/tpm/tpm_crb.c
+@@ -804,14 +804,12 @@ static int crb_acpi_add(struct acpi_device *device)
+ return rc;
+ }
+
+-static int crb_acpi_remove(struct acpi_device *device)
++static void crb_acpi_remove(struct acpi_device *device)
+ {
+ struct device *dev = &device->dev;
+ struct tpm_chip *chip = dev_get_drvdata(dev);
+
+ tpm_chip_unregister(chip);
+-
+- return 0;
+ }
+
+ static const struct dev_pm_ops crb_pm = {
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index b03cb7ae7fd38..89944a87989ff 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -2239,7 +2239,7 @@ static acpi_status vmbus_walk_resources(struct acpi_resource *res, void *ctx)
+ return AE_OK;
+ }
+
+-static int vmbus_acpi_remove(struct acpi_device *device)
++static void vmbus_acpi_remove(struct acpi_device *device)
+ {
+ struct resource *cur_res;
+ struct resource *next_res;
+@@ -2256,8 +2256,6 @@ static int vmbus_acpi_remove(struct acpi_device *device)
+ kfree(cur_res);
+ }
+ }
+-
+- return 0;
+ }
+
+ static void vmbus_reserve_fb(void)
+diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
+index 0962c12eba5a0..fa28d447f0dfb 100644
+--- a/drivers/hwmon/acpi_power_meter.c
++++ b/drivers/hwmon/acpi_power_meter.c
+@@ -910,12 +910,12 @@ static int acpi_power_meter_add(struct acpi_device *device)
+ return res;
+ }
+
+-static int acpi_power_meter_remove(struct acpi_device *device)
++static void acpi_power_meter_remove(struct acpi_device *device)
+ {
+ struct acpi_power_meter_resource *resource;
+
+ if (!device || !acpi_driver_data(device))
+- return -EINVAL;
++ return;
+
+ resource = acpi_driver_data(device);
+ hwmon_device_unregister(resource->hwmon_dev);
+@@ -924,7 +924,6 @@ static int acpi_power_meter_remove(struct acpi_device *device)
+ free_capabilities(resource);
+
+ kfree(resource);
+- return 0;
+ }
+
+ static int acpi_power_meter_resume(struct device *dev)
+diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
+index ff64a39d56def..d778a2aaefec1 100644
+--- a/drivers/hwmon/asus_atk0110.c
++++ b/drivers/hwmon/asus_atk0110.c
+@@ -187,7 +187,7 @@ struct atk_acpi_input_buf {
+ };
+
+ static int atk_add(struct acpi_device *device);
+-static int atk_remove(struct acpi_device *device);
++static void atk_remove(struct acpi_device *device);
+ static void atk_print_sensor(struct atk_data *data, union acpi_object *obj);
+ static int atk_read_value(struct atk_sensor_data *sensor, u64 *value);
+
+@@ -1344,7 +1344,7 @@ static int atk_add(struct acpi_device *device)
+ return err;
+ }
+
+-static int atk_remove(struct acpi_device *device)
++static void atk_remove(struct acpi_device *device)
+ {
+ struct atk_data *data = device->driver_data;
+ dev_dbg(&device->dev, "removing...\n");
+@@ -1359,8 +1359,6 @@ static int atk_remove(struct acpi_device *device)
+ if (atk_ec_ctl(data, 0))
+ dev_err(&device->dev, "Failed to disable EC\n");
+ }
+-
+- return 0;
+ }
+
+ static int __init atk0110_init(void)
+diff --git a/drivers/input/misc/atlas_btns.c b/drivers/input/misc/atlas_btns.c
+index 0e77c40e1966b..3c9bbd04e1434 100644
+--- a/drivers/input/misc/atlas_btns.c
++++ b/drivers/input/misc/atlas_btns.c
+@@ -106,7 +106,7 @@ static int atlas_acpi_button_add(struct acpi_device *device)
+ return err;
+ }
+
+-static int atlas_acpi_button_remove(struct acpi_device *device)
++static void atlas_acpi_button_remove(struct acpi_device *device)
+ {
+ acpi_status status;
+
+@@ -116,8 +116,6 @@ static int atlas_acpi_button_remove(struct acpi_device *device)
+ pr_err("error removing addr spc handler\n");
+
+ input_unregister_device(input_dev);
+-
+- return 0;
+ }
+
+ static const struct acpi_device_id atlas_device_ids[] = {
+diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
+index 1eff202f6a1fa..2513be6d4e11d 100644
+--- a/drivers/net/fjes/fjes_main.c
++++ b/drivers/net/fjes/fjes_main.c
+@@ -145,14 +145,12 @@ static int fjes_acpi_add(struct acpi_device *device)
+ return 0;
+ }
+
+-static int fjes_acpi_remove(struct acpi_device *device)
++static void fjes_acpi_remove(struct acpi_device *device)
+ {
+ struct platform_device *plat_dev;
+
+ plat_dev = (struct platform_device *)acpi_driver_data(device);
+ platform_device_unregister(plat_dev);
+-
+- return 0;
+ }
+
+ static struct acpi_driver fjes_acpi_driver = {
+diff --git a/drivers/platform/chrome/chromeos_privacy_screen.c b/drivers/platform/chrome/chromeos_privacy_screen.c
+index 77e9f5ee8e334..bb74ddf9af4ac 100644
+--- a/drivers/platform/chrome/chromeos_privacy_screen.c
++++ b/drivers/platform/chrome/chromeos_privacy_screen.c
+@@ -123,12 +123,11 @@ static int chromeos_privacy_screen_add(struct acpi_device *adev)
+ return 0;
+ }
+
+-static int chromeos_privacy_screen_remove(struct acpi_device *adev)
++static void chromeos_privacy_screen_remove(struct acpi_device *adev)
+ {
+ struct drm_privacy_screen *drm_privacy_screen = acpi_driver_data(adev);
+
+ drm_privacy_screen_unregister(drm_privacy_screen);
+- return 0;
+ }
+
+ static const struct acpi_device_id chromeos_privacy_screen_device_ids[] = {
+diff --git a/drivers/platform/chrome/wilco_ec/event.c b/drivers/platform/chrome/wilco_ec/event.c
+index 32e400590be5a..69ceead8cdaa1 100644
+--- a/drivers/platform/chrome/wilco_ec/event.c
++++ b/drivers/platform/chrome/wilco_ec/event.c
+@@ -500,15 +500,13 @@ static int event_device_add(struct acpi_device *adev)
+ return error;
+ }
+
+-static int event_device_remove(struct acpi_device *adev)
++static void event_device_remove(struct acpi_device *adev)
+ {
+ struct event_device_data *dev_data = adev->driver_data;
+
+ cdev_device_del(&dev_data->cdev, &dev_data->dev);
+ ida_simple_remove(&event_ida, MINOR(dev_data->dev.devt));
+ hangup_device(dev_data);
+-
+- return 0;
+ }
+
+ static const struct acpi_device_id event_acpi_ids[] = {
+diff --git a/drivers/platform/surface/surfacepro3_button.c b/drivers/platform/surface/surfacepro3_button.c
+index 242fb690dcaf7..2755601f979cd 100644
+--- a/drivers/platform/surface/surfacepro3_button.c
++++ b/drivers/platform/surface/surfacepro3_button.c
+@@ -239,13 +239,12 @@ static int surface_button_add(struct acpi_device *device)
+ return error;
+ }
+
+-static int surface_button_remove(struct acpi_device *device)
++static void surface_button_remove(struct acpi_device *device)
+ {
+ struct surface_button *button = acpi_driver_data(device);
+
+ input_unregister_device(button->input);
+ kfree(button);
+- return 0;
+ }
+
+ static SIMPLE_DEV_PM_OPS(surface_button_pm,
+diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
+index 47b2f8bb6fb53..761029f39314a 100644
+--- a/drivers/platform/x86/asus-laptop.c
++++ b/drivers/platform/x86/asus-laptop.c
+@@ -1901,7 +1901,7 @@ static int asus_acpi_add(struct acpi_device *device)
+ return result;
+ }
+
+-static int asus_acpi_remove(struct acpi_device *device)
++static void asus_acpi_remove(struct acpi_device *device)
+ {
+ struct asus_laptop *asus = acpi_driver_data(device);
+
+@@ -1914,7 +1914,6 @@ static int asus_acpi_remove(struct acpi_device *device)
+
+ kfree(asus->name);
+ kfree(asus);
+- return 0;
+ }
+
+ static const struct acpi_device_id asus_device_ids[] = {
+diff --git a/drivers/platform/x86/asus-wireless.c b/drivers/platform/x86/asus-wireless.c
+index d3e7171928e5d..abf01e00b799f 100644
+--- a/drivers/platform/x86/asus-wireless.c
++++ b/drivers/platform/x86/asus-wireless.c
+@@ -175,7 +175,7 @@ static int asus_wireless_add(struct acpi_device *adev)
+ return err;
+ }
+
+-static int asus_wireless_remove(struct acpi_device *adev)
++static void asus_wireless_remove(struct acpi_device *adev)
+ {
+ struct asus_wireless_data *data = acpi_driver_data(adev);
+
+@@ -183,7 +183,6 @@ static int asus_wireless_remove(struct acpi_device *adev)
+ devm_led_classdev_unregister(&adev->dev, &data->led);
+ destroy_workqueue(data->wq);
+ }
+- return 0;
+ }
+
+ static struct acpi_driver asus_wireless_driver = {
+diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c
+index 9309ab5792cbc..8b6a146118599 100644
+--- a/drivers/platform/x86/classmate-laptop.c
++++ b/drivers/platform/x86/classmate-laptop.c
+@@ -418,11 +418,11 @@ static int cmpc_accel_add_v4(struct acpi_device *acpi)
+ return error;
+ }
+
+-static int cmpc_accel_remove_v4(struct acpi_device *acpi)
++static void cmpc_accel_remove_v4(struct acpi_device *acpi)
+ {
+ device_remove_file(&acpi->dev, &cmpc_accel_sensitivity_attr_v4);
+ device_remove_file(&acpi->dev, &cmpc_accel_g_select_attr_v4);
+- return cmpc_remove_acpi_notify_device(acpi);
++ cmpc_remove_acpi_notify_device(acpi);
+ }
+
+ static SIMPLE_DEV_PM_OPS(cmpc_accel_pm, cmpc_accel_suspend_v4,
+@@ -648,10 +648,10 @@ static int cmpc_accel_add(struct acpi_device *acpi)
+ return error;
+ }
+
+-static int cmpc_accel_remove(struct acpi_device *acpi)
++static void cmpc_accel_remove(struct acpi_device *acpi)
+ {
+ device_remove_file(&acpi->dev, &cmpc_accel_sensitivity_attr);
+- return cmpc_remove_acpi_notify_device(acpi);
++ cmpc_remove_acpi_notify_device(acpi);
+ }
+
+ static const struct acpi_device_id cmpc_accel_device_ids[] = {
+@@ -727,9 +727,9 @@ static int cmpc_tablet_add(struct acpi_device *acpi)
+ cmpc_tablet_idev_init);
+ }
+
+-static int cmpc_tablet_remove(struct acpi_device *acpi)
++static void cmpc_tablet_remove(struct acpi_device *acpi)
+ {
+- return cmpc_remove_acpi_notify_device(acpi);
++ cmpc_remove_acpi_notify_device(acpi);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+@@ -974,7 +974,7 @@ static int cmpc_ipml_add(struct acpi_device *acpi)
+ return retval;
+ }
+
+-static int cmpc_ipml_remove(struct acpi_device *acpi)
++static void cmpc_ipml_remove(struct acpi_device *acpi)
+ {
+ struct ipml200_dev *ipml;
+
+@@ -988,8 +988,6 @@ static int cmpc_ipml_remove(struct acpi_device *acpi)
+ }
+
+ kfree(ipml);
+-
+- return 0;
+ }
+
+ static const struct acpi_device_id cmpc_ipml_device_ids[] = {
+@@ -1055,9 +1053,9 @@ static int cmpc_keys_add(struct acpi_device *acpi)
+ cmpc_keys_idev_init);
+ }
+
+-static int cmpc_keys_remove(struct acpi_device *acpi)
++static void cmpc_keys_remove(struct acpi_device *acpi)
+ {
+- return cmpc_remove_acpi_notify_device(acpi);
++ cmpc_remove_acpi_notify_device(acpi);
+ }
+
+ static const struct acpi_device_id cmpc_keys_device_ids[] = {
+diff --git a/drivers/platform/x86/dell/dell-rbtn.c b/drivers/platform/x86/dell/dell-rbtn.c
+index a89fad47ff139..aa0e6c9074942 100644
+--- a/drivers/platform/x86/dell/dell-rbtn.c
++++ b/drivers/platform/x86/dell/dell-rbtn.c
+@@ -206,7 +206,7 @@ static void rbtn_input_event(struct rbtn_data *rbtn_data)
+ */
+
+ static int rbtn_add(struct acpi_device *device);
+-static int rbtn_remove(struct acpi_device *device);
++static void rbtn_remove(struct acpi_device *device);
+ static void rbtn_notify(struct acpi_device *device, u32 event);
+
+ static const struct acpi_device_id rbtn_ids[] = {
+@@ -426,7 +426,7 @@ static int rbtn_add(struct acpi_device *device)
+
+ }
+
+-static int rbtn_remove(struct acpi_device *device)
++static void rbtn_remove(struct acpi_device *device)
+ {
+ struct rbtn_data *rbtn_data = device->driver_data;
+
+@@ -443,8 +443,6 @@ static int rbtn_remove(struct acpi_device *device)
+
+ rbtn_acquire(device, false);
+ device->driver_data = NULL;
+-
+- return 0;
+ }
+
+ static void rbtn_notify(struct acpi_device *device, u32 event)
+diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
+index a388a28b6f2a2..62b71e8e3567a 100644
+--- a/drivers/platform/x86/eeepc-laptop.c
++++ b/drivers/platform/x86/eeepc-laptop.c
+@@ -1440,7 +1440,7 @@ static int eeepc_acpi_add(struct acpi_device *device)
+ return result;
+ }
+
+-static int eeepc_acpi_remove(struct acpi_device *device)
++static void eeepc_acpi_remove(struct acpi_device *device)
+ {
+ struct eeepc_laptop *eeepc = acpi_driver_data(device);
+
+@@ -1451,7 +1451,6 @@ static int eeepc_acpi_remove(struct acpi_device *device)
+ eeepc_platform_exit(eeepc);
+
+ kfree(eeepc);
+- return 0;
+ }
+
+
+diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
+index b543d117b12c7..085e044e888e4 100644
+--- a/drivers/platform/x86/fujitsu-laptop.c
++++ b/drivers/platform/x86/fujitsu-laptop.c
+@@ -847,15 +847,13 @@ static int acpi_fujitsu_laptop_add(struct acpi_device *device)
+ return ret;
+ }
+
+-static int acpi_fujitsu_laptop_remove(struct acpi_device *device)
++static void acpi_fujitsu_laptop_remove(struct acpi_device *device)
+ {
+ struct fujitsu_laptop *priv = acpi_driver_data(device);
+
+ fujitsu_laptop_platform_remove(device);
+
+ kfifo_free(&priv->fifo);
+-
+- return 0;
+ }
+
+ static void acpi_fujitsu_laptop_press(struct acpi_device *device, int scancode)
+diff --git a/drivers/platform/x86/fujitsu-tablet.c b/drivers/platform/x86/fujitsu-tablet.c
+index 7fb7fe5eb55a1..17f08ce7552d7 100644
+--- a/drivers/platform/x86/fujitsu-tablet.c
++++ b/drivers/platform/x86/fujitsu-tablet.c
+@@ -484,12 +484,11 @@ static int acpi_fujitsu_add(struct acpi_device *adev)
+ return 0;
+ }
+
+-static int acpi_fujitsu_remove(struct acpi_device *adev)
++static void acpi_fujitsu_remove(struct acpi_device *adev)
+ {
+ free_irq(fujitsu.irq, fujitsu_interrupt);
+ release_region(fujitsu.io_base, fujitsu.io_length);
+ input_fujitsu_remove();
+- return 0;
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/platform/x86/intel/rst.c b/drivers/platform/x86/intel/rst.c
+index 3b81cb896fedf..35814a7707af7 100644
+--- a/drivers/platform/x86/intel/rst.c
++++ b/drivers/platform/x86/intel/rst.c
+@@ -113,12 +113,10 @@ static int irst_add(struct acpi_device *acpi)
+ return error;
+ }
+
+-static int irst_remove(struct acpi_device *acpi)
++static void irst_remove(struct acpi_device *acpi)
+ {
+ device_remove_file(&acpi->dev, &irst_wakeup_attr);
+ device_remove_file(&acpi->dev, &irst_timeout_attr);
+-
+- return 0;
+ }
+
+ static const struct acpi_device_id irst_ids[] = {
+diff --git a/drivers/platform/x86/lg-laptop.c b/drivers/platform/x86/lg-laptop.c
+index 332868b140ed5..1452110d36ad7 100644
+--- a/drivers/platform/x86/lg-laptop.c
++++ b/drivers/platform/x86/lg-laptop.c
+@@ -761,7 +761,7 @@ static int acpi_add(struct acpi_device *device)
+ return ret;
+ }
+
+-static int acpi_remove(struct acpi_device *device)
++static void acpi_remove(struct acpi_device *device)
+ {
+ sysfs_remove_group(&pf_device->dev.kobj, &dev_attribute_group);
+
+@@ -773,8 +773,6 @@ static int acpi_remove(struct acpi_device *device)
+ platform_device_unregister(pf_device);
+ pf_device = NULL;
+ platform_driver_unregister(&pf_driver);
+-
+- return 0;
+ }
+
+ static const struct acpi_device_id device_ids[] = {
+diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
+index ad3083f9946d4..cf845ee1c7b1f 100644
+--- a/drivers/platform/x86/panasonic-laptop.c
++++ b/drivers/platform/x86/panasonic-laptop.c
+@@ -183,7 +183,7 @@ enum SINF_BITS { SINF_NUM_BATTERIES = 0,
+ /* R1 handles SINF_AC_CUR_BRIGHT as SINF_CUR_BRIGHT, doesn't know AC state */
+
+ static int acpi_pcc_hotkey_add(struct acpi_device *device);
+-static int acpi_pcc_hotkey_remove(struct acpi_device *device);
++static void acpi_pcc_hotkey_remove(struct acpi_device *device);
+ static void acpi_pcc_hotkey_notify(struct acpi_device *device, u32 event);
+
+ static const struct acpi_device_id pcc_device_ids[] = {
+@@ -1065,12 +1065,12 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
+ return result;
+ }
+
+-static int acpi_pcc_hotkey_remove(struct acpi_device *device)
++static void acpi_pcc_hotkey_remove(struct acpi_device *device)
+ {
+ struct pcc_acpi *pcc = acpi_driver_data(device);
+
+ if (!device || !pcc)
+- return -EINVAL;
++ return;
+
+ i8042_remove_filter(panasonic_i8042_filter);
+
+@@ -1088,8 +1088,6 @@ static int acpi_pcc_hotkey_remove(struct acpi_device *device)
+
+ kfree(pcc->sinf);
+ kfree(pcc);
+-
+- return 0;
+ }
+
+ module_acpi_driver(acpi_pcc_driver);
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index 5ff5aaf92b56e..17ef014b9a8a6 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -3270,7 +3270,7 @@ static int sony_nc_add(struct acpi_device *device)
+ return result;
+ }
+
+-static int sony_nc_remove(struct acpi_device *device)
++static void sony_nc_remove(struct acpi_device *device)
+ {
+ struct sony_nc_value *item;
+
+@@ -3287,8 +3287,6 @@ static int sony_nc_remove(struct acpi_device *device)
+ sony_pf_remove();
+ sony_laptop_remove_input();
+ dprintk(SONY_NC_DRIVER_NAME " removed.\n");
+-
+- return 0;
+ }
+
+ static const struct acpi_device_id sony_device_ids[] = {
+@@ -4637,14 +4635,14 @@ static irqreturn_t sony_pic_irq(int irq, void *dev_id)
+ * ACPI driver
+ *
+ *****************/
+-static int sony_pic_remove(struct acpi_device *device)
++static void sony_pic_remove(struct acpi_device *device)
+ {
+ struct sony_pic_ioport *io, *tmp_io;
+ struct sony_pic_irq *irq, *tmp_irq;
+
+ if (sony_pic_disable(device)) {
+ pr_err("Couldn't disable device\n");
+- return -ENXIO;
++ return;
+ }
+
+ free_irq(spic_dev.cur_irq->irq.interrupts[0], &spic_dev);
+@@ -4674,7 +4672,6 @@ static int sony_pic_remove(struct acpi_device *device)
+ spic_dev.cur_irq = NULL;
+
+ dprintk(SONY_PIC_DRIVER_NAME " removed.\n");
+- return 0;
+ }
+
+ static int sony_pic_add(struct acpi_device *device)
+diff --git a/drivers/platform/x86/system76_acpi.c b/drivers/platform/x86/system76_acpi.c
+index 958df41ad5098..52d94d8b1f25f 100644
+--- a/drivers/platform/x86/system76_acpi.c
++++ b/drivers/platform/x86/system76_acpi.c
+@@ -744,7 +744,7 @@ static int system76_add(struct acpi_device *acpi_dev)
+ }
+
+ // Remove a System76 ACPI device
+-static int system76_remove(struct acpi_device *acpi_dev)
++static void system76_remove(struct acpi_device *acpi_dev)
+ {
+ struct system76_data *data;
+
+@@ -760,8 +760,6 @@ static int system76_remove(struct acpi_device *acpi_dev)
+ devm_led_classdev_unregister(&acpi_dev->dev, &data->kb_led);
+
+ system76_get(data, "FINI");
+-
+- return 0;
+ }
+
+ static struct acpi_driver system76_driver = {
+diff --git a/drivers/platform/x86/topstar-laptop.c b/drivers/platform/x86/topstar-laptop.c
+index 6d18fbf8762b1..20df1ebefc30e 100644
+--- a/drivers/platform/x86/topstar-laptop.c
++++ b/drivers/platform/x86/topstar-laptop.c
+@@ -332,7 +332,7 @@ static int topstar_acpi_add(struct acpi_device *device)
+ return err;
+ }
+
+-static int topstar_acpi_remove(struct acpi_device *device)
++static void topstar_acpi_remove(struct acpi_device *device)
+ {
+ struct topstar_laptop *topstar = acpi_driver_data(device);
+
+@@ -344,7 +344,6 @@ static int topstar_acpi_remove(struct acpi_device *device)
+ topstar_acpi_exit(topstar);
+
+ kfree(topstar);
+- return 0;
+ }
+
+ static const struct acpi_device_id topstar_device_ids[] = {
+diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
+index 160abd3b3af8b..ce6a735b1abd8 100644
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -3186,7 +3186,7 @@ static void print_supported_features(struct toshiba_acpi_dev *dev)
+ pr_cont("\n");
+ }
+
+-static int toshiba_acpi_remove(struct acpi_device *acpi_dev)
++static void toshiba_acpi_remove(struct acpi_device *acpi_dev)
+ {
+ struct toshiba_acpi_dev *dev = acpi_driver_data(acpi_dev);
+
+@@ -3234,8 +3234,6 @@ static int toshiba_acpi_remove(struct acpi_device *acpi_dev)
+ toshiba_acpi = NULL;
+
+ kfree(dev);
+-
+- return 0;
+ }
+
+ static const char *find_hci_method(acpi_handle handle)
+diff --git a/drivers/platform/x86/toshiba_bluetooth.c b/drivers/platform/x86/toshiba_bluetooth.c
+index 57a5dc60c58a6..d8f81962a2402 100644
+--- a/drivers/platform/x86/toshiba_bluetooth.c
++++ b/drivers/platform/x86/toshiba_bluetooth.c
+@@ -36,7 +36,7 @@ struct toshiba_bluetooth_dev {
+ };
+
+ static int toshiba_bt_rfkill_add(struct acpi_device *device);
+-static int toshiba_bt_rfkill_remove(struct acpi_device *device);
++static void toshiba_bt_rfkill_remove(struct acpi_device *device);
+ static void toshiba_bt_rfkill_notify(struct acpi_device *device, u32 event);
+
+ static const struct acpi_device_id bt_device_ids[] = {
+@@ -279,7 +279,7 @@ static int toshiba_bt_rfkill_add(struct acpi_device *device)
+ return result;
+ }
+
+-static int toshiba_bt_rfkill_remove(struct acpi_device *device)
++static void toshiba_bt_rfkill_remove(struct acpi_device *device)
+ {
+ struct toshiba_bluetooth_dev *bt_dev = acpi_driver_data(device);
+
+@@ -291,7 +291,7 @@ static int toshiba_bt_rfkill_remove(struct acpi_device *device)
+
+ kfree(bt_dev);
+
+- return toshiba_bluetooth_disable(device->handle);
++ toshiba_bluetooth_disable(device->handle);
+ }
+
+ module_acpi_driver(toshiba_bt_rfkill_driver);
+diff --git a/drivers/platform/x86/toshiba_haps.c b/drivers/platform/x86/toshiba_haps.c
+index 49e84095bb010..8c9f76286b080 100644
+--- a/drivers/platform/x86/toshiba_haps.c
++++ b/drivers/platform/x86/toshiba_haps.c
+@@ -138,14 +138,12 @@ static void toshiba_haps_notify(struct acpi_device *device, u32 event)
+ event, 0);
+ }
+
+-static int toshiba_haps_remove(struct acpi_device *device)
++static void toshiba_haps_remove(struct acpi_device *device)
+ {
+ sysfs_remove_group(&device->dev.kobj, &haps_attr_group);
+
+ if (toshiba_haps)
+ toshiba_haps = NULL;
+-
+- return 0;
+ }
+
+ /* Helper function */
+diff --git a/drivers/platform/x86/wireless-hotkey.c b/drivers/platform/x86/wireless-hotkey.c
+index 11c60a2734468..c64d9f0844049 100644
+--- a/drivers/platform/x86/wireless-hotkey.c
++++ b/drivers/platform/x86/wireless-hotkey.c
+@@ -83,10 +83,9 @@ static int wl_add(struct acpi_device *device)
+ return err;
+ }
+
+-static int wl_remove(struct acpi_device *device)
++static void wl_remove(struct acpi_device *device)
+ {
+ wireless_input_destroy();
+- return 0;
+ }
+
+ static struct acpi_driver wl_driver = {
+diff --git a/drivers/platform/x86/xo15-ebook.c b/drivers/platform/x86/xo15-ebook.c
+index 97440462aa258..391f7ea4431e0 100644
+--- a/drivers/platform/x86/xo15-ebook.c
++++ b/drivers/platform/x86/xo15-ebook.c
+@@ -143,13 +143,12 @@ static int ebook_switch_add(struct acpi_device *device)
+ return error;
+ }
+
+-static int ebook_switch_remove(struct acpi_device *device)
++static void ebook_switch_remove(struct acpi_device *device)
+ {
+ struct ebook_switch *button = acpi_driver_data(device);
+
+ input_unregister_device(button->input);
+ kfree(button);
+- return 0;
+ }
+
+ static struct acpi_driver xo15_ebook_driver = {
+diff --git a/drivers/ptp/ptp_vmw.c b/drivers/ptp/ptp_vmw.c
+index 5dca26e14bdc8..0dcbabd1533db 100644
+--- a/drivers/ptp/ptp_vmw.c
++++ b/drivers/ptp/ptp_vmw.c
+@@ -101,10 +101,9 @@ static int ptp_vmw_acpi_add(struct acpi_device *device)
+ return 0;
+ }
+
+-static int ptp_vmw_acpi_remove(struct acpi_device *device)
++static void ptp_vmw_acpi_remove(struct acpi_device *device)
+ {
+ ptp_clock_unregister(ptp_vmw_clock);
+- return 0;
+ }
+
+ static const struct acpi_device_id ptp_vmw_acpi_device_ids[] = {
+diff --git a/drivers/thermal/intel/intel_menlow.c b/drivers/thermal/intel/intel_menlow.c
+index 101d7e791a137..3f885b08a4909 100644
+--- a/drivers/thermal/intel/intel_menlow.c
++++ b/drivers/thermal/intel/intel_menlow.c
+@@ -179,22 +179,20 @@ static int intel_menlow_memory_add(struct acpi_device *device)
+
+ }
+
+-static int intel_menlow_memory_remove(struct acpi_device *device)
++static void intel_menlow_memory_remove(struct acpi_device *device)
+ {
+ struct thermal_cooling_device *cdev;
+
+ if (!device)
+- return -EINVAL;
++ return;
+
+ cdev = acpi_driver_data(device);
+ if (!cdev)
+- return -EINVAL;
++ return;
+
+ sysfs_remove_link(&device->dev.kobj, "thermal_cooling");
+ sysfs_remove_link(&cdev->device.kobj, "device");
+ thermal_cooling_device_unregister(cdev);
+-
+- return 0;
+ }
+
+ static const struct acpi_device_id intel_menlow_memory_ids[] = {
+diff --git a/drivers/video/backlight/apple_bl.c b/drivers/video/backlight/apple_bl.c
+index c0d9339cff873..e9e7acb577bfa 100644
+--- a/drivers/video/backlight/apple_bl.c
++++ b/drivers/video/backlight/apple_bl.c
+@@ -193,13 +193,12 @@ static int apple_bl_add(struct acpi_device *dev)
+ return 0;
+ }
+
+-static int apple_bl_remove(struct acpi_device *dev)
++static void apple_bl_remove(struct acpi_device *dev)
+ {
+ backlight_device_unregister(apple_backlight_device);
+
+ release_region(hw_data->iostart, hw_data->iolen);
+ hw_data = NULL;
+- return 0;
+ }
+
+ static const struct acpi_device_id apple_bl_ids[] = {
+diff --git a/drivers/watchdog/ni903x_wdt.c b/drivers/watchdog/ni903x_wdt.c
+index 4cebad324b202..045bb72d9a438 100644
+--- a/drivers/watchdog/ni903x_wdt.c
++++ b/drivers/watchdog/ni903x_wdt.c
+@@ -224,14 +224,12 @@ static int ni903x_acpi_add(struct acpi_device *device)
+ return 0;
+ }
+
+-static int ni903x_acpi_remove(struct acpi_device *device)
++static void ni903x_acpi_remove(struct acpi_device *device)
+ {
+ struct ni903x_wdt *wdt = acpi_driver_data(device);
+
+ ni903x_wdd_stop(&wdt->wdd);
+ watchdog_unregister_device(&wdt->wdd);
+-
+- return 0;
+ }
+
+ static const struct acpi_device_id ni903x_device_ids[] = {
+diff --git a/drivers/xen/xen-acpi-pad.c b/drivers/xen/xen-acpi-pad.c
+index ccd8012020f15..ede69a5278d3f 100644
+--- a/drivers/xen/xen-acpi-pad.c
++++ b/drivers/xen/xen-acpi-pad.c
+@@ -122,7 +122,7 @@ static int acpi_pad_add(struct acpi_device *device)
+ return 0;
+ }
+
+-static int acpi_pad_remove(struct acpi_device *device)
++static void acpi_pad_remove(struct acpi_device *device)
+ {
+ mutex_lock(&xen_cpu_lock);
+ xen_acpi_pad_idle_cpus(0);
+@@ -130,7 +130,6 @@ static int acpi_pad_remove(struct acpi_device *device)
+
+ acpi_remove_notify_handler(device->handle,
+ ACPI_DEVICE_NOTIFY, acpi_pad_notify);
+- return 0;
+ }
+
+ static const struct acpi_device_id pad_device_ids[] = {
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index 6badc50ec4e66..0584e9f6e3397 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -149,7 +149,7 @@ struct acpi_hotplug_context {
+ */
+
+ typedef int (*acpi_op_add) (struct acpi_device * device);
+-typedef int (*acpi_op_remove) (struct acpi_device * device);
++typedef void (*acpi_op_remove) (struct acpi_device *device);
+ typedef void (*acpi_op_notify) (struct acpi_device * device, u32 event);
+
+ struct acpi_device_ops {
+--
+2.39.2
+
--- /dev/null
+From 8debe4fbe4482ae3cffaedbc4f918f233134d938 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 10:17:32 +0800
+Subject: ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 79597c8bf64ca99eab385115743131d260339da5 ]
+
+smatch error:
+sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error:
+we previously assumed 'rac97' could be null (see line 2072)
+
+remove redundant assignment, return error if rac97 is NULL.
+
+Fixes: da3cec35dd3c ("ALSA: Kill snd_assert() in sound/pci/*")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Link: https://lore.kernel.org/r/20230615021732.1972194-1-suhui@nfschina.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/ac97/ac97_codec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
+index ff685321f1a11..534ea7a256ec3 100644
+--- a/sound/pci/ac97/ac97_codec.c
++++ b/sound/pci/ac97/ac97_codec.c
+@@ -2070,8 +2070,8 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
+ .dev_disconnect = snd_ac97_dev_disconnect,
+ };
+
+- if (rac97)
+- *rac97 = NULL;
++ if (!rac97)
++ return -EINVAL;
+ if (snd_BUG_ON(!bus || !template))
+ return -EINVAL;
+ if (snd_BUG_ON(template->num >= 4))
+--
+2.39.2
+
--- /dev/null
+From 56643677c00e8bb98e945f60dcc5d5943b1f5b32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 15:44:12 -0700
+Subject: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit 9f0bcf49e9895cb005d78b33a5eebfa11711b425 ]
+
+This is motivated by OOB access in amdgpu_vm_update_range when
+offset_in_bo+map_size overflows.
+
+v2: keep the validations in amdgpu_vm_bo_map
+v3: add the validations to amdgpu_vm_bo_map/amdgpu_vm_bo_replace_map
+ rather than to amdgpu_gem_va_ioctl
+
+Fixes: 9f7eb5367d00 ("drm/amdgpu: actually use the VM map parameters")
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index 5a8a4cda7e987..58fe7279599f0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -1427,14 +1427,14 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
+ uint64_t eaddr;
+
+ /* validate the parameters */
+- if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK ||
+- size == 0 || size & ~PAGE_MASK)
++ if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK)
++ return -EINVAL;
++ if (saddr + size <= saddr || offset + size <= offset)
+ return -EINVAL;
+
+ /* make sure object fit at this offset */
+ eaddr = saddr + size - 1;
+- if (saddr >= eaddr ||
+- (bo && offset + size > amdgpu_bo_size(bo)) ||
++ if ((bo && offset + size > amdgpu_bo_size(bo)) ||
+ (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT))
+ return -EINVAL;
+
+@@ -1493,14 +1493,14 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev,
+ int r;
+
+ /* validate the parameters */
+- if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK ||
+- size == 0 || size & ~PAGE_MASK)
++ if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK)
++ return -EINVAL;
++ if (saddr + size <= saddr || offset + size <= offset)
+ return -EINVAL;
+
+ /* make sure object fit at this offset */
+ eaddr = saddr + size - 1;
+- if (saddr >= eaddr ||
+- (bo && offset + size > amdgpu_bo_size(bo)) ||
++ if ((bo && offset + size > amdgpu_bo_size(bo)) ||
+ (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT))
+ return -EINVAL;
+
+--
+2.39.2
+
--- /dev/null
+From a1b02bcb6b5096bc31ddf778f3bf5aefb78bbb8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jun 2023 00:50:50 +0900
+Subject: ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__
+ guard
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 92e2921eeafdfca9acd9b83f07d2b7ca099bac24 ]
+
+ASM_NL is useful not only in *.S files but also in .c files for using
+inline assembler in C code.
+
+On ARC, however, ASM_NL is evaluated inconsistently. It is expanded to
+a backquote (`) in *.S files, but a semicolon (;) in *.c files because
+arch/arc/include/asm/linkage.h defines it inside #ifdef __ASSEMBLY__,
+so the definition for C code falls back to the default value defined in
+include/linux/linkage.h.
+
+If ASM_NL is used in inline assembler in .c files, it will result in
+wrong assembly code because a semicolon is not an instruction separator,
+but the start of a comment for ARC.
+
+Move ASM_NL (also __ALIGN and __ALIGN_STR) out of the #ifdef.
+
+Fixes: 9df62f054406 ("arch: use ASM_NL instead of ';' for assembler new line character in the macro")
+Fixes: 8d92e992a785 ("ARC: define __ALIGN_STR and __ALIGN symbols for ARC")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/linkage.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h
+index c9434ff3aa4ce..8a3fb71e9cfad 100644
+--- a/arch/arc/include/asm/linkage.h
++++ b/arch/arc/include/asm/linkage.h
+@@ -8,6 +8,10 @@
+
+ #include <asm/dwarf.h>
+
++#define ASM_NL ` /* use '`' to mark new line in macro */
++#define __ALIGN .align 4
++#define __ALIGN_STR __stringify(__ALIGN)
++
+ #ifdef __ASSEMBLY__
+
+ .macro ST2 e, o, off
+@@ -28,10 +32,6 @@
+ #endif
+ .endm
+
+-#define ASM_NL ` /* use '`' to mark new line in macro */
+-#define __ALIGN .align 4
+-#define __ALIGN_STR __stringify(__ALIGN)
+-
+ /* annotation for data we want in DCCM - if enabled in .config */
+ .macro ARCFP_DATA nm
+ #ifdef CONFIG_ARC_HAS_DCCM
+--
+2.39.2
+
--- /dev/null
+From 120f9f600001fbfeb232061e55bddaf59f7c753e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 19:28:42 +0100
+Subject: ARM: 9303/1: kprobes: avoid missing-declaration warnings
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 1b9c3ddcec6a55e15d3e38e7405e2d078db02020 ]
+
+checker_stack_use_t32strd() and kprobe_handler() can be made static since
+they are not used from other files, while coverage_start_registers()
+and __kprobes_test_case() are used from assembler code, and just need
+a declaration to avoid a warning with the global definition.
+
+arch/arm/probes/kprobes/checkers-common.c:43:18: error: no previous prototype for 'checker_stack_use_t32strd'
+arch/arm/probes/kprobes/core.c:236:16: error: no previous prototype for 'kprobe_handler'
+arch/arm/probes/kprobes/test-core.c:723:10: error: no previous prototype for 'coverage_start_registers'
+arch/arm/probes/kprobes/test-core.c:918:14: error: no previous prototype for '__kprobes_test_case_start'
+arch/arm/probes/kprobes/test-core.c:952:14: error: no previous prototype for '__kprobes_test_case_end_16'
+arch/arm/probes/kprobes/test-core.c:967:14: error: no previous prototype for '__kprobes_test_case_end_32'
+
+Fixes: 6624cf651f1a ("ARM: kprobes: collects stack consumption for store instructions")
+Fixes: 454f3e132d05 ("ARM/kprobes: Remove jprobe arm implementation")
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/probes/kprobes/checkers-common.c | 2 +-
+ arch/arm/probes/kprobes/core.c | 2 +-
+ arch/arm/probes/kprobes/opt-arm.c | 2 --
+ arch/arm/probes/kprobes/test-core.c | 2 +-
+ arch/arm/probes/kprobes/test-core.h | 4 ++++
+ 5 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/probes/kprobes/checkers-common.c b/arch/arm/probes/kprobes/checkers-common.c
+index 4d720990cf2a3..eba7ac4725c02 100644
+--- a/arch/arm/probes/kprobes/checkers-common.c
++++ b/arch/arm/probes/kprobes/checkers-common.c
+@@ -40,7 +40,7 @@ enum probes_insn checker_stack_use_imm_0xx(probes_opcode_t insn,
+ * Different from other insn uses imm8, the real addressing offset of
+ * STRD in T32 encoding should be imm8 * 4. See ARMARM description.
+ */
+-enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn,
++static enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn,
+ struct arch_probes_insn *asi,
+ const struct decode_header *h)
+ {
+diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c
+index 9090c3a74dcce..d8238da095df7 100644
+--- a/arch/arm/probes/kprobes/core.c
++++ b/arch/arm/probes/kprobes/core.c
+@@ -233,7 +233,7 @@ singlestep(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *kcb)
+ * kprobe, and that level is reserved for user kprobe handlers, so we can't
+ * risk encountering a new kprobe in an interrupt handler.
+ */
+-void __kprobes kprobe_handler(struct pt_regs *regs)
++static void __kprobes kprobe_handler(struct pt_regs *regs)
+ {
+ struct kprobe *p, *cur;
+ struct kprobe_ctlblk *kcb;
+diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c
+index dbef34ed933f2..7f65048380ca5 100644
+--- a/arch/arm/probes/kprobes/opt-arm.c
++++ b/arch/arm/probes/kprobes/opt-arm.c
+@@ -145,8 +145,6 @@ __arch_remove_optimized_kprobe(struct optimized_kprobe *op, int dirty)
+ }
+ }
+
+-extern void kprobe_handler(struct pt_regs *regs);
+-
+ static void
+ optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs)
+ {
+diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c
+index c562832b86272..171c7076b89f4 100644
+--- a/arch/arm/probes/kprobes/test-core.c
++++ b/arch/arm/probes/kprobes/test-core.c
+@@ -720,7 +720,7 @@ static const char coverage_register_lookup[16] = {
+ [REG_TYPE_NOSPPCX] = COVERAGE_ANY_REG | COVERAGE_SP,
+ };
+
+-unsigned coverage_start_registers(const struct decode_header *h)
++static unsigned coverage_start_registers(const struct decode_header *h)
+ {
+ unsigned regs = 0;
+ int i;
+diff --git a/arch/arm/probes/kprobes/test-core.h b/arch/arm/probes/kprobes/test-core.h
+index 56ad3c0aaeeac..c7297037c1623 100644
+--- a/arch/arm/probes/kprobes/test-core.h
++++ b/arch/arm/probes/kprobes/test-core.h
+@@ -454,3 +454,7 @@ void kprobe_thumb32_test_cases(void);
+ #else
+ void kprobe_arm_test_cases(void);
+ #endif
++
++void __kprobes_test_case_start(void);
++void __kprobes_test_case_end_16(void);
++void __kprobes_test_case_end_32(void);
+--
+2.39.2
+
--- /dev/null
+From 5b3d4d75112b57c88a6ca23bdc88e0d5c002abfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 14:28:30 +0200
+Subject: ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit d3c8e2c5757153bbfad70019ec1decbca86f3def ]
+
+There is no such property in the SPI controller binding documentation.
+Also Linux driver doesn't look for it.
+
+This fixes:
+arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: spi@18029200: Unevaluated properties are not allowed ('clock-names' was unexpected)
+ From schema: Documentation/devicetree/bindings/spi/brcm,spi-bcm-qspi.yaml
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20230503122830.3200-1-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm5301x.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index 5fc1b847f4aa5..787a0dd8216b7 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -542,7 +542,6 @@ spi@18029200 {
+ "spi_lr_session_done",
+ "spi_lr_overread";
+ clocks = <&iprocmed>;
+- clock-names = "iprocmed";
+ num-cs = <2>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+--
+2.39.2
+
--- /dev/null
+From 421ec223cc532a4d4aa22d129a17769284893b79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jun 2023 17:36:29 +0200
+Subject: ARM: dts: BCM5301X: fix duplex-full => full-duplex
+
+From: Christian Lamparter <chunkeey@gmail.com>
+
+[ Upstream commit fd274b733bfdde3ca72f0fa2a37f032f3a8c402c ]
+
+this typo was found by the dtbs_check
+| ports:port@5:fixed-link: 'oneOf' conditional failed,
+| {'speed': [[1000]], 'duplex-full': True} is not of type 'array'
+| 'duplex-full' does not match any of the regexes: 'pinctrl-[0-]..."
+
+this should have been full-duplex;
+
+Fixes: 935327a73553 ("ARM: dts: BCM5301X: Add DT for Meraki MR26")
+Fixes: ec88a9c344d9 ("ARM: BCM5301X: Add DT for Meraki MR32")
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Link: https://lore.kernel.org/r/50522f45566951a9eabd22820647924cc6b4a264.1686238550.git.chunkeey@gmail.com
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm53015-meraki-mr26.dts | 2 +-
+ arch/arm/boot/dts/bcm53016-meraki-mr32.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/bcm53015-meraki-mr26.dts b/arch/arm/boot/dts/bcm53015-meraki-mr26.dts
+index 14f58033efeb9..ca2266b936ee2 100644
+--- a/arch/arm/boot/dts/bcm53015-meraki-mr26.dts
++++ b/arch/arm/boot/dts/bcm53015-meraki-mr26.dts
+@@ -128,7 +128,7 @@ port@5 {
+
+ fixed-link {
+ speed = <1000>;
+- duplex-full;
++ full-duplex;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
+index e678bc03d8165..008de8ee2584a 100644
+--- a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
++++ b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
+@@ -187,7 +187,7 @@ port@5 {
+
+ fixed-link {
+ speed = <1000>;
+- duplex-full;
++ full-duplex;
+ };
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From c2212c75e0514c4ffee55ca8194af520df48be19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 13:32:25 +0300
+Subject: ARM: dts: gta04: Move model property out of pinctrl node
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 4ffec92e70ac5097b9f67ec154065305b16a3b46 ]
+
+The model property should be at the top level, let's move it out
+of the pinctrl node.
+
+Fixes: d2eaf949d2c3 ("ARM: dts: omap3-gta04a5one: define GTA04A5 variant with OneNAND")
+Cc: Andreas Kemnade <andreas@kemnade.info>
+Cc: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04a5one.dts | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04a5one.dts b/arch/arm/boot/dts/omap3-gta04a5one.dts
+index 9db9fe67cd63b..95df45cc70c09 100644
+--- a/arch/arm/boot/dts/omap3-gta04a5one.dts
++++ b/arch/arm/boot/dts/omap3-gta04a5one.dts
+@@ -5,9 +5,11 @@
+
+ #include "omap3-gta04a5.dts"
+
+-&omap3_pmx_core {
++/ {
+ model = "Goldelico GTA04A5/Letux 2804 with OneNAND";
++};
+
++&omap3_pmx_core {
+ gpmc_pins: pinmux_gpmc_pins {
+ pinctrl-single,pins = <
+
+--
+2.39.2
+
--- /dev/null
+From 0f189176178237d07d45a55dee87368be7ec60e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 17:35:16 +0200
+Subject: ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0501fdec106a291c43b3c1b525cf22ab4c24b2d8 ]
+
+make dtbs_check:
+
+ arch/arm/boot/dts/renesas/r8a7743-iwg20d-q7.dtb: backlight: pwms: [[58, 0, 5000000], [0]] is too long
+ From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml
+ arch/arm/boot/dts/renesas/r8a7743-iwg20d-q7-dbcm-ca.dtb: backlight: pwms: [[67, 0, 5000000], [0]] is too long
+ From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml
+ arch/arm/boot/dts/renesas/r8a7744-iwg20d-q7-dbcm-ca.dtb: backlight: pwms: [[67, 0, 5000000], [0]] is too long
+ From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml
+ arch/arm/boot/dts/renesas/r8a7744-iwg20d-q7.dtb: backlight: pwms: [[58, 0, 5000000], [0]] is too long
+ From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml
+
+PWM specifiers referring to R-Car PWM Timer Controllers should contain
+only two cells.
+
+Fix this by dropping the bogus third cell.
+
+Fixes: 6f89dd9e9325d05b ("ARM: dts: iwg20d-q7-common: Add LCD support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/6e5c3167424a43faf8c1fa68d9667b3d87dc86d8.1684855911.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/iwg20d-q7-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/iwg20d-q7-common.dtsi b/arch/arm/boot/dts/iwg20d-q7-common.dtsi
+index 03caea6fc6ffa..4351c5a02fa59 100644
+--- a/arch/arm/boot/dts/iwg20d-q7-common.dtsi
++++ b/arch/arm/boot/dts/iwg20d-q7-common.dtsi
+@@ -49,7 +49,7 @@ audio_clock: audio_clock {
+ lcd_backlight: backlight {
+ compatible = "pwm-backlight";
+
+- pwms = <&pwm3 0 5000000 0>;
++ pwms = <&pwm3 0 5000000>;
+ brightness-levels = <0 4 8 16 32 64 128 255>;
+ default-brightness-level = <7>;
+ enable-gpios = <&gpio5 14 GPIO_ACTIVE_HIGH>;
+--
+2.39.2
+
--- /dev/null
+From 486cd1c1893de2f66e899ece4c0db9eb62ac9719 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jun 2023 15:18:39 +0200
+Subject: ARM: dts: lan966x: kontron-d10: fix board reset
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit bfcd5714f6424c03e385e0e9296dcd69855cfea7 ]
+
+The pinctrl node was missing which change the pin mux to GPIO mode. Add
+it.
+
+Fixes: 79d83b3a458e ("ARM: dts: lan966x: add basic Kontron KSwitch D10 support")
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+[claudiu.beznea: moved pinctrl-* bindings after compatible]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230616-feature-d10-dt-cleanups-v1-1-50dd0452b8fe@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
+index 0097e72e3fb22..42be207509a46 100644
+--- a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
++++ b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
+@@ -18,6 +18,8 @@ chosen {
+
+ gpio-restart {
+ compatible = "gpio-restart";
++ pinctrl-0 = <&reset_pins>;
++ pinctrl-names = "default";
+ gpios = <&gpio 56 GPIO_ACTIVE_LOW>;
+ priority = <200>;
+ };
+@@ -59,6 +61,12 @@ miim_c_pins: miim-c-pins {
+ function = "miim_c";
+ };
+
++ reset_pins: reset-pins {
++ /* SYS_RST# */
++ pins = "GPIO_56";
++ function = "gpio";
++ };
++
+ sgpio_a_pins: sgpio-a-pins {
+ /* SCK, D0, D1 */
+ pins = "GPIO_32", "GPIO_33", "GPIO_34";
+--
+2.39.2
+
--- /dev/null
+From 8a2a23a1c59f2663550d65cb5413b02dd40e8251 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jun 2023 15:18:40 +0200
+Subject: ARM: dts: lan966x: kontron-d10: fix SPI CS
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit fcb79ee3f0b15ed15f35eca5f24e952fdced9c61 ]
+
+The pinctrl node was missing which change the pin mux to GPIO mode.
+Add it so we don't have to rely on the bootloader to set the correct
+mode.
+
+Fixes: 79d83b3a458e ("ARM: dts: lan966x: add basic Kontron KSwitch D10 support")
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230616-feature-d10-dt-cleanups-v1-2-50dd0452b8fe@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
+index 42be207509a46..f4df4cc1dfa5e 100644
+--- a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
++++ b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
+@@ -41,7 +41,7 @@ &flx3 {
+ status = "okay";
+
+ spi3: spi@400 {
+- pinctrl-0 = <&fc3_b_pins>;
++ pinctrl-0 = <&fc3_b_pins>, <&spi3_cs_pins>;
+ pinctrl-names = "default";
+ status = "okay";
+ cs-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+@@ -79,6 +79,12 @@ sgpio_b_pins: sgpio-b-pins {
+ function = "sgpio_b";
+ };
+
++ spi3_cs_pins: spi3-cs-pins {
++ /* CS# */
++ pins = "GPIO_46";
++ function = "gpio";
++ };
++
+ usart0_pins: usart0-pins {
+ /* RXD, TXD */
+ pins = "GPIO_25", "GPIO_26";
+--
+2.39.2
+
--- /dev/null
+From d595f26a1c7c78775824790fbd2cc3949f9ebac5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 22:30:29 +0200
+Subject: ARM: dts: meson8: correct uart_B and uart_C clock references
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 98b503c7fb13a17a47d8ebf15fa8f7c10118e75c ]
+
+On Meson8 uart_B and uart_C do not work, because they are relying on
+incorrect clocks. Change the references of pclk to the correct CLKID
+(UART1 for uart_B and UART2 for uart_C), to allow use of the two uarts.
+
+This was originally reported by Hans-Frieder Vogt for Meson8b [0], but
+the same bug is also present in meson8.dtsi
+
+[0] https://lore.kernel.org/linux-amlogic/trinity-bf20bcb9-790b-4ab9-99e3-0831ef8257f4-1680878185420@3c-app-gmx-bap55/
+
+Fixes: 57007bfb5469 ("ARM: dts: meson8: Fix the UART device-tree schema validation")
+Reported-by: Hans-Frieder Vogt <hfdevel@gmx.net> # for meson8b.dtsi
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20230516203029.1031174-1-martin.blumenstingl@googlemail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi
+index 0f8bac8bac8bb..f9da7faa2186b 100644
+--- a/arch/arm/boot/dts/meson8.dtsi
++++ b/arch/arm/boot/dts/meson8.dtsi
+@@ -749,13 +749,13 @@ &uart_A {
+
+ &uart_B {
+ compatible = "amlogic,meson8-uart";
+- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>;
++ clocks = <&xtal>, <&clkc CLKID_UART1>, <&clkc CLKID_CLK81>;
+ clock-names = "xtal", "pclk", "baud";
+ };
+
+ &uart_C {
+ compatible = "amlogic,meson8-uart";
+- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>;
++ clocks = <&xtal>, <&clkc CLKID_UART2>, <&clkc CLKID_CLK81>;
+ clock-names = "xtal", "pclk", "baud";
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 5ddf1f5830a6fc9187bce11b07ac8681194fd508 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 16:36:25 +0200
+Subject: ARM: dts: meson8b: correct uart_B and uart_C clock references
+
+From: hfdevel@gmx.net <hfdevel@gmx.net>
+
+[ Upstream commit d542ce8d4769cdef6a7bc3437e59cfed9c68f0e4 ]
+
+With the current device tree for meson8b, uarts B (e.g. available on pins
+8/10 on Odroid-C1) and C (pins 3/5 on Odroid-C1) do not work, because they
+are relying on incorrect clocks. Change the references of pclk to the
+correct CLKID, to allow use of the two uarts.
+
+Fixes: 3375aa77135f ("ARM: dts: meson8b: Fix the UART device-tree schema validation")
+Signed-off-by: Hans-Frieder Vogt <hfdevel@gmx.net>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/trinity-bf20bcb9-790b-4ab9-99e3-0831ef8257f4-1680878185420@3c-app-gmx-bap55
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8b.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/meson8b.dtsi b/arch/arm/boot/dts/meson8b.dtsi
+index cf9c04a61ba3c..d3e0f085904db 100644
+--- a/arch/arm/boot/dts/meson8b.dtsi
++++ b/arch/arm/boot/dts/meson8b.dtsi
+@@ -737,13 +737,13 @@ &uart_A {
+
+ &uart_B {
+ compatible = "amlogic,meson8b-uart";
+- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>;
++ clocks = <&xtal>, <&clkc CLKID_UART1>, <&clkc CLKID_CLK81>;
+ clock-names = "xtal", "pclk", "baud";
+ };
+
+ &uart_C {
+ compatible = "amlogic,meson8b-uart";
+- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>;
++ clocks = <&xtal>, <&clkc CLKID_UART2>, <&clkc CLKID_CLK81>;
+ clock-names = "xtal", "pclk", "baud";
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 2861ae7e23a342ede8f159161cac96c8d94b86f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 May 2023 22:07:33 +0300
+Subject: ARM: dts: qcom: apq8074-dragonboard: Set DMA as remotely controlled
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit e60c230588d88036f974cec7e93361e2c4f62226 ]
+
+Add the qcom,controlled-remotely property for the blsp2_bam
+controller node. This board requires this, otherwise the board stalls
+during the boot for some reason (most probably because TZ mishandles the
+protection error and keeps on looping somewhere inside).
+
+Fixes: 62bc81792223 dts: msm8974: Add blsp2_bam dma node
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230507190735.2333145-3-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-apq8074-dragonboard.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts b/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts
+index 91716298ec5ed..be1ab7eff8ff4 100644
+--- a/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts
++++ b/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts
+@@ -23,6 +23,10 @@ &blsp1_uart2 {
+ status = "okay";
+ };
+
++&blsp2_dma {
++ qcom,controlled-remotely;
++};
++
+ &blsp2_i2c5 {
+ status = "okay";
+ clock-frequency = <200000>;
+--
+2.39.2
+
--- /dev/null
+From 8b943233e1b1da2187c6501743d4f0d498214946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 19:52:32 +0200
+Subject: ARM: dts: qcom: msm8974: do not use underscore in node name (again)
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 311bbc884b2edcf584b67d331be85ce43b27586f ]
+
+Align RPM requests node with DT schema by using hyphen instead of
+underscore.
+
+Fixes: f300826d27be ("ARM: dts: qcom-msm8974: Sort and clean up nodes")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230410175232.22317-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-msm8974.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-msm8974.dtsi b/arch/arm/boot/dts/qcom-msm8974.dtsi
+index 7a9be0acf3f5a..c4b2e9ac24940 100644
+--- a/arch/arm/boot/dts/qcom-msm8974.dtsi
++++ b/arch/arm/boot/dts/qcom-msm8974.dtsi
+@@ -300,7 +300,7 @@ rpm {
+ qcom,ipc = <&apcs 8 0>;
+ qcom,smd-edge = <15>;
+
+- rpm_requests: rpm_requests {
++ rpm_requests: rpm-requests {
+ compatible = "qcom,rpm-msm8974";
+ qcom,smd-channels = "rpm_requests";
+
+--
+2.39.2
+
--- /dev/null
+From a8da7d327908d9735d7a465969d61d7ac650549a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 20:01:12 +0200
+Subject: ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit e3f2778b1b6ced649bffdc7cbb05b80bb92f2108 ]
+
+The audio routing flow is not correct, the flow should be from source
+(second element in the pair) to sink (first element in the pair). The
+flow now is from "HP_OUT" to "Playback", where "Playback" is source
+and "HP_OUT" is sink, i.e. the direction is swapped and there is no
+direct link between the two either.
+
+Fill in the correct routing, where "HP_OUT" supplies the "Headphone Jack",
+"Line In Jack" supplies "LINE_IN" input, "Microphone Jack" supplies "MIC_IN"
+input and "Mic Bias" supplies "Microphone Jack".
+
+Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+index 5f586f024060f..38f46c2c83aa6 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+@@ -137,10 +137,13 @@ reg_panel_supply: regulator-panel-supply {
+
+ sound {
+ compatible = "audio-graph-card";
+- routing =
+- "MIC_IN", "Capture",
+- "Capture", "Mic Bias",
+- "Playback", "HP_OUT";
++ widgets = "Headphone", "Headphone Jack",
++ "Line", "Line In Jack",
++ "Microphone", "Microphone Jack";
++ routing = "Headphone Jack", "HP_OUT",
++ "LINE_IN", "Line In Jack",
++ "MIC_IN", "Microphone Jack",
++ "Microphone Jack", "Mic Bias";
+ dais = <&sai2a_port &sai2b_port>;
+ status = "okay";
+ };
+--
+2.39.2
+
--- /dev/null
+From 264c1c1504658ef219cd9378c74e573b6eacf2e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 13:56:04 +0200
+Subject: ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx
+
+From: Olivier Moysan <olivier.moysan@foss.st.com>
+
+[ Upstream commit 076c74c592cabe4a47537fe5205b5b678bed010d ]
+
+Use "dai-format" to configure DAI audio format as specified in
+audio-graph-port.yaml bindings.
+
+Fixes: 144d1ba70548 ("ARM: dts: stm32: Adapt STM32MP157 DK boards to stm32 DT diversity")
+Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dkx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
+index 8b48d3c89a047..fdc48536e97d1 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
+@@ -438,7 +438,7 @@ &i2s2 {
+ i2s2_port: port {
+ i2s2_endpoint: endpoint {
+ remote-endpoint = <&sii9022_tx_endpoint>;
+- format = "i2s";
++ dai-format = "i2s";
+ mclk-fs = <256>;
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From c6361ac9710b41d5cf05a58555484f207a47b661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 23:37:29 +0200
+Subject: ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 9660efc2af37f3c12dc6e6a5511ad99e0addc297 ]
+
+The ethernet MAC EEPROM is not populated on the SoM itself, it has to be
+populated on each carrier board. Move the EEPROM into the correct place
+in DTs, i.e. the carrier board DTs. Add label to the EEPROM too.
+
+Fixes: 7e76f82acd9e1 ("ARM: dts: stm32: Split Avenger96 into DHCOR SoM and Avenger96 board")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 6 ++++++
+ arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi | 6 ++++++
+ arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi | 6 ------
+ 3 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
+index b6957cbdeff5f..2c246ac641533 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
+@@ -322,6 +322,12 @@ adv7513_i2s0: endpoint {
+ };
+ };
+ };
++
++ dh_mac_eeprom: eeprom@53 {
++ compatible = "atmel,24c02";
++ reg = <0x53>;
++ pagesize = <16>;
++ };
+ };
+
+ <dc {
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi
+index 27477bb219ded..bb4ac6c13cbd3 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi
+@@ -192,6 +192,12 @@ eeprom@50 {
+ reg = <0x50>;
+ pagesize = <16>;
+ };
++
++ dh_mac_eeprom: eeprom@53 {
++ compatible = "atmel,24c02";
++ reg = <0x53>;
++ pagesize = <16>;
++ };
+ };
+
+ &sdmmc1 { /* MicroSD */
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
+index bb40fb46da81d..bba19f21e5277 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
+@@ -213,12 +213,6 @@ watchdog {
+ status = "disabled";
+ };
+ };
+-
+- eeprom@53 {
+- compatible = "atmel,24c02";
+- reg = <0x53>;
+- pagesize = <16>;
+- };
+ };
+
+ &ipcc {
+--
+2.39.2
+
--- /dev/null
+From 5a014636f830a946999079dca2e235bfc1bb5671 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 02:42:32 +0200
+Subject: ARM: dts: stm32: Shorten the AV96 HDMI sound card name
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 0cf765e598712addec34d0208cc1418c151fefb2 ]
+
+Fix the following error in kernel log due to too long sound card name:
+"
+asoc-audio-graph-card sound: ASoC: driver name too long 'STM32MP1-AV96-HDMI' -> 'STM32MP1-AV96-H'
+"
+
+Fixes: e027da342772 ("ARM: dts: stm32: Add bindings for audio on AV96")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
+index 2c246ac641533..f068e4fcc404f 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
+@@ -88,7 +88,7 @@ sd_switch: regulator-sd_switch {
+
+ sound {
+ compatible = "audio-graph-card";
+- label = "STM32MP1-AV96-HDMI";
++ label = "STM32-AV96-HDMI";
+ dais = <&sai2a_port>;
+ status = "okay";
+ };
+--
+2.39.2
+
--- /dev/null
+From ea340ce2b03131b1753e4cbf03840e395bf46846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 17:30:58 +0200
+Subject: ARM: ep93xx: fix missing-prototype warnings
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 419013740ea1e4343d8ade535d999f59fa28e460 ]
+
+ep93xx_clocksource_read() is only called from the file it is declared in,
+while ep93xx_timer_init() is declared in a header that is not included here.
+
+arch/arm/mach-ep93xx/timer-ep93xx.c:120:13: error: no previous prototype for 'ep93xx_timer_init'
+arch/arm/mach-ep93xx/timer-ep93xx.c:63:5: error: no previous prototype for 'ep93xx_clocksource_read'
+
+Fixes: 000bc17817bf ("ARM: ep93xx: switch to GENERIC_CLOCKEVENTS")
+Acked-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Link: https://lore.kernel.org/r/20230516153109.514251-3-arnd@kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-ep93xx/timer-ep93xx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-ep93xx/timer-ep93xx.c b/arch/arm/mach-ep93xx/timer-ep93xx.c
+index dd4b164d18317..a9efa7bc2fa12 100644
+--- a/arch/arm/mach-ep93xx/timer-ep93xx.c
++++ b/arch/arm/mach-ep93xx/timer-ep93xx.c
+@@ -9,6 +9,7 @@
+ #include <linux/io.h>
+ #include <asm/mach/time.h>
+ #include "soc.h"
++#include "platform.h"
+
+ /*************************************************************************
+ * Timer handling for EP93xx
+@@ -60,7 +61,7 @@ static u64 notrace ep93xx_read_sched_clock(void)
+ return ret;
+ }
+
+-u64 ep93xx_clocksource_read(struct clocksource *c)
++static u64 ep93xx_clocksource_read(struct clocksource *c)
+ {
+ u64 ret;
+
+--
+2.39.2
+
--- /dev/null
+From d7b982c57946b78d8f96d615406ebe6ce1cb7ae8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 17:31:04 +0200
+Subject: ARM: omap2: fix missing tick_broadcast() prototype
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 861bc1d2886d47bd57a2cbf2cda87fdbe3eb9d08 ]
+
+omap2 contains a hack to define tick_broadcast() on non-SMP
+configurations in place of the normal SMP definition. This one
+causes a warning because of a missing prototype:
+
+arch/arm/mach-omap2/board-generic.c:44:6: error: no previous prototype for 'tick_broadcast'
+
+Make sure to always include the header with the declaration.
+
+Fixes: d86ad463d670 ("ARM: OMAP2+: Fix regression for using local timer on non-SMP SoCs")
+Acked-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Link: https://lore.kernel.org/r/20230516153109.514251-9-arnd@kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/board-generic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
+index 1610c567a6a3a..10d2f078e4a8e 100644
+--- a/arch/arm/mach-omap2/board-generic.c
++++ b/arch/arm/mach-omap2/board-generic.c
+@@ -13,6 +13,7 @@
+ #include <linux/of_platform.h>
+ #include <linux/irqdomain.h>
+ #include <linux/clocksource.h>
++#include <linux/clockchips.h>
+
+ #include <asm/setup.h>
+ #include <asm/mach/arch.h>
+--
+2.39.2
+
--- /dev/null
+From 6c87db0815f8aa427d090051be1672d89c2542f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 14:19:44 +0800
+Subject: arm64: dts: mediatek: Add cpufreq nodes for MT8192
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
+
+[ Upstream commit 9d498cce9298a71e3896e2d1aee24a1a4c531d81 ]
+
+Add the cpufreq nodes for MT8192 SoC.
+
+Signed-off-by: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230317061944.15434-1-allen-kh.cheng@mediatek.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Stable-dep-of: a4366b5695c9 ("arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8192.dtsi | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+index ef1294d960145..ff2310fe3f1d2 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+@@ -64,6 +64,7 @@ cpu0: cpu@0 {
+ clock-frequency = <1701000000>;
+ cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
+ next-level-cache = <&l2_0>;
++ performance-domains = <&performance 0>;
+ capacity-dmips-mhz = <530>;
+ };
+
+@@ -75,6 +76,7 @@ cpu1: cpu@100 {
+ clock-frequency = <1701000000>;
+ cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
+ next-level-cache = <&l2_0>;
++ performance-domains = <&performance 0>;
+ capacity-dmips-mhz = <530>;
+ };
+
+@@ -86,6 +88,7 @@ cpu2: cpu@200 {
+ clock-frequency = <1701000000>;
+ cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
+ next-level-cache = <&l2_0>;
++ performance-domains = <&performance 0>;
+ capacity-dmips-mhz = <530>;
+ };
+
+@@ -97,6 +100,7 @@ cpu3: cpu@300 {
+ clock-frequency = <1701000000>;
+ cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
+ next-level-cache = <&l2_0>;
++ performance-domains = <&performance 0>;
+ capacity-dmips-mhz = <530>;
+ };
+
+@@ -108,6 +112,7 @@ cpu4: cpu@400 {
+ clock-frequency = <2171000000>;
+ cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>;
+ next-level-cache = <&l2_1>;
++ performance-domains = <&performance 1>;
+ capacity-dmips-mhz = <1024>;
+ };
+
+@@ -119,6 +124,7 @@ cpu5: cpu@500 {
+ clock-frequency = <2171000000>;
+ cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>;
+ next-level-cache = <&l2_1>;
++ performance-domains = <&performance 1>;
+ capacity-dmips-mhz = <1024>;
+ };
+
+@@ -130,6 +136,7 @@ cpu6: cpu@600 {
+ clock-frequency = <2171000000>;
+ cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>;
+ next-level-cache = <&l2_1>;
++ performance-domains = <&performance 1>;
+ capacity-dmips-mhz = <1024>;
+ };
+
+@@ -141,6 +148,7 @@ cpu7: cpu@700 {
+ clock-frequency = <2171000000>;
+ cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>;
+ next-level-cache = <&l2_1>;
++ performance-domains = <&performance 1>;
+ capacity-dmips-mhz = <1024>;
+ };
+
+@@ -257,6 +265,12 @@ soc {
+ compatible = "simple-bus";
+ ranges;
+
++ performance: performance-controller@11bc10 {
++ compatible = "mediatek,cpufreq-hw";
++ reg = <0 0x0011bc10 0 0x120>, <0 0x0011bd30 0 0x120>;
++ #performance-domain-cells = <1>;
++ };
++
+ gic: interrupt-controller@c000000 {
+ compatible = "arm,gic-v3";
+ #interrupt-cells = <4>;
+--
+2.39.2
+
--- /dev/null
+From d57f750c397c6de74d14a5e20f1c38e12bb60653 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 13:13:52 -0700
+Subject: arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to
+ kukui
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 42127f578ebde652d1373e0233356fbd351675c4 ]
+
+Firmware shipped on mt8183 Chromebooks is affected by the GICR
+save/restore issue as described by the patch ("dt-bindings:
+interrupt-controller: arm,gic-v3: Add quirk for Mediatek SoCs w/
+broken FW"). Add the quirk property.
+
+Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board")
+Reviewed-by: Julius Werner <jwerner@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230515131353.v2.3.I525a2ed4260046d43c885ee1275e91707743df1c@changeid
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+index b4b86bb1f1a7d..632fd89e75969 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+@@ -297,6 +297,10 @@ dsi_out: endpoint {
+ };
+ };
+
++&gic {
++ mediatek,broken-save-restore-fw;
++};
++
+ &gpu {
+ mali-supply = <&mt6358_vgpu_reg>;
+ sram-supply = <&mt6358_vsram_gpu_reg>;
+--
+2.39.2
+
--- /dev/null
+From 1597bc9ba1458c9ae161dc5bf89ef9db89f65e20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 14:35:15 -0400
+Subject: arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit a4366b5695c984b8a3fc8b31de9e758c8f6d1aed ]
+
+The capacity-dmips-mhz parameter was miscalculated: this SoC runs
+the first (Cortex-A55) cluster at a maximum of 2000MHz and the
+second (Cortex-A76) cluster at a maximum of 2200MHz.
+
+In order to calculate the right capacity-dmips-mhz, the following
+test was performed:
+1. CPUFREQ governor was set to 'performance' on both clusters
+2. Ran dhrystone with 500000000 iterations for 10 times on each cluster
+3. Calculated the mean result for each cluster
+4. Calculated DMIPS/MHz: dmips_mhz = dmips_per_second / cpu_mhz
+5. Scaled results to 1024:
+ result_c0 = dmips_mhz_c0 / dmips_mhz_c1 * 1024
+
+The mean results for this SoC are:
+Cluster 0 (LITTLE): 12016411 Dhry/s
+Cluster 1 (BIG): 31702034 Dhry/s
+
+The calculated scaled results are:
+Cluster 0: 426.953226899238 (rounded to 427)
+Cluster 1: 1024
+
+Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230602183515.3778780-1-nfraprado@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8192.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+index ff2310fe3f1d2..2f40c6cc407c1 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+@@ -65,7 +65,7 @@ cpu0: cpu@0 {
+ cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
+ next-level-cache = <&l2_0>;
+ performance-domains = <&performance 0>;
+- capacity-dmips-mhz = <530>;
++ capacity-dmips-mhz = <427>;
+ };
+
+ cpu1: cpu@100 {
+@@ -77,7 +77,7 @@ cpu1: cpu@100 {
+ cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
+ next-level-cache = <&l2_0>;
+ performance-domains = <&performance 0>;
+- capacity-dmips-mhz = <530>;
++ capacity-dmips-mhz = <427>;
+ };
+
+ cpu2: cpu@200 {
+@@ -89,7 +89,7 @@ cpu2: cpu@200 {
+ cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
+ next-level-cache = <&l2_0>;
+ performance-domains = <&performance 0>;
+- capacity-dmips-mhz = <530>;
++ capacity-dmips-mhz = <427>;
+ };
+
+ cpu3: cpu@300 {
+@@ -101,7 +101,7 @@ cpu3: cpu@300 {
+ cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
+ next-level-cache = <&l2_0>;
+ performance-domains = <&performance 0>;
+- capacity-dmips-mhz = <530>;
++ capacity-dmips-mhz = <427>;
+ };
+
+ cpu4: cpu@400 {
+--
+2.39.2
+
--- /dev/null
+From c211d70d46053045a58f8ae06d34e2edc94bbe89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Feb 2023 11:50:37 +0100
+Subject: arm64: dts: microchip: sparx5: do not use PSCI on reference boards
+
+From: Robert Marko <robert.marko@sartura.hr>
+
+[ Upstream commit 70be83708c925b3f72c508e4756e48ad2330c830 ]
+
+PSCI is not implemented on SparX-5 at all, there is no ATF and U-boot that
+is shipped does not implement it as well.
+
+I have tried flashing the latest BSP 2022.12 U-boot which did not work.
+After contacting Microchip, they confirmed that there is no ATF for the
+SoC nor PSCI implementation which is unfortunate in 2023.
+
+So, disable PSCI as otherwise kernel crashes as soon as it tries probing
+PSCI with, and the crash is only visible if earlycon is used.
+
+Since PSCI is not implemented, switch core bringup to use spin-tables
+which are implemented in the vendor U-boot and actually work.
+
+Tested on PCB134 with eMMC (VSC5640EV).
+
+Fixes: 6694aee00a4b ("arm64: dts: sparx5: Add basic cpu support")
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+Acked-by: Steen Hegelund <Steen.Hegelund@microchip.com>
+Link: https://lore.kernel.org/r/20230221105039.316819-1-robert.marko@sartura.hr
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/microchip/sparx5.dtsi | 2 +-
+ arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi | 12 ++++++++++++
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/microchip/sparx5.dtsi b/arch/arm64/boot/dts/microchip/sparx5.dtsi
+index 2dd5e38820b16..088d89801c276 100644
+--- a/arch/arm64/boot/dts/microchip/sparx5.dtsi
++++ b/arch/arm64/boot/dts/microchip/sparx5.dtsi
+@@ -61,7 +61,7 @@ arm-pmu {
+ interrupt-affinity = <&cpu0>, <&cpu1>;
+ };
+
+- psci {
++ psci: psci {
+ compatible = "arm,psci-0.2";
+ method = "smc";
+ };
+diff --git a/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi b/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi
+index 9d1a082de3e29..32bb76b3202a0 100644
+--- a/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi
++++ b/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi
+@@ -6,6 +6,18 @@
+ /dts-v1/;
+ #include "sparx5.dtsi"
+
++&psci {
++ status = "disabled";
++};
++
++&cpu0 {
++ enable-method = "spin-table";
++};
++
++&cpu1 {
++ enable-method = "spin-table";
++};
++
+ &uart0 {
+ status = "okay";
+ };
+--
+2.39.2
+
--- /dev/null
+From ff66cfdf18274dab0d3343792fa4484cdbf1617e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 20:48:41 +0200
+Subject: arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 5500f823db38db073d30557af159b77fb1f2bf26 ]
+
+The 96Boards specification expects a 1.8V power rail on the low-speed
+expansion connector that is able to provide at least 0.18W / 100 mA.
+According to the DB410c hardware user manual this is done by connecting
+both L15 and L16 in parallel with up to 55mA each (for 110 mA total) [1].
+
+Unfortunately the current regulator setup in the DB410c device tree
+does not implement the specification correctly and only provides 5 mA:
+
+ - Only L15 is marked always-on, so L16 is never enabled.
+ - Without specifying a load the regulator is put into LPM where
+ it can only provide 5 mA.
+
+Fix this by:
+
+ - Adding proper voltage constraints for L16.
+ - Making L16 always-on.
+ - Adding regulator-system-load for both L15 and L16. 100 mA should be
+ available in total, so specify 50 mA for each. (The regulator
+ hardware can only be in normal (55 mA) or low-power mode (5 mA) so
+ this will actually result in the expected 110 mA total...)
+
+[1]: https://www.96boards.org/documentation/consumer/dragonboard/dragonboard410c/hardware-docs/hardware-user-manual.md.html#power-supplies
+
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Fixes: 828dd5d66f0f ("arm64: dts: apq8016-sbc: make 1.8v available on LS expansion")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230510-msm8916-regulators-v1-2-54d4960a05fc@gerhold.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
+index c6f4ee7b82042..e3e90ad92cc59 100644
+--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
+@@ -527,19 +527,27 @@ l14 {
+ regulator-max-microvolt = <3300000>;
+ };
+
+- /**
+- * 1.8v required on LS expansion
+- * for mezzanine boards
++ /*
++ * The 96Boards specification expects a 1.8V power rail on the low-speed
++ * expansion connector that is able to provide at least 0.18W / 100 mA.
++ * L15/L16 are connected in parallel to provide 55 mA each. A minimum load
++ * must be specified to ensure the regulators are not put in LPM where they
++ * would only provide 5 mA.
+ */
+ l15 {
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-system-load = <50000>;
++ regulator-allow-set-load;
+ regulator-always-on;
+ };
+
+ l16 {
+ regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <3300000>;
++ regulator-max-microvolt = <1800000>;
++ regulator-system-load = <50000>;
++ regulator-allow-set-load;
++ regulator-always-on;
+ };
+
+ l17 {
+--
+2.39.2
+
--- /dev/null
+From acb99861cdc5e77dcef8355419d022d031e555c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 20:48:40 +0200
+Subject: arm64: dts: qcom: apq8016-sbc: Fix regulator constraints
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit e27654df20d77ad7549a3cf6739ebaa3aa59a088 ]
+
+For some reason DB410c has completely bogus regulator constraints that
+actually just correspond to the programmable voltages which are already
+provided by the regulator driver. Some of them are not just outside the
+recommended operating conditions of the APQ8016E SoC but even exceed
+the absolute maximum ratings, potentially risking permanent device
+damage.
+
+In practice it's not quite as dangerous thanks to the RPM firmware:
+It turns out that it has its own voltage constraints and silently
+clamps all regulator requests. For example, requesting 3.3V for L5
+(allowed by the current regulator constraints!) still results in 1.8V
+being programmed in the actual regulator hardware.
+
+Experimentation with various voltages shows that the internal RPM
+voltage constraints roughly correspond to the safe "specified range"
+in the PM8916 Device Specification (rather than the "programmable
+range" used inside apq8016-sbc.dtsi right now).
+
+Combine those together with some fixed voltages used in the old
+msm-3.10 device tree from Qualcomm to give DB410c some actually valid
+voltage constraints.
+
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Fixes: 4c7d53d16d77 ("arm64: dts: apq8016-sbc: add regulators support")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230510-msm8916-regulators-v1-1-54d4960a05fc@gerhold.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 64 ++++++++++++------------
+ 1 file changed, 32 insertions(+), 32 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
+index 1b613098fb4a0..c6f4ee7b82042 100644
+--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
+@@ -448,21 +448,21 @@ &smd_rpm_regulators {
+ vdd_l7-supply = <&pm8916_s4>;
+
+ s3 {
+- regulator-min-microvolt = <375000>;
+- regulator-max-microvolt = <1562000>;
++ regulator-min-microvolt = <1250000>;
++ regulator-max-microvolt = <1350000>;
+ };
+
+ s4 {
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
++ regulator-min-microvolt = <1850000>;
++ regulator-max-microvolt = <2150000>;
+
+ regulator-always-on;
+ regulator-boot-on;
+ };
+
+ l1 {
+- regulator-min-microvolt = <375000>;
+- regulator-max-microvolt = <1525000>;
++ regulator-min-microvolt = <1225000>;
++ regulator-max-microvolt = <1225000>;
+ };
+
+ l2 {
+@@ -471,13 +471,13 @@ l2 {
+ };
+
+ l4 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <2050000>;
++ regulator-max-microvolt = <2050000>;
+ };
+
+ l5 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
+ };
+
+ l6 {
+@@ -486,45 +486,45 @@ l6 {
+ };
+
+ l7 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
+ };
+
+ l8 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <2900000>;
++ regulator-max-microvolt = <2900000>;
+ };
+
+ l9 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
+ };
+
+ l10 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <2800000>;
++ regulator-max-microvolt = <2800000>;
+ };
+
+ l11 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <2950000>;
++ regulator-max-microvolt = <2950000>;
+ regulator-allow-set-load;
+ regulator-system-load = <200000>;
+ };
+
+ l12 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <2950000>;
+ };
+
+ l13 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <3075000>;
++ regulator-max-microvolt = <3075000>;
+ };
+
+ l14 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <3300000>;
+ };
+
+ /**
+@@ -532,14 +532,14 @@ l14 {
+ * for mezzanine boards
+ */
+ l15 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
+ regulator-always-on;
+ };
+
+ l16 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <3300000>;
+ };
+
+ l17 {
+@@ -548,8 +548,8 @@ l17 {
+ };
+
+ l18 {
+- regulator-min-microvolt = <1750000>;
+- regulator-max-microvolt = <3337000>;
++ regulator-min-microvolt = <2700000>;
++ regulator-max-microvolt = <2700000>;
+ };
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 73ff330181473636ecbadc2803c3c4af19919945 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 May 2023 19:45:16 +0200
+Subject: arm64: dts: qcom: apq8096: fix fixed regulator name property
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit c77612a07d18d4425fd8ddd532a8a9b8e1970c53 ]
+
+Correct the typo in 'regulator-name' property.
+
+ apq8096-ifc6640.dtb: v1p05-regulator: 'regulator-name' is a required property
+ apq8096-ifc6640.dtb: v1p05-regulator: Unevaluated properties are not allowed ('reglator-name' was unexpected)
+
+Fixes: 6cbdec2d3ca6 ("arm64: dts: qcom: msm8996: Introduce IFC6640")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230507174516.264936-3-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts b/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts
+index 92f264891d84b..9b20c1a47a186 100644
+--- a/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts
++++ b/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts
+@@ -26,7 +26,7 @@ chosen {
+
+ v1p05: v1p05-regulator {
+ compatible = "regulator-fixed";
+- reglator-name = "v1p05";
++ regulator-name = "v1p05";
+ regulator-always-on;
+ regulator-boot-on;
+
+@@ -38,7 +38,7 @@ v1p05: v1p05-regulator {
+
+ v12_poe: v12-poe-regulator {
+ compatible = "regulator-fixed";
+- reglator-name = "v12_poe";
++ regulator-name = "v12_poe";
+ regulator-always-on;
+ regulator-boot-on;
+
+--
+2.39.2
+
--- /dev/null
+From 06e6bc63dd272c4bd9761ec24c22eeb129ba381f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 23:18:40 +0200
+Subject: arm64: dts: qcom: msm8916: correct camss unit address
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 48798d992ce276cf0d57bf75318daf8eabd02aa4 ]
+
+Match unit-address to reg entry to fix dtbs W=1 warnings:
+
+ Warning (simple_bus_reg): /soc@0/camss@1b00000: simple-bus unit address format error, expected "1b0ac00"
+
+Fixes: 58f479f90a7c ("arm64: dts: qcom: msm8916: Add CAMSS support")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230419211856.79332-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 9743cb270639d..99aa9b4dce8aa 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -1088,7 +1088,7 @@ dsi_phy0: dsi-phy@1a98300 {
+ };
+ };
+
+- camss: camss@1b00000 {
++ camss: camss@1b0ac00 {
+ compatible = "qcom,msm8916-camss";
+ reg = <0x01b0ac00 0x200>,
+ <0x01b00030 0x4>,
+--
+2.39.2
+
--- /dev/null
+From 31d06b637645ef8530df262a7071e7baffeac30a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 23:18:41 +0200
+Subject: arm64: dts: qcom: msm8916: correct MMC unit address
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 72644bc76d5145c098c268829554a0b98fab1de1 ]
+
+Match unit-address to reg entry to fix dtbs W=1 warnings:
+
+ Warning (simple_bus_reg): /soc@0/mmc@7824000: simple-bus unit address format error, expected "7824900"
+ Warning (simple_bus_reg): /soc@0/mmc@7864000: simple-bus unit address format error, expected "7864900"
+
+Fixes: c4da5a561627 ("arm64: dts: qcom: Add msm8916 sdhci configuration nodes")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230419211856.79332-3-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 99aa9b4dce8aa..f84b3c1a03c53 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -1480,7 +1480,7 @@ lpass_codec: audio-codec@771c000 {
+ #sound-dai-cells = <1>;
+ };
+
+- sdhc_1: mmc@7824000 {
++ sdhc_1: mmc@7824900 {
+ compatible = "qcom,msm8916-sdhci", "qcom,sdhci-msm-v4";
+ reg = <0x07824900 0x11c>, <0x07824000 0x800>;
+ reg-names = "hc", "core";
+@@ -1498,7 +1498,7 @@ sdhc_1: mmc@7824000 {
+ status = "disabled";
+ };
+
+- sdhc_2: mmc@7864000 {
++ sdhc_2: mmc@7864900 {
+ compatible = "qcom,msm8916-sdhci", "qcom,sdhci-msm-v4";
+ reg = <0x07864900 0x11c>, <0x07864000 0x800>;
+ reg-names = "hc", "core";
+--
+2.39.2
+
--- /dev/null
+From 7bfdb90a9013c82af2114320013ffcc86230f642 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 23:18:46 +0200
+Subject: arm64: dts: qcom: msm8994: correct SPMI unit address
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 24f0f6a8059c7108d4ee3476c95db1e7ff4feb79 ]
+
+Match unit-address to reg entry to fix dtbs W=1 warnings:
+
+ Warning (simple_bus_reg): /soc/spmi@fc4c0000: simple-bus unit address format error, expected "fc4cf000"
+
+Fixes: b0ad598f8ec0 ("arm64: dts: qcom: msm8994: Add SPMI PMIC arbiter device")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230419211856.79332-8-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8994.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+index 7ed59e698c14d..3c6c2cf99fb9d 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+@@ -746,7 +746,7 @@ restart@fc4ab000 {
+ reg = <0xfc4ab000 0x4>;
+ };
+
+- spmi_bus: spmi@fc4c0000 {
++ spmi_bus: spmi@fc4cf000 {
+ compatible = "qcom,spmi-pmic-arb";
+ reg = <0xfc4cf000 0x1000>,
+ <0xfc4cb000 0x1000>,
+--
+2.39.2
+
--- /dev/null
+From 85ccf2bee59de19ae9eecee4f10dda3b3f060333 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 23:18:47 +0200
+Subject: arm64: dts: qcom: msm8996: correct camss unit address
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit e959ced1d0e5ef0b1f66a0c2d0e1ae80790e5ca5 ]
+
+Match unit-address to reg entry to fix dtbs W=1 warnings:
+
+ Warning (simple_bus_reg): /soc/camss@a00000: simple-bus unit address format error, expected "a34000"
+
+Fixes: e0531312e78f ("arm64: dts: qcom: msm8996: Add CAMSS support")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230419211856.79332-9-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 9f89100542018..9d6ec59d1cd3a 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -2045,7 +2045,7 @@ ufsphy_lane: phy@627400 {
+ };
+ };
+
+- camss: camss@a00000 {
++ camss: camss@a34000 {
+ compatible = "qcom,msm8996-camss";
+ reg = <0x00a34000 0x1000>,
+ <0x00a00030 0x4>,
+--
+2.39.2
+
--- /dev/null
+From a9e46346b5a192c553776e0118319712b44033e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 09:45:44 +0200
+Subject: arm64: dts: qcom: pm7250b: add missing spmi-vadc include
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+[ Upstream commit 83022f6484b11a60dbf9a95a88c7ef8e59c4b19c ]
+
+This file is using definitions from the spmi-vadc header, so we need to
+include it.
+
+Fixes: 11975b9b8135 ("arm64: dts: qcom: Add pm7250b PMIC")
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230407-pm7250b-sid-v1-1-fc648478cc25@fairphone.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/pm7250b.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/pm7250b.dtsi b/arch/arm64/boot/dts/qcom/pm7250b.dtsi
+index 61f7a63451505..694fe912536e8 100644
+--- a/arch/arm64/boot/dts/qcom/pm7250b.dtsi
++++ b/arch/arm64/boot/dts/qcom/pm7250b.dtsi
+@@ -3,6 +3,7 @@
+ * Copyright (C) 2022 Luca Weiss <luca.weiss@fairphone.com>
+ */
+
++#include <dt-bindings/iio/qcom,spmi-vadc.h>
+ #include <dt-bindings/interrupt-controller/irq.h>
+ #include <dt-bindings/spmi/spmi.h>
+
+--
+2.39.2
+
--- /dev/null
+From 30dbb35cb9d1fb0cf56998baa916d46c43e8cc74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 23:18:48 +0200
+Subject: arm64: dts: qcom: sdm630: correct camss unit address
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit c8b7faa7e9913a94444b3f00b6480e53a174fcfd ]
+
+Match unit-address to reg entry to fix dtbs W=1 warnings:
+
+ Warning (simple_bus_reg): /soc/camss@ca00000: simple-bus unit address format error, expected "ca00020"
+
+Fixes: f3d5d3cc6971 ("arm64: dts: qcom: sdm630: Configure the camera subsystem")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230419211856.79332-10-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm630.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi
+index e119060ac56cb..2430549265d3f 100644
+--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
+@@ -1902,7 +1902,7 @@ pil-reloc@94c {
+ };
+ };
+
+- camss: camss@ca00000 {
++ camss: camss@ca00020 {
+ compatible = "qcom,sdm660-camss";
+ reg = <0x0ca00020 0x10>,
+ <0x0ca30000 0x100>,
+--
+2.39.2
+
--- /dev/null
+From 93eb46a0fe6924607e3749bc034bb4bc01d9df52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 23:18:49 +0200
+Subject: arm64: dts: qcom: sdm845: correct camss unit address
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit a05b913a27e46926ba60ba2bcacc7ec7a8403e4c ]
+
+Match unit-address to reg entry to fix dtbs W=1 warnings:
+
+ Warning (simple_bus_reg): /soc@0/camss@a00000: simple-bus unit address format error, expected "acb3000"
+
+Fixes: d48a6698a6b7 ("arm64: dts: qcom: sdm845: Add CAMSS ISP node")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230419211856.79332-11-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index a99eda4971010..6f4cc3329400c 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -4207,7 +4207,7 @@ videocc: clock-controller@ab00000 {
+ #reset-cells = <1>;
+ };
+
+- camss: camss@a00000 {
++ camss: camss@acb3000 {
+ compatible = "qcom,sdm845-camss";
+
+ reg = <0 0xacb3000 0 0x1000>,
+--
+2.39.2
+
--- /dev/null
+From 85778135df962e1f9f036c4d6b53ad95f968ec46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 15:22:40 +0200
+Subject: arm64: dts: qcom: sdm845: Flush RSC sleep & wake votes
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 91e83140b5dd5598fbcfada3ee1f8b2b410c3731 ]
+
+The rpmh driver will cache sleep and wake votes until the cluster
+power-domain is about to enter idle, to avoid unnecessary writes. So
+associate the apps_rsc with the cluster pd, so that it can be notified
+about this event.
+
+Without this, only AMC votes are being commited.
+
+Fixes: c83545d95376 ("arm64: dts: sdm845: Add rpmh-rsc node")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230531-topic-rsc-v1-6-b4a985f57b8b@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 6f4cc3329400c..b7ba70857d0ad 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -5043,6 +5043,7 @@ apps_rsc: rsc@179c0000 {
+ <SLEEP_TCS 3>,
+ <WAKE_TCS 3>,
+ <CONTROL_TCS 1>;
++ power-domains = <&CLUSTER_PD>;
+
+ apps_bcm_voter: bcm-voter {
+ compatible = "qcom,bcm-voter";
+--
+2.39.2
+
--- /dev/null
+From e1092e87be8273dbe05ca2691ed72da4b4f12df8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 23:18:56 +0200
+Subject: arm64: dts: qcom: sdm845-polaris: add missing touchscreen child node
+ reg
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 4a0156b8862665a3e31c8280607388e3001ace3d ]
+
+Add missing reg property to touchscreen child node to fix dtbs W=1 warnings:
+
+ Warning (unit_address_vs_reg): /soc@0/geniqup@ac0000/i2c@a98000/touchscreen@20/rmi4-f12@12: node has a unit name, but no reg or ranges property
+
+Fixes: be497abe19bf ("arm64: dts: qcom: Add support for Xiaomi Mi Mix2s")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Molly Sophia <mollysophia379@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230419211856.79332-18-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
+index 74c6832e05985..093b04359ec39 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
+@@ -484,6 +484,7 @@ rmi4-f01@1 {
+ };
+
+ rmi4-f12@12 {
++ reg = <0x12>;
+ syna,rezero-wait-ms = <0xc8>;
+ syna,clip-x-high = <0x438>;
+ syna,clip-y-high = <0x870>;
+--
+2.39.2
+
--- /dev/null
+From 45f5daf5f8dac9d1dcb5fedcac1f671e2b190fe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 23:14:18 +0200
+Subject: arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit 223ce29c8b7e5b00f01a68387aabeefd77d97f06 ]
+
+The framebuffer configuration for edo pdx203, written in edo dtsi (which
+is overwritten in pdx206 dts for its smaller panel) has to use a
+1096x2560 configuration as this is what the panel (and framebuffer area)
+has been initialized to. Downstream userspace also has access to (and
+uses) this 2.5k mode by default, and only switches the panel to 4k when
+requested.
+
+This is similar to commit be8de06dc397 ("arm64: dts: qcom:
+sm8150-kumano: Panel framebuffer is 2.5k instead of 4k") which fixed the
+same for the previous generation Sony platform.
+
+Fixes: 69cdb97ef652 ("arm64: dts: qcom: sm8250: Add support for SONY Xperia 1 II / 5 II (Edo platform)")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230606211418.587676-1-marijn.suijten@somainline.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi
+index e4769dcfaad7b..390b90a8ddf70 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi
+@@ -26,9 +26,10 @@ chosen {
+ framebuffer: framebuffer@9c000000 {
+ compatible = "simple-framebuffer";
+ reg = <0 0x9c000000 0 0x2300000>;
+- width = <1644>;
+- height = <3840>;
+- stride = <(1644 * 4)>;
++ /* pdx203 BL initializes in 2.5k mode, not 4k */
++ width = <1096>;
++ height = <2560>;
++ stride = <(1096 * 4)>;
+ format = "a8r8g8b8";
+ /*
+ * That's a lot of clocks, but it's necessary due
+--
+2.39.2
+
--- /dev/null
+From 3d43c709861dd258a485244d6bf6458bb8cd2b1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:03:51 -0400
+Subject: arm64: dts: qcom: sm8350: Add GPI DMA compatible fallback
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b561e225dee5412609fd98340ca71ba0ab2e4b36 ]
+
+Use SM6350 as fallback for GPI DMA, to indicate devices are compatible
+and that drivers can bind with only one compatible.
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221018230352.1238479-5-krzysztof.kozlowski@linaro.org
+Stable-dep-of: 41d6bca799b3 ("arm64: dts: qcom: sm8350: correct DMA controller unit address")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index ca7c428a741d4..9430166ee45b5 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -678,7 +678,7 @@ ipcc: mailbox@408000 {
+ };
+
+ gpi_dma2: dma-controller@800000 {
+- compatible = "qcom,sm8350-gpi-dma";
++ compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma";
+ reg = <0 0x00800000 0 0x60000>;
+ interrupts = <GIC_SPI 588 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 589 IRQ_TYPE_LEVEL_HIGH>,
+@@ -904,7 +904,7 @@ spi19: spi@894000 {
+ };
+
+ gpi_dma0: dma-controller@900000 {
+- compatible = "qcom,sm8350-gpi-dma";
++ compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma";
+ reg = <0 0x09800000 0 0x60000>;
+ interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1207,7 +1207,7 @@ spi7: spi@99c000 {
+ };
+
+ gpi_dma1: dma-controller@a00000 {
+- compatible = "qcom,sm8350-gpi-dma";
++ compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma";
+ reg = <0 0x00a00000 0 0x60000>;
+ interrupts = <GIC_SPI 279 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 280 IRQ_TYPE_LEVEL_HIGH>,
+--
+2.39.2
+
--- /dev/null
+From cf31eb7e74a5d645f46b0aa3231e6a287c453c81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 23:18:51 +0200
+Subject: arm64: dts: qcom: sm8350: correct DMA controller unit address
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 41d6bca799b3f40d4d3c22dd4545aeac7c210e33 ]
+
+Match unit-address to reg entry to fix dtbs W=1 warnings:
+
+ Warning (simple_bus_reg): /soc@0/dma-controller@900000: simple-bus unit address format error, expected "9800000"
+
+Fixes: bc08fbf49bc8 ("arm64: dts: qcom: sm8350: Define GPI DMA engines")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230419211856.79332-13-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index 9430166ee45b5..7fd1c3f71c0f8 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -903,7 +903,7 @@ spi19: spi@894000 {
+ };
+ };
+
+- gpi_dma0: dma-controller@900000 {
++ gpi_dma0: dma-controller@9800000 {
+ compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma";
+ reg = <0 0x09800000 0 0x60000>;
+ interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
+--
+2.39.2
+
--- /dev/null
+From 9a465833b8c1db890f1252bf9bb608c929c10cab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 10:48:22 +0200
+Subject: arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 1a2c4e5635177939a088d22fa35c6a7032725663 ]
+
+The schematics are misleading, the flow control is for HSCIF1. We need
+SCIF1 for GNSS/GPS which does not use flow control.
+
+Fixes: c6c816e22bc8 ("arm64: dts: ulcb-kf: enable SCIF1")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230525084823.4195-2-wsa+renesas@sang-engineering.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
+index 408871c2859d1..588b14b66b6fb 100644
+--- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
++++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
+@@ -393,7 +393,7 @@ hscif0_pins: hscif0 {
+ };
+
+ scif1_pins: scif1 {
+- groups = "scif1_data_b", "scif1_ctrl";
++ groups = "scif1_data_b";
+ function = "scif1";
+ };
+
+@@ -447,7 +447,6 @@ rsnd_for_pcm3168a_capture: endpoint {
+ &scif1 {
+ pinctrl-0 = <&scif1_pins>;
+ pinctrl-names = "default";
+- uart-has-rtscts;
+
+ status = "okay";
+ };
+--
+2.39.2
+
--- /dev/null
+From 3460a27971ce5f11d5d5fe6f53259ef73532e078 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 09:30:06 +0530
+Subject: arm64: dts: ti: k3-j7200: Fix physical address of pin
+
+From: Keerthy <j-keerthy@ti.com>
+
+[ Upstream commit 3d011933000ed9054c649952d83162d24f020a93 ]
+
+wkup_pmx splits into multiple regions. Like
+
+ wkup_pmx0 -> 13 pins (WKUP_PADCONFIG 0 - 12)
+ wkup_pmx1 -> 2 pins (WKUP_PADCONFIG 14 - 15)
+ wkup_pmx2 -> 59 pins (WKUP_PADCONFIG 26 - 84)
+ wkup_pmx3 -> 8 pins (WKUP_PADCONFIG 93 - 100)
+
+With this split, pin offset needs to be adjusted to
+match with new pmx for all pins above wkup_pmx0.
+
+Example a pin under wkup_pmx1 should start from 0 instead of
+old offset(0x38 WKUP_PADCONFIG 14 offset)
+
+J7200 Datasheet (Table 6-106, Section 6.4 Pin Multiplexing) :
+https://www.ti.com/lit/ds/symlink/dra821u.pdf
+
+Fixes: 9ae21ac445e9 ("arm64: dts: ti: k3-j7200: Fix wakeup pinmux range")
+
+Signed-off-by: Keerthy <j-keerthy@ti.com>
+Signed-off-by: Udit Kumar <u-kumar1@ti.com>
+Link: https://lore.kernel.org/r/20230419040007.3022780-2-u-kumar1@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/ti/k3-j7200-common-proc-board.dts | 28 +++++++++----------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+index 50009f963a324..5840063f61293 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+@@ -83,25 +83,25 @@ vdd_sd_dv: gpio-regulator-TLV71033 {
+ &wkup_pmx2 {
+ mcu_cpsw_pins_default: mcu-cpsw-pins-default {
+ pinctrl-single,pins = <
+- J721E_WKUP_IOPAD(0x0068, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */
+- J721E_WKUP_IOPAD(0x006c, PIN_INPUT, 0) /* MCU_RGMII1_RX_CTL */
+- J721E_WKUP_IOPAD(0x0070, PIN_OUTPUT, 0) /* MCU_RGMII1_TD3 */
+- J721E_WKUP_IOPAD(0x0074, PIN_OUTPUT, 0) /* MCU_RGMII1_TD2 */
+- J721E_WKUP_IOPAD(0x0078, PIN_OUTPUT, 0) /* MCU_RGMII1_TD1 */
+- J721E_WKUP_IOPAD(0x007c, PIN_OUTPUT, 0) /* MCU_RGMII1_TD0 */
+- J721E_WKUP_IOPAD(0x0088, PIN_INPUT, 0) /* MCU_RGMII1_RD3 */
+- J721E_WKUP_IOPAD(0x008c, PIN_INPUT, 0) /* MCU_RGMII1_RD2 */
+- J721E_WKUP_IOPAD(0x0090, PIN_INPUT, 0) /* MCU_RGMII1_RD1 */
+- J721E_WKUP_IOPAD(0x0094, PIN_INPUT, 0) /* MCU_RGMII1_RD0 */
+- J721E_WKUP_IOPAD(0x0080, PIN_OUTPUT, 0) /* MCU_RGMII1_TXC */
+- J721E_WKUP_IOPAD(0x0084, PIN_INPUT, 0) /* MCU_RGMII1_RXC */
++ J721E_WKUP_IOPAD(0x0000, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */
++ J721E_WKUP_IOPAD(0x0004, PIN_INPUT, 0) /* MCU_RGMII1_RX_CTL */
++ J721E_WKUP_IOPAD(0x0008, PIN_OUTPUT, 0) /* MCU_RGMII1_TD3 */
++ J721E_WKUP_IOPAD(0x000c, PIN_OUTPUT, 0) /* MCU_RGMII1_TD2 */
++ J721E_WKUP_IOPAD(0x0010, PIN_OUTPUT, 0) /* MCU_RGMII1_TD1 */
++ J721E_WKUP_IOPAD(0x0014, PIN_OUTPUT, 0) /* MCU_RGMII1_TD0 */
++ J721E_WKUP_IOPAD(0x0020, PIN_INPUT, 0) /* MCU_RGMII1_RD3 */
++ J721E_WKUP_IOPAD(0x0024, PIN_INPUT, 0) /* MCU_RGMII1_RD2 */
++ J721E_WKUP_IOPAD(0x0028, PIN_INPUT, 0) /* MCU_RGMII1_RD1 */
++ J721E_WKUP_IOPAD(0x002c, PIN_INPUT, 0) /* MCU_RGMII1_RD0 */
++ J721E_WKUP_IOPAD(0x0018, PIN_OUTPUT, 0) /* MCU_RGMII1_TXC */
++ J721E_WKUP_IOPAD(0x001c, PIN_INPUT, 0) /* MCU_RGMII1_RXC */
+ >;
+ };
+
+ mcu_mdio_pins_default: mcu-mdio1-pins-default {
+ pinctrl-single,pins = <
+- J721E_WKUP_IOPAD(0x009c, PIN_OUTPUT, 0) /* (L1) MCU_MDIO0_MDC */
+- J721E_WKUP_IOPAD(0x0098, PIN_INPUT, 0) /* (L4) MCU_MDIO0_MDIO */
++ J721E_WKUP_IOPAD(0x0034, PIN_OUTPUT, 0) /* (L1) MCU_MDIO0_MDC */
++ J721E_WKUP_IOPAD(0x0030, PIN_INPUT, 0) /* (L4) MCU_MDIO0_MDIO */
+ >;
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From b752e6d11f6c90a78f4fb42c8637de569ff23377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 16:56:05 +0100
+Subject: arm64: sme: Use STR P to clear FFR context field in streaming SVE
+ mode
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit 893b24181b4c4bf1fa2841b1ed192e5413a97cb1 ]
+
+The FFR is a predicate register which can vary between 16 and 256 bits
+in size depending upon the configured vector length. When saving the
+SVE state in streaming SVE mode, the FFR register is inaccessible and
+so commit 9f5848665788 ("arm64/sve: Make access to FFR optional") simply
+clears the FFR field of the in-memory context structure. Unfortunately,
+it achieves this using an unconditional 8-byte store and so if the SME
+vector length is anything other than 64 bytes in size we will either
+fail to clear the entire field or, worse, we will corrupt memory
+immediately following the structure. This has led to intermittent kfence
+splats in CI [1] and can trigger kmalloc Redzone corruption messages
+when running the 'fp-stress' kselftest:
+
+ | =============================================================================
+ | BUG kmalloc-1k (Not tainted): kmalloc Redzone overwritten
+ | -----------------------------------------------------------------------------
+ |
+ | 0xffff000809bf1e22-0xffff000809bf1e27 @offset=7714. First byte 0x0 instead of 0xcc
+ | Allocated in do_sme_acc+0x9c/0x220 age=2613 cpu=1 pid=531
+ | __kmalloc+0x8c/0xcc
+ | do_sme_acc+0x9c/0x220
+ | ...
+
+Replace the 8-byte store with a store of a predicate register which has
+been zero-initialised with PFALSE, ensuring that the entire field is
+cleared in memory.
+
+[1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com
+
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
+Fixes: 9f5848665788 ("arm64/sve: Make access to FFR optional")
+Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Tested-by: Anders Roxell <anders.roxell@linaro.org>
+Link: https://lore.kernel.org/r/20230628155605.22296-1-will@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/fpsimdmacros.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/include/asm/fpsimdmacros.h b/arch/arm64/include/asm/fpsimdmacros.h
+index 5e0910cf48321..696d247cf8fb0 100644
+--- a/arch/arm64/include/asm/fpsimdmacros.h
++++ b/arch/arm64/include/asm/fpsimdmacros.h
+@@ -294,12 +294,12 @@
+ _for n, 0, 15, _sve_str_p \n, \nxbase, \n - 16
+ cbz \save_ffr, 921f
+ _sve_rdffr 0
+- _sve_str_p 0, \nxbase
+- _sve_ldr_p 0, \nxbase, -16
+ b 922f
+ 921:
+- str xzr, [x\nxbase] // Zero out FFR
++ _sve_pfalse 0 // Zero out FFR
+ 922:
++ _sve_str_p 0, \nxbase
++ _sve_ldr_p 0, \nxbase, -16
+ mrs x\nxtmp, fpsr
+ str w\nxtmp, [\xpfpsr]
+ mrs x\nxtmp, fpcr
+--
+2.39.2
+
--- /dev/null
+From e2d08ca2c97c25df31485d1a9d89e3d885858319 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 20:53:38 +0530
+Subject: ASoC: amd: acp: clear pdm dma interrupt mask
+
+From: Syed Saba Kareem <Syed.SabaKareem@amd.com>
+
+[ Upstream commit ad60672394bd1f95c58d3d9336902f47e05126fc ]
+
+Clear pdm dma interrupt mask in acp_dmic_shutdown().
+
+'Fixes: c32bd332ce5c9 ("ASoC: amd: acp: Add generic support for
+PDM controller on ACP")'
+
+Signed-off-by: Syed Saba Kareem <Syed.SabaKareem@amd.com>
+Link: https://lore.kernel.org/r/Message-Id: <20230622152406.3709231-1-Syed.SabaKareem@amd.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/acp-pdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/acp/acp-pdm.c b/sound/soc/amd/acp/acp-pdm.c
+index 66ec6b6a59723..f8030b79ac17c 100644
+--- a/sound/soc/amd/acp/acp-pdm.c
++++ b/sound/soc/amd/acp/acp-pdm.c
+@@ -176,7 +176,7 @@ static void acp_dmic_dai_shutdown(struct snd_pcm_substream *substream,
+
+ /* Disable DMIC interrupts */
+ ext_int_ctrl = readl(ACP_EXTERNAL_INTR_CNTL(adata, 0));
+- ext_int_ctrl |= ~PDM_DMA_INTR_MASK;
++ ext_int_ctrl &= ~PDM_DMA_INTR_MASK;
+ writel(ext_int_ctrl, ACP_EXTERNAL_INTR_CNTL(adata, 0));
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 85501fab874392b62b95596c551b034e10b8ef80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 21:11:39 +0300
+Subject: ASoC: es8316: Do not set rate constraints for unsupported MCLKs
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 60413129ee2b38a80347489270af7f6e1c1de4d0 ]
+
+When using the codec through the generic audio graph card, there are at
+least two calls of es8316_set_dai_sysclk(), with the effect of limiting
+the allowed sample rates according to the MCLK/LRCK ratios supported by
+the codec:
+
+1. During audio card setup, to set the initial MCLK - see
+ asoc_simple_init_dai().
+
+2. Before opening a stream, to update MCLK, according to the stream
+ sample rate and the multiplication factor - see
+ asoc_simple_hw_params().
+
+In some cases the initial MCLK might be set to a frequency that doesn't
+match any of the supported ratios, e.g. 12287999 instead of 12288000,
+which is only 1 Hz below the supported clock, as that is what the
+hardware reports. This creates an empty list of rate constraints, which
+is further passed to snd_pcm_hw_constraint_list() via
+es8316_pcm_startup(), and causes the following error on the very first
+access of the sound card:
+
+ $ speaker-test -D hw:Analog,0 -F S16_LE -c 2 -t wav
+ Broken configuration for playback: no configurations available: Invalid argument
+ Setting of hwparams failed: Invalid argument
+
+Note that all subsequent retries succeed thanks to the updated MCLK set
+at point 2 above, which uses a computed frequency value instead of a
+reading from the hardware registers. Normally this would have mitigated
+the issue, but es8316_pcm_startup() executes before the 2nd call to
+es8316_set_dai_sysclk(), hence it cannot make use of the updated
+constraints.
+
+Since es8316_pcm_hw_params() performs anyway a final validation of MCLK
+against the stream sample rate and the supported MCLK/LRCK ratios, fix
+the issue by ensuring that sysclk_constraints list is only set when at
+least one supported sample rate is autodetected by the codec.
+
+Fixes: b8b88b70875a ("ASoC: add es8316 codec driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://lore.kernel.org/r/20230530181140.483936-3-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8316.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index 2bfcd9af39172..87775378362e7 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -369,13 +369,11 @@ static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai,
+ int count = 0;
+
+ es8316->sysclk = freq;
++ es8316->sysclk_constraints.list = NULL;
++ es8316->sysclk_constraints.count = 0;
+
+- if (freq == 0) {
+- es8316->sysclk_constraints.list = NULL;
+- es8316->sysclk_constraints.count = 0;
+-
++ if (freq == 0)
+ return 0;
+- }
+
+ ret = clk_set_rate(es8316->mclk, freq);
+ if (ret)
+@@ -391,8 +389,10 @@ static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai,
+ es8316->allowed_rates[count++] = freq / ratio;
+ }
+
+- es8316->sysclk_constraints.list = es8316->allowed_rates;
+- es8316->sysclk_constraints.count = count;
++ if (count) {
++ es8316->sysclk_constraints.list = es8316->allowed_rates;
++ es8316->sysclk_constraints.count = count;
++ }
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From eee46e08350ec173ee511b260a861f3a786310d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 21:11:38 +0300
+Subject: ASoC: es8316: Increment max value for ALC Capture Target Volume
+ control
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 6f073429037cd79d7311cd8236311c53f5ea8f01 ]
+
+The following error occurs when trying to restore a previously saved
+ALSA mixer state (tested on a Rock 5B board):
+
+ $ alsactl --no-ucm -f /tmp/asound.state store hw:Analog
+ $ alsactl --no-ucm -I -f /tmp/asound.state restore hw:Analog
+ alsactl: set_control:1475: Cannot write control '2:0:0:ALC Capture Target Volume:0' : Invalid argument
+
+According to ES8316 datasheet, the register at address 0x2B, which is
+related to the above mixer control, contains by default the value 0xB0.
+Considering the corresponding ALC target bits (ALCLVL) are 7:4, the
+control is initialized with 11, which is one step above the maximum
+value allowed by the driver:
+
+ ALCLVL | dB gain
+ -------+--------
+ 0000 | -16.5
+ 0001 | -15.0
+ 0010 | -13.5
+ .... | .....
+ 0111 | -6.0
+ 1000 | -4.5
+ 1001 | -3.0
+ 1010 | -1.5
+ .... | .....
+ 1111 | -1.5
+
+The tests performed using the VU meter feature (--vumeter=TYPE) of
+arecord/aplay confirm the specs are correct and there is no measured
+gain if the 1011-1111 range would have been mapped to 0 dB:
+
+ dB gain | VU meter %
+ --------+-----------
+ -6.0 | 30-31
+ -4.5 | 35-36
+ -3.0 | 42-43
+ -1.5 | 50-51
+ 0.0 | 50-51
+
+Increment the max value allowed for ALC Capture Target Volume control,
+so that it matches the hardware default. Additionally, update the
+related TLV to prevent an artificial extension of the dB gain range.
+
+Fixes: b8b88b70875a ("ASoC: add es8316 codec driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://lore.kernel.org/r/20230530181140.483936-2-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8316.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index f7d7a9c91e04c..2bfcd9af39172 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -52,7 +52,12 @@ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(dac_vol_tlv, -9600, 50, 1);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(adc_vol_tlv, -9600, 50, 1);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_max_gain_tlv, -650, 150, 0);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_min_gain_tlv, -1200, 150, 0);
+-static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_target_tlv, -1650, 150, 0);
++
++static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(alc_target_tlv,
++ 0, 10, TLV_DB_SCALE_ITEM(-1650, 150, 0),
++ 11, 11, TLV_DB_SCALE_ITEM(-150, 0, 0),
++);
++
+ static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(hpmixer_gain_tlv,
+ 0, 4, TLV_DB_SCALE_ITEM(-1200, 150, 0),
+ 8, 11, TLV_DB_SCALE_ITEM(-450, 150, 0),
+@@ -115,7 +120,7 @@ static const struct snd_kcontrol_new es8316_snd_controls[] = {
+ alc_max_gain_tlv),
+ SOC_SINGLE_TLV("ALC Capture Min Volume", ES8316_ADC_ALC2, 0, 28, 0,
+ alc_min_gain_tlv),
+- SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 10, 0,
++ SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 11, 0,
+ alc_target_tlv),
+ SOC_SINGLE("ALC Capture Hold Time", ES8316_ADC_ALC3, 0, 10, 0),
+ SOC_SINGLE("ALC Capture Decay Time", ES8316_ADC_ALC4, 4, 10, 0),
+--
+2.39.2
+
--- /dev/null
+From fe0e9c6bc81a4454792105925508fc5573549707 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 15:15:09 +0300
+Subject: ASoC: imx-audmix: check return value of devm_kasprintf()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 2f76e1d6ca524a888d29aafe29f2ad2003857971 ]
+
+devm_kasprintf() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: b86ef5367761 ("ASoC: fsl: Add Audio Mixer machine driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230614121509.443926-1-claudiu.beznea@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-audmix.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/soc/fsl/imx-audmix.c b/sound/soc/fsl/imx-audmix.c
+index 1292a845c4244..d8e99b263ab21 100644
+--- a/sound/soc/fsl/imx-audmix.c
++++ b/sound/soc/fsl/imx-audmix.c
+@@ -228,6 +228,8 @@ static int imx_audmix_probe(struct platform_device *pdev)
+
+ dai_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s%s",
+ fe_name_pref, args.np->full_name + 1);
++ if (!dai_name)
++ return -ENOMEM;
+
+ dev_info(pdev->dev.parent, "DAI FE name:%s\n", dai_name);
+
+@@ -236,6 +238,8 @@ static int imx_audmix_probe(struct platform_device *pdev)
+ capture_dai_name =
+ devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s %s",
+ dai_name, "CPU-Capture");
++ if (!capture_dai_name)
++ return -ENOMEM;
+ }
+
+ priv->dai[i].cpus = &dlc[0];
+@@ -266,6 +270,8 @@ static int imx_audmix_probe(struct platform_device *pdev)
+ "AUDMIX-Playback-%d", i);
+ be_cp = devm_kasprintf(&pdev->dev, GFP_KERNEL,
+ "AUDMIX-Capture-%d", i);
++ if (!be_name || !be_pb || !be_cp)
++ return -ENOMEM;
+
+ priv->dai[num_dai + i].cpus = &dlc[3];
+ priv->dai[num_dai + i].codecs = &dlc[4];
+@@ -293,6 +299,9 @@ static int imx_audmix_probe(struct platform_device *pdev)
+ priv->dapm_routes[i].source =
+ devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s %s",
+ dai_name, "CPU-Playback");
++ if (!priv->dapm_routes[i].source)
++ return -ENOMEM;
++
+ priv->dapm_routes[i].sink = be_pb;
+ priv->dapm_routes[num_dai + i].source = be_pb;
+ priv->dapm_routes[num_dai + i].sink = be_cp;
+--
+2.39.2
+
--- /dev/null
+From 3dad8bff59547ec634b3dfdbdfd1ee74bc6cd690 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 12:32:59 -0500
+Subject: ASoC: Intel: sof_sdw: remove SOF_SDW_TGL_HDMI for MeteorLake devices
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 0db94947c9d3da16aa31d152b7d26fab78b02cb9 ]
+
+Topologies support three HDMI links on MeteorLake devices only.
+
+Fixes: 18489174e4fb ("ASoC: intel: sof_sdw: add RT711 SDCA card for MTL platform")
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com
+Link: https://lore.kernel.org/r/20230512173305.65399-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index d4f92bb5e29f8..a37c85d301471 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -372,7 +372,7 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ .matches = {
+ DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_mtlrvp"),
+ },
+- .driver_data = (void *)(RT711_JD1 | SOF_SDW_TGL_HDMI),
++ .driver_data = (void *)(RT711_JD1),
+ },
+ {}
+ };
+--
+2.39.2
+
--- /dev/null
+From 6fd31c923cd18d2425b3e6da138e13c2c349f571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 May 2023 17:19:04 +0800
+Subject: blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 8d211554679d0b23702bd32ba04aeac0c1c4f660 ]
+
+adjust_inuse_and_calc_cost() use spin_lock_irq() and IRQ will be enabled
+when unlock. DEADLOCK might happen if we have held other locks and disabled
+IRQ before invoking it.
+
+Fix it by using spin_lock_irqsave() instead, which can keep IRQ state
+consistent with before when unlock.
+
+ ================================
+ WARNING: inconsistent lock state
+ 5.10.0-02758-g8e5f91fd772f #26 Not tainted
+ --------------------------------
+ inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
+ kworker/2:3/388 [HC0[0]:SC0[0]:HE0:SE1] takes:
+ ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq
+ ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390
+ {IN-HARDIRQ-W} state was registered at:
+ __lock_acquire+0x3d7/0x1070
+ lock_acquire+0x197/0x4a0
+ __raw_spin_lock_irqsave
+ _raw_spin_lock_irqsave+0x3b/0x60
+ bfq_idle_slice_timer_body
+ bfq_idle_slice_timer+0x53/0x1d0
+ __run_hrtimer+0x477/0xa70
+ __hrtimer_run_queues+0x1c6/0x2d0
+ hrtimer_interrupt+0x302/0x9e0
+ local_apic_timer_interrupt
+ __sysvec_apic_timer_interrupt+0xfd/0x420
+ run_sysvec_on_irqstack_cond
+ sysvec_apic_timer_interrupt+0x46/0xa0
+ asm_sysvec_apic_timer_interrupt+0x12/0x20
+ irq event stamp: 837522
+ hardirqs last enabled at (837521): [<ffffffff84b9419d>] __raw_spin_unlock_irqrestore
+ hardirqs last enabled at (837521): [<ffffffff84b9419d>] _raw_spin_unlock_irqrestore+0x3d/0x40
+ hardirqs last disabled at (837522): [<ffffffff84b93fa3>] __raw_spin_lock_irq
+ hardirqs last disabled at (837522): [<ffffffff84b93fa3>] _raw_spin_lock_irq+0x43/0x50
+ softirqs last enabled at (835852): [<ffffffff84e00558>] __do_softirq+0x558/0x8ec
+ softirqs last disabled at (835845): [<ffffffff84c010ff>] asm_call_irq_on_stack+0xf/0x20
+
+ other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(&bfqd->lock);
+ <Interrupt>
+ lock(&bfqd->lock);
+
+ *** DEADLOCK ***
+
+ 3 locks held by kworker/2:3/388:
+ #0: ffff888107af0f38 ((wq_completion)kthrotld){+.+.}-{0:0}, at: process_one_work+0x742/0x13f0
+ #1: ffff8881176bfdd8 ((work_completion)(&td->dispatch_work)){+.+.}-{0:0}, at: process_one_work+0x777/0x13f0
+ #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq
+ #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390
+
+ stack backtrace:
+ CPU: 2 PID: 388 Comm: kworker/2:3 Not tainted 5.10.0-02758-g8e5f91fd772f #26
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
+ Workqueue: kthrotld blk_throtl_dispatch_work_fn
+ Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x107/0x167
+ print_usage_bug
+ valid_state
+ mark_lock_irq.cold+0x32/0x3a
+ mark_lock+0x693/0xbc0
+ mark_held_locks+0x9e/0xe0
+ __trace_hardirqs_on_caller
+ lockdep_hardirqs_on_prepare.part.0+0x151/0x360
+ trace_hardirqs_on+0x5b/0x180
+ __raw_spin_unlock_irq
+ _raw_spin_unlock_irq+0x24/0x40
+ spin_unlock_irq
+ adjust_inuse_and_calc_cost+0x4fb/0x970
+ ioc_rqos_merge+0x277/0x740
+ __rq_qos_merge+0x62/0xb0
+ rq_qos_merge
+ bio_attempt_back_merge+0x12c/0x4a0
+ blk_mq_sched_try_merge+0x1b6/0x4d0
+ bfq_bio_merge+0x24a/0x390
+ __blk_mq_sched_bio_merge+0xa6/0x460
+ blk_mq_sched_bio_merge
+ blk_mq_submit_bio+0x2e7/0x1ee0
+ __submit_bio_noacct_mq+0x175/0x3b0
+ submit_bio_noacct+0x1fb/0x270
+ blk_throtl_dispatch_work_fn+0x1ef/0x2b0
+ process_one_work+0x83e/0x13f0
+ process_scheduled_works
+ worker_thread+0x7e3/0xd80
+ kthread+0x353/0x470
+ ret_from_fork+0x1f/0x30
+
+Fixes: b0853ab4a238 ("blk-iocost: revamp in-period donation snapbacks")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20230527091904.3001833-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-iocost.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/block/blk-iocost.c b/block/blk-iocost.c
+index 00d59d2288f00..7dd6a33e1d6a8 100644
+--- a/block/blk-iocost.c
++++ b/block/blk-iocost.c
+@@ -2437,6 +2437,7 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime,
+ u32 hwi, adj_step;
+ s64 margin;
+ u64 cost, new_inuse;
++ unsigned long flags;
+
+ current_hweight(iocg, NULL, &hwi);
+ old_hwi = hwi;
+@@ -2455,11 +2456,11 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime,
+ iocg->inuse == iocg->active)
+ return cost;
+
+- spin_lock_irq(&ioc->lock);
++ spin_lock_irqsave(&ioc->lock, flags);
+
+ /* we own inuse only when @iocg is in the normal active state */
+ if (iocg->abs_vdebt || list_empty(&iocg->active_list)) {
+- spin_unlock_irq(&ioc->lock);
++ spin_unlock_irqrestore(&ioc->lock, flags);
+ return cost;
+ }
+
+@@ -2480,7 +2481,7 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime,
+ } while (time_after64(vtime + cost, now->vnow) &&
+ iocg->inuse != iocg->active);
+
+- spin_unlock_irq(&ioc->lock);
++ spin_unlock_irqrestore(&ioc->lock, flags);
+
+ TRACE_IOCG_PATH(inuse_adjust, iocg, now,
+ old_inuse, iocg->inuse, old_hwi, hwi);
+--
+2.39.2
+
--- /dev/null
+From 94cb7ec31def09b54a7fa40e1b653b28c1566adf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jun 2023 10:30:43 +0800
+Subject: blk-mq: fix potential io hang by wrong 'wake_batch'
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 4f1731df60f9033669f024d06ae26a6301260b55 ]
+
+In __blk_mq_tag_busy/idle(), updating 'active_queues' and calculating
+'wake_batch' is not atomic:
+
+t1: t2:
+_blk_mq_tag_busy blk_mq_tag_busy
+inc active_queues
+// assume 1->2
+ inc active_queues
+ // 2 -> 3
+ blk_mq_update_wake_batch
+ // calculate based on 3
+blk_mq_update_wake_batch
+/* calculate based on 2, while active_queues is actually 3. */
+
+Fix this problem by protecting them wih 'tags->lock', this is not a hot
+path, so performance should not be concerned. And now that all writers
+are inside the lock, switch 'actives_queues' from atomic to unsigned
+int.
+
+Fixes: 180dccb0dba4 ("blk-mq: fix tag_get wait task can't be awakened")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230610023043.2559121-1-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-debugfs.c | 2 +-
+ block/blk-mq-tag.c | 15 ++++++++++-----
+ block/blk-mq.h | 3 +--
+ include/linux/blk-mq.h | 3 +--
+ 4 files changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
+index bd942341b6382..7675e663df365 100644
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -427,7 +427,7 @@ static void blk_mq_debugfs_tags_show(struct seq_file *m,
+ seq_printf(m, "nr_tags=%u\n", tags->nr_tags);
+ seq_printf(m, "nr_reserved_tags=%u\n", tags->nr_reserved_tags);
+ seq_printf(m, "active_queues=%d\n",
+- atomic_read(&tags->active_queues));
++ READ_ONCE(tags->active_queues));
+
+ seq_puts(m, "\nbitmap_tags:\n");
+ sbitmap_queue_show(&tags->bitmap_tags, m);
+diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
+index a80d7c62bdfe6..100889c276c3f 100644
+--- a/block/blk-mq-tag.c
++++ b/block/blk-mq-tag.c
+@@ -40,6 +40,7 @@ static void blk_mq_update_wake_batch(struct blk_mq_tags *tags,
+ void __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx)
+ {
+ unsigned int users;
++ struct blk_mq_tags *tags = hctx->tags;
+
+ /*
+ * calling test_bit() prior to test_and_set_bit() is intentional,
+@@ -57,9 +58,11 @@ void __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx)
+ return;
+ }
+
+- users = atomic_inc_return(&hctx->tags->active_queues);
+-
+- blk_mq_update_wake_batch(hctx->tags, users);
++ spin_lock_irq(&tags->lock);
++ users = tags->active_queues + 1;
++ WRITE_ONCE(tags->active_queues, users);
++ blk_mq_update_wake_batch(tags, users);
++ spin_unlock_irq(&tags->lock);
+ }
+
+ /*
+@@ -92,9 +95,11 @@ void __blk_mq_tag_idle(struct blk_mq_hw_ctx *hctx)
+ return;
+ }
+
+- users = atomic_dec_return(&tags->active_queues);
+-
++ spin_lock_irq(&tags->lock);
++ users = tags->active_queues - 1;
++ WRITE_ONCE(tags->active_queues, users);
+ blk_mq_update_wake_batch(tags, users);
++ spin_unlock_irq(&tags->lock);
+
+ blk_mq_tag_wakeup_all(tags, false);
+ }
+diff --git a/block/blk-mq.h b/block/blk-mq.h
+index 0b2870839cdd6..c6eca452ea2a2 100644
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -362,8 +362,7 @@ static inline bool hctx_may_queue(struct blk_mq_hw_ctx *hctx,
+ return true;
+ }
+
+- users = atomic_read(&hctx->tags->active_queues);
+-
++ users = READ_ONCE(hctx->tags->active_queues);
+ if (!users)
+ return true;
+
+diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
+index a9764cbf7f8d2..e4f676e1042b5 100644
+--- a/include/linux/blk-mq.h
++++ b/include/linux/blk-mq.h
+@@ -745,8 +745,7 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
+ struct blk_mq_tags {
+ unsigned int nr_tags;
+ unsigned int nr_reserved_tags;
+-
+- atomic_t active_queues;
++ unsigned int active_queues;
+
+ struct sbitmap_queue bitmap_tags;
+ struct sbitmap_queue breserved_tags;
+--
+2.39.2
+
--- /dev/null
+From 7dc54a5b7dbae2edce1e8bcbfa3b564bf281cc76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jun 2023 10:20:03 +0800
+Subject: block: fix blktrace debugfs entries leakage
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit dd7de3704af9989b780693d51eaea49a665bd9c2 ]
+
+Commit 99d055b4fd4b ("block: remove per-disk debugfs files in
+blk_unregister_queue") moves blk_trace_shutdown() from
+blk_release_queue() to blk_unregister_queue(), this is safe if blktrace
+is created through sysfs, however, there is a regression in corner
+case.
+
+blktrace can still be enabled after del_gendisk() through ioctl if
+the disk is opened before del_gendisk(), and if blktrace is not shutdown
+through ioctl before closing the disk, debugfs entries will be leaked.
+
+Fix this problem by shutdown blktrace in disk_release(), this is safe
+because blk_trace_remove() is reentrant.
+
+Fixes: 99d055b4fd4b ("block: remove per-disk debugfs files in blk_unregister_queue")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20230610022003.2557284-4-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/genhd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 62a61388e752d..afab646d12c85 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -25,8 +25,9 @@
+ #include <linux/pm_runtime.h>
+ #include <linux/badblocks.h>
+ #include <linux/part_stat.h>
+-#include "blk-throttle.h"
++#include <linux/blktrace_api.h>
+
++#include "blk-throttle.h"
+ #include "blk.h"
+ #include "blk-mq-sched.h"
+ #include "blk-rq-qos.h"
+@@ -1181,6 +1182,8 @@ static void disk_release(struct device *dev)
+ might_sleep();
+ WARN_ON_ONCE(disk_live(disk));
+
++ blk_trace_remove(disk->queue);
++
+ /*
+ * To undo the all initialization from blk_mq_init_allocated_queue in
+ * case of a probe failure where add_disk is never called we have to
+--
+2.39.2
+
--- /dev/null
+From cdaa08692e19863bf26ec9e539bb230d9af8d8cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 10:42:21 -0700
+Subject: block: Fix the type of the second bdev_op_is_zoned_write() argument
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 3ddbe2a7e0d4a155a805f69c906c9beed30d4cc4 ]
+
+Change the type of the second argument of bdev_op_is_zoned_write() from
+blk_opf_t into enum req_op because this function expects an operation
+without flags as second argument.
+
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Pankaj Raghav <p.raghav@samsung.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Cc: Ming Lei <ming.lei@redhat.com>
+Fixes: 8cafdb5ab94c ("block: adapt blk_mq_plug() to not plug for writes that require a zone lock")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20230517174230.897144-4-bvanassche@acm.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/blkdev.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 891f8cbcd0436..427e79ac72194 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -1305,7 +1305,7 @@ static inline bool bdev_is_zoned(struct block_device *bdev)
+ }
+
+ static inline bool bdev_op_is_zoned_write(struct block_device *bdev,
+- blk_opf_t op)
++ enum req_op op)
+ {
+ if (!bdev_is_zoned(bdev))
+ return false;
+--
+2.39.2
+
--- /dev/null
+From 157eed3125fcc13f75af4147092bb06ed35848d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 15:23:04 +0000
+Subject: bonding: do not assume skb mac_header is set
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 6a940abdef3162e5723f1495b8a49859d1708f79 ]
+
+Drivers must not assume in their ndo_start_xmit() that
+skbs have their mac_header set. skb->data is all what is needed.
+
+bonding seems to be one of the last offender as caught by syzbot:
+
+WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 skb_mac_offset include/linux/skbuff.h:2913 [inline]
+WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline]
+WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline]
+WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline]
+WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 __bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline]
+WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470
+Modules linked in:
+CPU: 1 PID: 12155 Comm: syz-executor.3 Not tainted 6.1.30-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
+RIP: 0010:skb_mac_header include/linux/skbuff.h:2907 [inline]
+RIP: 0010:skb_mac_offset include/linux/skbuff.h:2913 [inline]
+RIP: 0010:bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline]
+RIP: 0010:bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline]
+RIP: 0010:bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline]
+RIP: 0010:__bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline]
+RIP: 0010:bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470
+Code: 8b 7c 24 30 e8 76 dd 1a 01 48 85 c0 74 0d 48 89 c3 e8 29 67 2e fe e9 15 ef ff ff e8 1f 67 2e fe e9 10 ef ff ff e8 15 67 2e fe <0f> 0b e9 45 f8 ff ff e8 09 67 2e fe e9 dc fa ff ff e8 ff 66 2e fe
+RSP: 0018:ffffc90002fff6e0 EFLAGS: 00010283
+RAX: ffffffff835874db RBX: 000000000000ffff RCX: 0000000000040000
+RDX: ffffc90004dcf000 RSI: 00000000000000b5 RDI: 00000000000000b6
+RBP: ffffc90002fff8b8 R08: ffffffff83586d16 R09: ffffffff83586584
+R10: 0000000000000007 R11: ffff8881599fc780 R12: ffff88811b6a7b7e
+R13: 1ffff110236d4f6f R14: ffff88811b6a7ac0 R15: 1ffff110236d4f76
+FS: 00007f2e9eb47700(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000001b2e421000 CR3: 000000010e6d4000 CR4: 00000000003526e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+<TASK>
+[<ffffffff8471a49f>] netdev_start_xmit include/linux/netdevice.h:4925 [inline]
+[<ffffffff8471a49f>] __dev_direct_xmit+0x4ef/0x850 net/core/dev.c:4380
+[<ffffffff851d845b>] dev_direct_xmit include/linux/netdevice.h:3043 [inline]
+[<ffffffff851d845b>] packet_direct_xmit+0x18b/0x300 net/packet/af_packet.c:284
+[<ffffffff851c7472>] packet_snd net/packet/af_packet.c:3112 [inline]
+[<ffffffff851c7472>] packet_sendmsg+0x4a22/0x64d0 net/packet/af_packet.c:3143
+[<ffffffff8467a4b2>] sock_sendmsg_nosec net/socket.c:716 [inline]
+[<ffffffff8467a4b2>] sock_sendmsg net/socket.c:736 [inline]
+[<ffffffff8467a4b2>] __sys_sendto+0x472/0x5f0 net/socket.c:2139
+[<ffffffff8467a715>] __do_sys_sendto net/socket.c:2151 [inline]
+[<ffffffff8467a715>] __se_sys_sendto net/socket.c:2147 [inline]
+[<ffffffff8467a715>] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147
+[<ffffffff8553071f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+[<ffffffff8553071f>] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80
+[<ffffffff85600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Fixes: 7b8fc0103bb5 ("bonding: add a vlan+srcmac tx hashing option")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Jarod Wilson <jarod@redhat.com>
+Cc: Moshe Tal <moshet@nvidia.com>
+Cc: Jussi Maki <joamaki@gmail.com>
+Cc: Jay Vosburgh <j.vosburgh@gmail.com>
+Cc: Andy Gospodarek <andy@greyhouse.net>
+Cc: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://lore.kernel.org/r/20230622152304.2137482-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 9ed80f7106515..91d84df91123b 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4168,7 +4168,7 @@ u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb)
+ return skb->hash;
+
+ return __bond_xmit_hash(bond, skb, skb->data, skb->protocol,
+- skb_mac_offset(skb), skb_network_offset(skb),
++ 0, skb_network_offset(skb),
+ skb_headlen(skb));
+ }
+
+--
+2.39.2
+
--- /dev/null
+From c3cadfbd769e18cffb2123537e7d2bfb61fbfd35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 13:42:09 +0300
+Subject: bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC
+ hookpoint
+
+From: Gilad Sever <gilad9366@gmail.com>
+
+[ Upstream commit 97fbfeb86917bdbe9c41d5143e335a929147f405 ]
+
+skb->dev always exists in the tc flow. There is no need to use
+bpf_skc_lookup(), bpf_sk_lookup() from this code path.
+
+This change facilitates fixing the tc flow to be VRF aware.
+
+Signed-off-by: Gilad Sever <gilad9366@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
+Reviewed-by: Eyal Birger <eyal.birger@gmail.com>
+Acked-by: Stanislav Fomichev <sdf@google.com>
+Link: https://lore.kernel.org/bpf/20230621104211.301902-3-gilad9366@gmail.com
+Stable-dep-of: 9a5cb79762e0 ("bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index e0f73ed8821e1..1b60a6cc975a7 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -6649,8 +6649,12 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = {
+ BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb,
+ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
+ {
+- return (unsigned long)bpf_skc_lookup(skb, tuple, len, IPPROTO_TCP,
+- netns_id, flags);
++ struct net *caller_net = dev_net(skb->dev);
++ int ifindex = skb->dev->ifindex;
++
++ return (unsigned long)__bpf_skc_lookup(skb, tuple, len, caller_net,
++ ifindex, IPPROTO_TCP, netns_id,
++ flags);
+ }
+
+ static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = {
+@@ -6668,8 +6672,12 @@ static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = {
+ BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb,
+ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
+ {
+- return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_TCP,
+- netns_id, flags);
++ struct net *caller_net = dev_net(skb->dev);
++ int ifindex = skb->dev->ifindex;
++
++ return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net,
++ ifindex, IPPROTO_TCP, netns_id,
++ flags);
+ }
+
+ static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = {
+@@ -6687,8 +6695,12 @@ static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = {
+ BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb,
+ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
+ {
+- return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_UDP,
+- netns_id, flags);
++ struct net *caller_net = dev_net(skb->dev);
++ int ifindex = skb->dev->ifindex;
++
++ return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net,
++ ifindex, IPPROTO_UDP, netns_id,
++ flags);
+ }
+
+ static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = {
+--
+2.39.2
+
--- /dev/null
+From 7490c80b0b897ccf88a682546ca814acfbc16fb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 May 2023 10:04:53 -0700
+Subject: bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen
+
+From: Stanislav Fomichev <sdf@google.com>
+
+[ Upstream commit 29ebbba7d46136cba324264e513a1e964ca16c0a ]
+
+With the way the hooks implemented right now, we have a special
+condition: optval larger than PAGE_SIZE will expose only first 4k into
+BPF; any modifications to the optval are ignored. If the BPF program
+doesn't handle this condition by resetting optlen to 0,
+the userspace will get EFAULT.
+
+The intention of the EFAULT was to make it apparent to the
+developers that the program is doing something wrong.
+However, this inadvertently might affect production workloads
+with the BPF programs that are not too careful (i.e., returning EFAULT
+for perfectly valid setsockopt/getsockopt calls).
+
+Let's try to minimize the chance of BPF program screwing up userspace
+by ignoring the output of those BPF programs (instead of returning
+EFAULT to the userspace). pr_info_once those cases to
+the dmesg to help with figuring out what's going wrong.
+
+Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks")
+Suggested-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Link: https://lore.kernel.org/r/20230511170456.1759459-2-sdf@google.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/cgroup.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
+index b86b907e566ca..bb70f400c25eb 100644
+--- a/kernel/bpf/cgroup.c
++++ b/kernel/bpf/cgroup.c
+@@ -1826,6 +1826,12 @@ int __cgroup_bpf_run_filter_setsockopt(struct sock *sk, int *level,
+ ret = 1;
+ } else if (ctx.optlen > max_optlen || ctx.optlen < -1) {
+ /* optlen is out of bounds */
++ if (*optlen > PAGE_SIZE && ctx.optlen >= 0) {
++ pr_info_once("bpf setsockopt: ignoring program buffer with optlen=%d (max_optlen=%d)\n",
++ ctx.optlen, max_optlen);
++ ret = 0;
++ goto out;
++ }
+ ret = -EFAULT;
+ } else {
+ /* optlen within bounds, run kernel handler */
+@@ -1881,8 +1887,10 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
+ .optname = optname,
+ .current_task = current,
+ };
++ int orig_optlen;
+ int ret;
+
++ orig_optlen = max_optlen;
+ ctx.optlen = max_optlen;
+ max_optlen = sockopt_alloc_buf(&ctx, max_optlen, &buf);
+ if (max_optlen < 0)
+@@ -1905,6 +1913,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
+ ret = -EFAULT;
+ goto out;
+ }
++ orig_optlen = ctx.optlen;
+
+ if (copy_from_user(ctx.optval, optval,
+ min(ctx.optlen, max_optlen)) != 0) {
+@@ -1922,6 +1931,12 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
+ goto out;
+
+ if (optval && (ctx.optlen > max_optlen || ctx.optlen < 0)) {
++ if (orig_optlen > PAGE_SIZE && ctx.optlen >= 0) {
++ pr_info_once("bpf getsockopt: ignoring program buffer with optlen=%d (max_optlen=%d)\n",
++ ctx.optlen, max_optlen);
++ ret = retval;
++ goto out;
++ }
+ ret = -EFAULT;
+ goto out;
+ }
+--
+2.39.2
+
--- /dev/null
+From 3700546d4c21df7de5f867d300d1fb6d622f5cd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 13:42:08 +0300
+Subject: bpf: Factor out socket lookup functions for the TC hookpoint.
+
+From: Gilad Sever <gilad9366@gmail.com>
+
+[ Upstream commit 6e98730bc0b44acaf86eccc75f823128aa9c9e79 ]
+
+Change BPF helper socket lookup functions to use TC specific variants:
+bpf_tc_sk_lookup_tcp() / bpf_tc_sk_lookup_udp() / bpf_tc_skc_lookup_tcp()
+instead of sharing implementation with the cg / sk_skb hooking points.
+This allows introducing a separate logic for the TC flow.
+
+The tc functions are identical to the original code.
+
+Signed-off-by: Gilad Sever <gilad9366@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
+Reviewed-by: Eyal Birger <eyal.birger@gmail.com>
+Acked-by: Stanislav Fomichev <sdf@google.com>
+Link: https://lore.kernel.org/bpf/20230621104211.301902-2-gilad9366@gmail.com
+Stable-dep-of: 9a5cb79762e0 ("bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 63 ++++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 60 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index b79a070fa8246..e0f73ed8821e1 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -6646,6 +6646,63 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = {
+ .arg5_type = ARG_ANYTHING,
+ };
+
++BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb,
++ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
++{
++ return (unsigned long)bpf_skc_lookup(skb, tuple, len, IPPROTO_TCP,
++ netns_id, flags);
++}
++
++static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = {
++ .func = bpf_tc_skc_lookup_tcp,
++ .gpl_only = false,
++ .pkt_access = true,
++ .ret_type = RET_PTR_TO_SOCK_COMMON_OR_NULL,
++ .arg1_type = ARG_PTR_TO_CTX,
++ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
++ .arg3_type = ARG_CONST_SIZE,
++ .arg4_type = ARG_ANYTHING,
++ .arg5_type = ARG_ANYTHING,
++};
++
++BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb,
++ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
++{
++ return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_TCP,
++ netns_id, flags);
++}
++
++static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = {
++ .func = bpf_tc_sk_lookup_tcp,
++ .gpl_only = false,
++ .pkt_access = true,
++ .ret_type = RET_PTR_TO_SOCKET_OR_NULL,
++ .arg1_type = ARG_PTR_TO_CTX,
++ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
++ .arg3_type = ARG_CONST_SIZE,
++ .arg4_type = ARG_ANYTHING,
++ .arg5_type = ARG_ANYTHING,
++};
++
++BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb,
++ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
++{
++ return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_UDP,
++ netns_id, flags);
++}
++
++static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = {
++ .func = bpf_tc_sk_lookup_udp,
++ .gpl_only = false,
++ .pkt_access = true,
++ .ret_type = RET_PTR_TO_SOCKET_OR_NULL,
++ .arg1_type = ARG_PTR_TO_CTX,
++ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
++ .arg3_type = ARG_CONST_SIZE,
++ .arg4_type = ARG_ANYTHING,
++ .arg5_type = ARG_ANYTHING,
++};
++
+ BPF_CALL_1(bpf_sk_release, struct sock *, sk)
+ {
+ if (sk && sk_is_refcounted(sk))
+@@ -7902,9 +7959,9 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
+ #endif
+ #ifdef CONFIG_INET
+ case BPF_FUNC_sk_lookup_tcp:
+- return &bpf_sk_lookup_tcp_proto;
++ return &bpf_tc_sk_lookup_tcp_proto;
+ case BPF_FUNC_sk_lookup_udp:
+- return &bpf_sk_lookup_udp_proto;
++ return &bpf_tc_sk_lookup_udp_proto;
+ case BPF_FUNC_sk_release:
+ return &bpf_sk_release_proto;
+ case BPF_FUNC_tcp_sock:
+@@ -7912,7 +7969,7 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
+ case BPF_FUNC_get_listener_sock:
+ return &bpf_get_listener_sock_proto;
+ case BPF_FUNC_skc_lookup_tcp:
+- return &bpf_skc_lookup_tcp_proto;
++ return &bpf_tc_skc_lookup_tcp_proto;
+ case BPF_FUNC_tcp_check_syncookie:
+ return &bpf_tcp_check_syncookie_proto;
+ case BPF_FUNC_skb_ecn_set_ce:
+--
+2.39.2
+
--- /dev/null
+From df8ec53ac1b0a7fd28ceec94b4f49ec30886884a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 13:42:10 +0300
+Subject: bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings
+
+From: Gilad Sever <gilad9366@gmail.com>
+
+[ Upstream commit 9a5cb79762e0eda17ca15c2a6eaca4622383c21c ]
+
+When calling bpf_sk_lookup_tcp(), bpf_sk_lookup_udp() or
+bpf_skc_lookup_tcp() from tc/xdp ingress, VRF socket bindings aren't
+respoected, i.e. unbound sockets are returned, and bound sockets aren't
+found.
+
+VRF binding is determined by the sdif argument to sk_lookup(), however
+when called from tc the IP SKB control block isn't initialized and thus
+inet{,6}_sdif() always returns 0.
+
+Fix by calculating sdif for the tc/xdp flows by observing the device's
+l3 enslaved state.
+
+The cg/sk_skb hooking points which are expected to support
+inet{,6}_sdif() pass sdif=-1 which makes __bpf_skc_lookup() use the
+existing logic.
+
+Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF")
+Signed-off-by: Gilad Sever <gilad9366@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
+Reviewed-by: Eyal Birger <eyal.birger@gmail.com>
+Acked-by: Stanislav Fomichev <sdf@google.com>
+Cc: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/bpf/20230621104211.301902-4-gilad9366@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 9 +++++
+ net/core/filter.c | 69 ++++++++++++++++++++++-----------------
+ 2 files changed, 48 insertions(+), 30 deletions(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index d5eb3ab8e38f2..5a04fbf724768 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -5028,6 +5028,15 @@ static inline bool netif_is_l3_slave(const struct net_device *dev)
+ return dev->priv_flags & IFF_L3MDEV_SLAVE;
+ }
+
++static inline int dev_sdif(const struct net_device *dev)
++{
++#ifdef CONFIG_NET_L3_MASTER_DEV
++ if (netif_is_l3_slave(dev))
++ return dev->ifindex;
++#endif
++ return 0;
++}
++
+ static inline bool netif_is_bridge_master(const struct net_device *dev)
+ {
+ return dev->priv_flags & IFF_EBRIDGE;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 1b60a6cc975a7..da71e6812ab51 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -6474,12 +6474,11 @@ static struct sock *sk_lookup(struct net *net, struct bpf_sock_tuple *tuple,
+ static struct sock *
+ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
+ struct net *caller_net, u32 ifindex, u8 proto, u64 netns_id,
+- u64 flags)
++ u64 flags, int sdif)
+ {
+ struct sock *sk = NULL;
+ struct net *net;
+ u8 family;
+- int sdif;
+
+ if (len == sizeof(tuple->ipv4))
+ family = AF_INET;
+@@ -6491,10 +6490,12 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
+ if (unlikely(flags || !((s32)netns_id < 0 || netns_id <= S32_MAX)))
+ goto out;
+
+- if (family == AF_INET)
+- sdif = inet_sdif(skb);
+- else
+- sdif = inet6_sdif(skb);
++ if (sdif < 0) {
++ if (family == AF_INET)
++ sdif = inet_sdif(skb);
++ else
++ sdif = inet6_sdif(skb);
++ }
+
+ if ((s32)netns_id < 0) {
+ net = caller_net;
+@@ -6514,10 +6515,11 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
+ static struct sock *
+ __bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
+ struct net *caller_net, u32 ifindex, u8 proto, u64 netns_id,
+- u64 flags)
++ u64 flags, int sdif)
+ {
+ struct sock *sk = __bpf_skc_lookup(skb, tuple, len, caller_net,
+- ifindex, proto, netns_id, flags);
++ ifindex, proto, netns_id, flags,
++ sdif);
+
+ if (sk) {
+ struct sock *sk2 = sk_to_full_sk(sk);
+@@ -6557,7 +6559,7 @@ bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
+ }
+
+ return __bpf_skc_lookup(skb, tuple, len, caller_net, ifindex, proto,
+- netns_id, flags);
++ netns_id, flags, -1);
+ }
+
+ static struct sock *
+@@ -6649,12 +6651,13 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = {
+ BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb,
+ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
+ {
+- struct net *caller_net = dev_net(skb->dev);
+- int ifindex = skb->dev->ifindex;
++ struct net_device *dev = skb->dev;
++ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
++ struct net *caller_net = dev_net(dev);
+
+ return (unsigned long)__bpf_skc_lookup(skb, tuple, len, caller_net,
+ ifindex, IPPROTO_TCP, netns_id,
+- flags);
++ flags, sdif);
+ }
+
+ static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = {
+@@ -6672,12 +6675,13 @@ static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = {
+ BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb,
+ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
+ {
+- struct net *caller_net = dev_net(skb->dev);
+- int ifindex = skb->dev->ifindex;
++ struct net_device *dev = skb->dev;
++ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
++ struct net *caller_net = dev_net(dev);
+
+ return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net,
+ ifindex, IPPROTO_TCP, netns_id,
+- flags);
++ flags, sdif);
+ }
+
+ static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = {
+@@ -6695,12 +6699,13 @@ static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = {
+ BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb,
+ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
+ {
+- struct net *caller_net = dev_net(skb->dev);
+- int ifindex = skb->dev->ifindex;
++ struct net_device *dev = skb->dev;
++ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
++ struct net *caller_net = dev_net(dev);
+
+ return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net,
+ ifindex, IPPROTO_UDP, netns_id,
+- flags);
++ flags, sdif);
+ }
+
+ static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = {
+@@ -6732,12 +6737,13 @@ static const struct bpf_func_proto bpf_sk_release_proto = {
+ BPF_CALL_5(bpf_xdp_sk_lookup_udp, struct xdp_buff *, ctx,
+ struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags)
+ {
+- struct net *caller_net = dev_net(ctx->rxq->dev);
+- int ifindex = ctx->rxq->dev->ifindex;
++ struct net_device *dev = ctx->rxq->dev;
++ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
++ struct net *caller_net = dev_net(dev);
+
+ return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, caller_net,
+ ifindex, IPPROTO_UDP, netns_id,
+- flags);
++ flags, sdif);
+ }
+
+ static const struct bpf_func_proto bpf_xdp_sk_lookup_udp_proto = {
+@@ -6755,12 +6761,13 @@ static const struct bpf_func_proto bpf_xdp_sk_lookup_udp_proto = {
+ BPF_CALL_5(bpf_xdp_skc_lookup_tcp, struct xdp_buff *, ctx,
+ struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags)
+ {
+- struct net *caller_net = dev_net(ctx->rxq->dev);
+- int ifindex = ctx->rxq->dev->ifindex;
++ struct net_device *dev = ctx->rxq->dev;
++ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
++ struct net *caller_net = dev_net(dev);
+
+ return (unsigned long)__bpf_skc_lookup(NULL, tuple, len, caller_net,
+ ifindex, IPPROTO_TCP, netns_id,
+- flags);
++ flags, sdif);
+ }
+
+ static const struct bpf_func_proto bpf_xdp_skc_lookup_tcp_proto = {
+@@ -6778,12 +6785,13 @@ static const struct bpf_func_proto bpf_xdp_skc_lookup_tcp_proto = {
+ BPF_CALL_5(bpf_xdp_sk_lookup_tcp, struct xdp_buff *, ctx,
+ struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags)
+ {
+- struct net *caller_net = dev_net(ctx->rxq->dev);
+- int ifindex = ctx->rxq->dev->ifindex;
++ struct net_device *dev = ctx->rxq->dev;
++ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
++ struct net *caller_net = dev_net(dev);
+
+ return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, caller_net,
+ ifindex, IPPROTO_TCP, netns_id,
+- flags);
++ flags, sdif);
+ }
+
+ static const struct bpf_func_proto bpf_xdp_sk_lookup_tcp_proto = {
+@@ -6803,7 +6811,8 @@ BPF_CALL_5(bpf_sock_addr_skc_lookup_tcp, struct bpf_sock_addr_kern *, ctx,
+ {
+ return (unsigned long)__bpf_skc_lookup(NULL, tuple, len,
+ sock_net(ctx->sk), 0,
+- IPPROTO_TCP, netns_id, flags);
++ IPPROTO_TCP, netns_id, flags,
++ -1);
+ }
+
+ static const struct bpf_func_proto bpf_sock_addr_skc_lookup_tcp_proto = {
+@@ -6822,7 +6831,7 @@ BPF_CALL_5(bpf_sock_addr_sk_lookup_tcp, struct bpf_sock_addr_kern *, ctx,
+ {
+ return (unsigned long)__bpf_sk_lookup(NULL, tuple, len,
+ sock_net(ctx->sk), 0, IPPROTO_TCP,
+- netns_id, flags);
++ netns_id, flags, -1);
+ }
+
+ static const struct bpf_func_proto bpf_sock_addr_sk_lookup_tcp_proto = {
+@@ -6841,7 +6850,7 @@ BPF_CALL_5(bpf_sock_addr_sk_lookup_udp, struct bpf_sock_addr_kern *, ctx,
+ {
+ return (unsigned long)__bpf_sk_lookup(NULL, tuple, len,
+ sock_net(ctx->sk), 0, IPPROTO_UDP,
+- netns_id, flags);
++ netns_id, flags, -1);
+ }
+
+ static const struct bpf_func_proto bpf_sock_addr_sk_lookup_udp_proto = {
+--
+2.39.2
+
--- /dev/null
+From 85ebabd75cfe9913da14dd29030c6a1859f9808d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 13:08:47 +0000
+Subject: bpf: Fix memleak due to fentry attach failure
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 108598c39eefbedc9882273ac0df96127a629220 ]
+
+If it fails to attach fentry, the allocated bpf trampoline image will be
+left in the system. That can be verified by checking /proc/kallsyms.
+
+This meamleak can be verified by a simple bpf program as follows:
+
+ SEC("fentry/trap_init")
+ int fentry_run()
+ {
+ return 0;
+ }
+
+It will fail to attach trap_init because this function is freed after
+kernel init, and then we can find the trampoline image is left in the
+system by checking /proc/kallsyms.
+
+ $ tail /proc/kallsyms
+ ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf]
+ ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf]
+
+ $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'"
+ [2522] FUNC 'trap_init' type_id=119 linkage=static
+
+ $ echo $((6442453466 & 0x7fffffff))
+ 2522
+
+Note that there are two left bpf trampoline images, that is because the
+libbpf will fallback to raw tracepoint if -EINVAL is returned.
+
+Fixes: e21aa341785c ("bpf: Fix fexit trampoline.")
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Song Liu <song@kernel.org>
+Cc: Jiri Olsa <olsajiri@gmail.com>
+Link: https://lore.kernel.org/bpf/20230515130849.57502-2-laoar.shao@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/trampoline.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
+index 91d8de938a3dd..30af8f66e17b4 100644
+--- a/kernel/bpf/trampoline.c
++++ b/kernel/bpf/trampoline.c
+@@ -279,11 +279,8 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total, bool *ip_a
+ return tlinks;
+ }
+
+-static void __bpf_tramp_image_put_deferred(struct work_struct *work)
++static void bpf_tramp_image_free(struct bpf_tramp_image *im)
+ {
+- struct bpf_tramp_image *im;
+-
+- im = container_of(work, struct bpf_tramp_image, work);
+ bpf_image_ksym_del(&im->ksym);
+ bpf_jit_free_exec(im->image);
+ bpf_jit_uncharge_modmem(PAGE_SIZE);
+@@ -291,6 +288,14 @@ static void __bpf_tramp_image_put_deferred(struct work_struct *work)
+ kfree_rcu(im, rcu);
+ }
+
++static void __bpf_tramp_image_put_deferred(struct work_struct *work)
++{
++ struct bpf_tramp_image *im;
++
++ im = container_of(work, struct bpf_tramp_image, work);
++ bpf_tramp_image_free(im);
++}
++
+ /* callback, fexit step 3 or fentry step 2 */
+ static void __bpf_tramp_image_put_rcu(struct rcu_head *rcu)
+ {
+@@ -465,7 +470,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
+ &tr->func.model, tr->flags, tlinks,
+ tr->func.addr);
+ if (err < 0)
+- goto out;
++ goto out_free;
+
+ set_memory_ro((long)im->image, 1);
+ set_memory_x((long)im->image, 1);
+@@ -495,7 +500,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
+ }
+ #endif
+ if (err)
+- goto out;
++ goto out_free;
+
+ if (tr->cur_image)
+ bpf_tramp_image_put(tr->cur_image);
+@@ -506,6 +511,10 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
+ tr->flags = orig_flags;
+ kfree(tlinks);
+ return err;
++
++out_free:
++ bpf_tramp_image_free(im);
++ goto out;
+ }
+
+ static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog)
+--
+2.39.2
+
--- /dev/null
+From f4c24105fc948e7ac9d417bb22742b88e7eff91c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 13:08:48 +0000
+Subject: bpf: Remove bpf trampoline selector
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 47e79cbeea4b3891ad476047f4c68543eb51c8e0 ]
+
+After commit e21aa341785c ("bpf: Fix fexit trampoline."), the selector is only
+used to indicate how many times the bpf trampoline image are updated and been
+displayed in the trampoline ksym name. After the trampoline is freed, the
+selector will start from 0 again. So the selector is a useless value to the
+user. We can remove it.
+
+If the user want to check whether the bpf trampoline image has been updated
+or not, the user can compare the address. Each time the trampoline image is
+updated, the address will change consequently. Jiri also pointed out another
+issue that perf is still using the old name "bpf_trampoline_%lu", so this
+change can fix the issue in perf.
+
+Fixes: e21aa341785c ("bpf: Fix fexit trampoline.")
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Song Liu <song@kernel.org>
+Cc: Jiri Olsa <olsajiri@gmail.com>
+Link: https://lore.kernel.org/bpf/ZFvOOlrmHiY9AgXE@krava
+Link: https://lore.kernel.org/bpf/20230515130849.57502-3-laoar.shao@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 1 -
+ kernel/bpf/trampoline.c | 11 ++++-------
+ 2 files changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 942f9ac9fa7b6..8cef9ec3a89c2 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -933,7 +933,6 @@ struct bpf_trampoline {
+ int progs_cnt[BPF_TRAMP_MAX];
+ /* Executable image of trampoline */
+ struct bpf_tramp_image *cur_image;
+- u64 selector;
+ struct module *mod;
+ };
+
+diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
+index f1504cb5b6e19..91d8de938a3dd 100644
+--- a/kernel/bpf/trampoline.c
++++ b/kernel/bpf/trampoline.c
+@@ -372,7 +372,7 @@ static void bpf_tramp_image_put(struct bpf_tramp_image *im)
+ call_rcu_tasks_trace(&im->rcu, __bpf_tramp_image_put_rcu_tasks);
+ }
+
+-static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, u32 idx)
++static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key)
+ {
+ struct bpf_tramp_image *im;
+ struct bpf_ksym *ksym;
+@@ -399,7 +399,7 @@ static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, u32 idx)
+
+ ksym = &im->ksym;
+ INIT_LIST_HEAD_RCU(&ksym->lnode);
+- snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu_%u", key, idx);
++ snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu", key);
+ bpf_image_ksym_add(image, ksym);
+ return im;
+
+@@ -429,11 +429,10 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
+ err = unregister_fentry(tr, tr->cur_image->image);
+ bpf_tramp_image_put(tr->cur_image);
+ tr->cur_image = NULL;
+- tr->selector = 0;
+ goto out;
+ }
+
+- im = bpf_tramp_image_alloc(tr->key, tr->selector);
++ im = bpf_tramp_image_alloc(tr->key);
+ if (IS_ERR(im)) {
+ err = PTR_ERR(im);
+ goto out;
+@@ -471,8 +470,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
+ set_memory_ro((long)im->image, 1);
+ set_memory_x((long)im->image, 1);
+
+- WARN_ON(tr->cur_image && tr->selector == 0);
+- WARN_ON(!tr->cur_image && tr->selector);
++ WARN_ON(tr->cur_image && total == 0);
+ if (tr->cur_image)
+ /* progs already running at this address */
+ err = modify_fentry(tr, tr->cur_image->image, im->image, lock_direct_mutex);
+@@ -502,7 +500,6 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
+ if (tr->cur_image)
+ bpf_tramp_image_put(tr->cur_image);
+ tr->cur_image = im;
+- tr->selector++;
+ out:
+ /* If any error happens, restore previous flags */
+ if (err)
+--
+2.39.2
+
--- /dev/null
+From 80ffa4402b38a65829425f6c9974706df7559382 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 12:31:34 +0100
+Subject: bpftool: JIT limited misreported as negative value on aarch64
+
+From: Alan Maguire <alan.maguire@oracle.com>
+
+[ Upstream commit 04cb8453a91c7c22f60ddadb6cef0d19abb33bb5 ]
+
+On aarch64, "bpftool feature" reports an incorrect BPF JIT limit:
+
+$ sudo /sbin/bpftool feature
+Scanning system configuration...
+bpf() syscall restricted to privileged users
+JIT compiler is enabled
+JIT compiler hardening is disabled
+JIT compiler kallsyms exports are enabled for root
+skipping kernel config, can't open file: No such file or directory
+Global memory limit for JIT compiler for unprivileged users is -201326592 bytes
+
+This is because /proc/sys/net/core/bpf_jit_limit reports
+
+$ sudo cat /proc/sys/net/core/bpf_jit_limit
+68169519595520
+
+...and an int is assumed in read_procfs(). Change read_procfs()
+to return a long to avoid negative value reporting.
+
+Fixes: 7a4522bbef0c ("tools: bpftool: add probes for /proc/ eBPF parameters")
+Reported-by: Nicky Veitch <nicky.veitch@oracle.com>
+Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/20230512113134.58996-1-alan.maguire@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/feature.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/tools/bpf/bpftool/feature.c b/tools/bpf/bpftool/feature.c
+index 36cf0f1517c94..4460399bc8ed8 100644
+--- a/tools/bpf/bpftool/feature.c
++++ b/tools/bpf/bpftool/feature.c
+@@ -167,12 +167,12 @@ static int get_vendor_id(int ifindex)
+ return strtol(buf, NULL, 0);
+ }
+
+-static int read_procfs(const char *path)
++static long read_procfs(const char *path)
+ {
+ char *endptr, *line = NULL;
+ size_t len = 0;
+ FILE *fd;
+- int res;
++ long res;
+
+ fd = fopen(path, "r");
+ if (!fd)
+@@ -194,7 +194,7 @@ static int read_procfs(const char *path)
+
+ static void probe_unprivileged_disabled(void)
+ {
+- int res;
++ long res;
+
+ /* No support for C-style ouptut */
+
+@@ -216,14 +216,14 @@ static void probe_unprivileged_disabled(void)
+ printf("Unable to retrieve required privileges for bpf() syscall\n");
+ break;
+ default:
+- printf("bpf() syscall restriction has unknown value %d\n", res);
++ printf("bpf() syscall restriction has unknown value %ld\n", res);
+ }
+ }
+ }
+
+ static void probe_jit_enable(void)
+ {
+- int res;
++ long res;
+
+ /* No support for C-style ouptut */
+
+@@ -245,7 +245,7 @@ static void probe_jit_enable(void)
+ printf("Unable to retrieve JIT-compiler status\n");
+ break;
+ default:
+- printf("JIT-compiler status has unknown value %d\n",
++ printf("JIT-compiler status has unknown value %ld\n",
+ res);
+ }
+ }
+@@ -253,7 +253,7 @@ static void probe_jit_enable(void)
+
+ static void probe_jit_harden(void)
+ {
+- int res;
++ long res;
+
+ /* No support for C-style ouptut */
+
+@@ -275,7 +275,7 @@ static void probe_jit_harden(void)
+ printf("Unable to retrieve JIT hardening status\n");
+ break;
+ default:
+- printf("JIT hardening status has unknown value %d\n",
++ printf("JIT hardening status has unknown value %ld\n",
+ res);
+ }
+ }
+@@ -283,7 +283,7 @@ static void probe_jit_harden(void)
+
+ static void probe_jit_kallsyms(void)
+ {
+- int res;
++ long res;
+
+ /* No support for C-style ouptut */
+
+@@ -302,14 +302,14 @@ static void probe_jit_kallsyms(void)
+ printf("Unable to retrieve JIT kallsyms export status\n");
+ break;
+ default:
+- printf("JIT kallsyms exports status has unknown value %d\n", res);
++ printf("JIT kallsyms exports status has unknown value %ld\n", res);
+ }
+ }
+ }
+
+ static void probe_jit_limit(void)
+ {
+- int res;
++ long res;
+
+ /* No support for C-style ouptut */
+
+@@ -322,7 +322,7 @@ static void probe_jit_limit(void)
+ printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n");
+ break;
+ default:
+- printf("Global memory limit for JIT compiler for unprivileged users is %d bytes\n", res);
++ printf("Global memory limit for JIT compiler for unprivileged users is %ld bytes\n", res);
+ }
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 24b9dec1c394c3f5275418eeb67a1c4d758c1bea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 10:04:16 +0300
+Subject: bus: ti-sysc: Fix dispc quirk masking bool variables
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit f620596fa347170852da499e778a5736d79a4b79 ]
+
+Fix warning drivers/bus/ti-sysc.c:1806 sysc_quirk_dispc()
+warn: masking a bool.
+
+While at it let's add a comment for what were doing to make
+the code a bit easier to follow.
+
+Fixes: 7324a7a0d5e2 ("bus: ti-sysc: Implement display subsystem reset quirk")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/linux-omap/a8ec8a68-9c2c-4076-bf47-09fccce7659f@kili.mountain/
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 9a7d12332fadb..cae078bffc715 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -1808,7 +1808,7 @@ static u32 sysc_quirk_dispc(struct sysc *ddata, int dispc_offset,
+ if (!ddata->module_va)
+ return -EIO;
+
+- /* DISP_CONTROL */
++ /* DISP_CONTROL, shut down lcd and digit on disable if enabled */
+ val = sysc_read(ddata, dispc_offset + 0x40);
+ lcd_en = val & lcd_en_mask;
+ digit_en = val & digit_en_mask;
+@@ -1820,7 +1820,7 @@ static u32 sysc_quirk_dispc(struct sysc *ddata, int dispc_offset,
+ else
+ irq_mask |= BIT(2) | BIT(3); /* EVSYNC bits */
+ }
+- if (disable & (lcd_en | digit_en))
++ if (disable && (lcd_en || digit_en))
+ sysc_write(ddata, dispc_offset + 0x40,
+ val & ~(lcd_en_mask | digit_en_mask));
+
+--
+2.39.2
+
--- /dev/null
+From 9d16f23a341fc1062aa4c944d9128d934826ca69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 May 2023 15:42:37 +0200
+Subject: can: kvaser_pciefd: Add function to set skb hwtstamps
+
+From: Jimmy Assarsson <extja@kvaser.com>
+
+[ Upstream commit 2d55e9f9b4427e1ad59b974f2267767aac3788d3 ]
+
+Add new function, kvaser_pciefd_set_skb_timestamp(), to set skb hwtstamps.
+
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Link: https://lore.kernel.org/all/20230529134248.752036-4-extja@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Stable-dep-of: ec681b91befa ("can: kvaser_pciefd: Set hardware timestamp on transmitted packets")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/kvaser_pciefd.c | 27 ++++++++++-----------------
+ 1 file changed, 10 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c
+index 956a4a57396f9..0b537292c7b19 100644
+--- a/drivers/net/can/kvaser_pciefd.c
++++ b/drivers/net/can/kvaser_pciefd.c
+@@ -538,6 +538,13 @@ static int kvaser_pciefd_set_tx_irq(struct kvaser_pciefd_can *can)
+ return 0;
+ }
+
++static inline void kvaser_pciefd_set_skb_timestamp(const struct kvaser_pciefd *pcie,
++ struct sk_buff *skb, u64 timestamp)
++{
++ skb_hwtstamps(skb)->hwtstamp =
++ ns_to_ktime(div_u64(timestamp * 1000, pcie->freq_to_ticks_div));
++}
++
+ static void kvaser_pciefd_setup_controller(struct kvaser_pciefd_can *can)
+ {
+ u32 mode;
+@@ -1171,7 +1178,6 @@ static int kvaser_pciefd_handle_data_packet(struct kvaser_pciefd *pcie,
+ struct canfd_frame *cf;
+ struct can_priv *priv;
+ struct net_device_stats *stats;
+- struct skb_shared_hwtstamps *shhwtstamps;
+ u8 ch_id = (p->header[1] >> KVASER_PCIEFD_PACKET_CHID_SHIFT) & 0x7;
+
+ if (ch_id >= pcie->nr_channels)
+@@ -1214,12 +1220,7 @@ static int kvaser_pciefd_handle_data_packet(struct kvaser_pciefd *pcie,
+ stats->rx_bytes += cf->len;
+ }
+ stats->rx_packets++;
+-
+- shhwtstamps = skb_hwtstamps(skb);
+-
+- shhwtstamps->hwtstamp =
+- ns_to_ktime(div_u64(p->timestamp * 1000,
+- pcie->freq_to_ticks_div));
++ kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp);
+
+ return netif_rx(skb);
+ }
+@@ -1282,7 +1283,6 @@ static int kvaser_pciefd_rx_error_frame(struct kvaser_pciefd_can *can,
+ struct net_device *ndev = can->can.dev;
+ struct sk_buff *skb;
+ struct can_frame *cf = NULL;
+- struct skb_shared_hwtstamps *shhwtstamps;
+ struct net_device_stats *stats = &ndev->stats;
+
+ old_state = can->can.state;
+@@ -1323,10 +1323,7 @@ static int kvaser_pciefd_rx_error_frame(struct kvaser_pciefd_can *can,
+ return -ENOMEM;
+ }
+
+- shhwtstamps = skb_hwtstamps(skb);
+- shhwtstamps->hwtstamp =
+- ns_to_ktime(div_u64(p->timestamp * 1000,
+- can->kv_pcie->freq_to_ticks_div));
++ kvaser_pciefd_set_skb_timestamp(can->kv_pcie, skb, p->timestamp);
+ cf->can_id |= CAN_ERR_BUSERROR | CAN_ERR_CNT;
+
+ cf->data[6] = bec.txerr;
+@@ -1374,7 +1371,6 @@ static int kvaser_pciefd_handle_status_resp(struct kvaser_pciefd_can *can,
+ struct net_device *ndev = can->can.dev;
+ struct sk_buff *skb;
+ struct can_frame *cf;
+- struct skb_shared_hwtstamps *shhwtstamps;
+
+ skb = alloc_can_err_skb(ndev, &cf);
+ if (!skb) {
+@@ -1394,10 +1390,7 @@ static int kvaser_pciefd_handle_status_resp(struct kvaser_pciefd_can *can,
+ cf->can_id |= CAN_ERR_RESTARTED;
+ }
+
+- shhwtstamps = skb_hwtstamps(skb);
+- shhwtstamps->hwtstamp =
+- ns_to_ktime(div_u64(p->timestamp * 1000,
+- can->kv_pcie->freq_to_ticks_div));
++ kvaser_pciefd_set_skb_timestamp(can->kv_pcie, skb, p->timestamp);
+
+ cf->data[6] = bec.txerr;
+ cf->data[7] = bec.rxerr;
+--
+2.39.2
+
--- /dev/null
+From 48b362f72be6137a53729da39c5c454af555c446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 May 2023 15:42:38 +0200
+Subject: can: kvaser_pciefd: Set hardware timestamp on transmitted packets
+
+From: Jimmy Assarsson <extja@kvaser.com>
+
+[ Upstream commit ec681b91befa982477e24a150dd6452427fe6473 ]
+
+Set hardware timestamp on transmitted packets.
+
+Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Link: https://lore.kernel.org/all/20230529134248.752036-5-extja@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/kvaser_pciefd.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c
+index 0b537292c7b19..74a47244f1291 100644
+--- a/drivers/net/can/kvaser_pciefd.c
++++ b/drivers/net/can/kvaser_pciefd.c
+@@ -1519,6 +1519,7 @@ static void kvaser_pciefd_handle_nack_packet(struct kvaser_pciefd_can *can,
+
+ if (skb) {
+ cf->can_id |= CAN_ERR_BUSERROR;
++ kvaser_pciefd_set_skb_timestamp(can->kv_pcie, skb, p->timestamp);
+ netif_rx(skb);
+ } else {
+ stats->rx_dropped++;
+@@ -1550,8 +1551,15 @@ static int kvaser_pciefd_handle_ack_packet(struct kvaser_pciefd *pcie,
+ netdev_dbg(can->can.dev, "Packet was flushed\n");
+ } else {
+ int echo_idx = p->header[0] & KVASER_PCIEFD_PACKET_SEQ_MSK;
+- int dlc = can_get_echo_skb(can->can.dev, echo_idx, NULL);
+- u8 count = ioread32(can->reg_base +
++ int dlc;
++ u8 count;
++ struct sk_buff *skb;
++
++ skb = can->can.echo_skb[echo_idx];
++ if (skb)
++ kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp);
++ dlc = can_get_echo_skb(can->can.dev, echo_idx, NULL);
++ count = ioread32(can->reg_base +
+ KVASER_PCIEFD_KCAN_TX_NPACKETS_REG) & 0xff;
+
+ if (count < KVASER_PCIEFD_CAN_TX_MAX_COUNT &&
+--
+2.39.2
+
--- /dev/null
+From 22049ca5e2d693e63bf9ecaa6c80f17521b024b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jun 2023 11:57:26 +0900
+Subject: can: length: fix bitstuffing count
+
+From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+
+[ Upstream commit 9fde4c557f78ee2f3626e92b4089ce9d54a2573a ]
+
+The Stuff Bit Count is always coded on 4 bits [1]. Update the Stuff
+Bit Count size accordingly.
+
+In addition, the CRC fields of CAN FD Frames contain stuff bits at
+fixed positions called fixed stuff bits [2]. The CRC field starts with
+a fixed stuff bit and then has another fixed stuff bit after each
+fourth bit [2], which allows us to derive this formula:
+
+ FSB count = 1 + round_down(len(CRC field)/4)
+
+The length of the CRC field is [1]:
+
+ len(CRC field) = len(Stuff Bit Count) + len(CRC)
+ = 4 + len(CRC)
+
+with len(CRC) either 17 or 21 bits depending of the payload length.
+
+In conclusion, for CRC17:
+
+ FSB count = 1 + round_down((4 + 17)/4)
+ = 6
+
+and for CRC 21:
+
+ FSB count = 1 + round_down((4 + 21)/4)
+ = 7
+
+Add a Fixed Stuff bits (FSB) field with above values and update
+CANFD_FRAME_OVERHEAD_SFF and CANFD_FRAME_OVERHEAD_EFF accordingly.
+
+[1] ISO 11898-1:2015 section 10.4.2.6 "CRC field":
+
+ The CRC field shall contain the CRC sequence followed by a recessive
+ CRC delimiter. For FD Frames, the CRC field shall also contain the
+ stuff count.
+
+ Stuff count
+
+ If FD Frames, the stuff count shall be at the beginning of the CRC
+ field. It shall consist of the stuff bit count modulo 8 in a 3-bit
+ gray code followed by a parity bit [...]
+
+[2] ISO 11898-1:2015 paragraph 10.5 "Frame coding":
+
+ In the CRC field of FD Frames, the stuff bits shall be inserted at
+ fixed positions; they are called fixed stuff bits. There shall be a
+ fixed stuff bit before the first bit of the stuff count, even if the
+ last bits of the preceding field are a sequence of five consecutive
+ bits of identical value, there shall be only the fixed stuff bit,
+ there shall not be two consecutive stuff bits. A further fixed stuff
+ bit shall be inserted after each fourth bit of the CRC field [...]
+
+Fixes: 85d99c3e2a13 ("can: length: can_skb_get_frame_len(): introduce function to get data length of frame in data link layer")
+Suggested-by: Thomas Kopp <Thomas.Kopp@microchip.com>
+Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Reviewed-by: Thomas Kopp <Thomas.Kopp@microchip.com>
+Link: https://lore.kernel.org/all/20230611025728.450837-2-mailhol.vincent@wanadoo.fr
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/can/length.h | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/can/length.h b/include/linux/can/length.h
+index 6995092b774ec..ef1fd32cef16b 100644
+--- a/include/linux/can/length.h
++++ b/include/linux/can/length.h
+@@ -69,17 +69,18 @@
+ * Error Status Indicator (ESI) 1
+ * Data length code (DLC) 4
+ * Data field 0...512
+- * Stuff Bit Count (SBC) 0...16: 4 20...64:5
++ * Stuff Bit Count (SBC) 4
+ * CRC 0...16: 17 20...64:21
+ * CRC delimiter (CD) 1
++ * Fixed Stuff bits (FSB) 0...16: 6 20...64:7
+ * ACK slot (AS) 1
+ * ACK delimiter (AD) 1
+ * End-of-frame (EOF) 7
+ * Inter frame spacing 3
+ *
+- * assuming CRC21, rounded up and ignoring bitstuffing
++ * assuming CRC21, rounded up and ignoring dynamic bitstuffing
+ */
+-#define CANFD_FRAME_OVERHEAD_SFF DIV_ROUND_UP(61, 8)
++#define CANFD_FRAME_OVERHEAD_SFF DIV_ROUND_UP(67, 8)
+
+ /*
+ * Size of a CAN-FD Extended Frame
+@@ -98,17 +99,18 @@
+ * Error Status Indicator (ESI) 1
+ * Data length code (DLC) 4
+ * Data field 0...512
+- * Stuff Bit Count (SBC) 0...16: 4 20...64:5
++ * Stuff Bit Count (SBC) 4
+ * CRC 0...16: 17 20...64:21
+ * CRC delimiter (CD) 1
++ * Fixed Stuff bits (FSB) 0...16: 6 20...64:7
+ * ACK slot (AS) 1
+ * ACK delimiter (AD) 1
+ * End-of-frame (EOF) 7
+ * Inter frame spacing 3
+ *
+- * assuming CRC21, rounded up and ignoring bitstuffing
++ * assuming CRC21, rounded up and ignoring dynamic bitstuffing
+ */
+-#define CANFD_FRAME_OVERHEAD_EFF DIV_ROUND_UP(80, 8)
++#define CANFD_FRAME_OVERHEAD_EFF DIV_ROUND_UP(86, 8)
+
+ /*
+ * Maximum size of a Classical CAN frame
+--
+2.39.2
+
--- /dev/null
+From 0baee28326c52356110f217b8da8a33ca891c6cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 18:16:04 +0000
+Subject: cifs: do all necessary checks for credits within or before locking
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+[ Upstream commit 326a8d04f147e2bf393f6f9cdb74126ee6900607 ]
+
+All the server credits and in-flight info is protected by req_lock.
+Once the req_lock is held, and we've determined that we have enough
+credits to continue, this lock cannot be dropped till we've made the
+changes to credits and in-flight count.
+
+However, we used to drop the lock in order to avoid deadlock with
+the recent srv_lock. This could cause the checks already made to be
+invalidated.
+
+Fixed it by moving the server status check to before locking req_lock.
+
+Fixes: d7d7a66aacd6 ("cifs: avoid use of global locks for high contention data")
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 19 ++++++++++---------
+ fs/smb/client/transport.c | 20 ++++++++++----------
+ 2 files changed, 20 insertions(+), 19 deletions(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index d512440d35b6f..e6a191a7499e8 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -208,6 +208,16 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
+
+ spin_lock(&server->req_lock);
+ while (1) {
++ spin_unlock(&server->req_lock);
++
++ spin_lock(&server->srv_lock);
++ if (server->tcpStatus == CifsExiting) {
++ spin_unlock(&server->srv_lock);
++ return -ENOENT;
++ }
++ spin_unlock(&server->srv_lock);
++
++ spin_lock(&server->req_lock);
+ if (server->credits <= 0) {
+ spin_unlock(&server->req_lock);
+ cifs_num_waiters_inc(server);
+@@ -218,15 +228,6 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
+ return rc;
+ spin_lock(&server->req_lock);
+ } else {
+- spin_unlock(&server->req_lock);
+- spin_lock(&server->srv_lock);
+- if (server->tcpStatus == CifsExiting) {
+- spin_unlock(&server->srv_lock);
+- return -ENOENT;
+- }
+- spin_unlock(&server->srv_lock);
+-
+- spin_lock(&server->req_lock);
+ scredits = server->credits;
+ /* can deadlock with reopen */
+ if (scredits <= 8) {
+diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c
+index c961b90f92b9f..e03ffcf7e201c 100644
+--- a/fs/smb/client/transport.c
++++ b/fs/smb/client/transport.c
+@@ -549,6 +549,16 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits,
+ }
+
+ while (1) {
++ spin_unlock(&server->req_lock);
++
++ spin_lock(&server->srv_lock);
++ if (server->tcpStatus == CifsExiting) {
++ spin_unlock(&server->srv_lock);
++ return -ENOENT;
++ }
++ spin_unlock(&server->srv_lock);
++
++ spin_lock(&server->req_lock);
+ if (*credits < num_credits) {
+ scredits = *credits;
+ spin_unlock(&server->req_lock);
+@@ -574,15 +584,6 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits,
+ return -ERESTARTSYS;
+ spin_lock(&server->req_lock);
+ } else {
+- spin_unlock(&server->req_lock);
+-
+- spin_lock(&server->srv_lock);
+- if (server->tcpStatus == CifsExiting) {
+- spin_unlock(&server->srv_lock);
+- return -ENOENT;
+- }
+- spin_unlock(&server->srv_lock);
+-
+ /*
+ * For normal commands, reserve the last MAX_COMPOUND
+ * credits to compound requests.
+@@ -596,7 +597,6 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits,
+ * for servers that are slow to hand out credits on
+ * new sessions.
+ */
+- spin_lock(&server->req_lock);
+ if (!optype && num_credits == 1 &&
+ server->in_flight > 2 * MAX_COMPOUND &&
+ *credits <= MAX_COMPOUND) {
+--
+2.39.2
+
--- /dev/null
+From 34ab99ef5cd99e7809c20e41c5a25bfb21723d03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 18:16:03 +0000
+Subject: cifs: prevent use-after-free by freeing the cfile later
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+[ Upstream commit 33f736187d08f6bc822117629f263b97d3df4165 ]
+
+In smb2_compound_op we have a possible use-after-free
+which can cause hard to debug problems later on.
+
+This was revealed during stress testing with KASAN enabled
+kernel. Fixing it by moving the cfile free call to
+a few lines below, after the usage.
+
+Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
+Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2inode.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
+index c97e049e29dd3..57526bdbab171 100644
+--- a/fs/smb/client/smb2inode.c
++++ b/fs/smb/client/smb2inode.c
+@@ -397,9 +397,6 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
+ rsp_iov);
+
+ finished:
+- if (cfile)
+- cifsFileInfo_put(cfile);
+-
+ SMB2_open_free(&rqst[0]);
+ if (rc == -EREMCHG) {
+ pr_warn_once("server share %s deleted\n", tcon->tree_name);
+@@ -513,6 +510,9 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
+ break;
+ }
+
++ if (cfile)
++ cifsFileInfo_put(cfile);
++
+ if (rc && err_iov && err_buftype) {
+ memcpy(err_iov, rsp_iov, 3 * sizeof(*err_iov));
+ memcpy(err_buftype, resp_buftype, 3 * sizeof(*err_buftype));
+--
+2.39.2
+
--- /dev/null
+From 47da85e18961fae51330844cc208dfa547b9b71e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 13:41:01 +0300
+Subject: clk: bcm: rpi: Fix off by one in raspberrypi_discover_clocks()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit da2edb3e3c09fd1451b7f400ccd1070ef086619a ]
+
+Smatch detected an off by one in this code:
+ drivers/clk/bcm/clk-raspberrypi.c:374 raspberrypi_discover_clocks()
+ error: buffer overflow 'data->hws' 16 <= 16
+
+The data->hws[] array has RPI_FIRMWARE_NUM_CLK_ID elements so the >
+comparison needs to changed to >=.
+
+Fixes: 12c90f3f27bb ("clk: bcm: rpi: Add variant structure")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/5a850b08-d2f5-4794-aceb-a6b468965139@kili.mountain
+Reviewed-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/bcm/clk-raspberrypi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/bcm/clk-raspberrypi.c b/drivers/clk/bcm/clk-raspberrypi.c
+index 679f4649a7efd..278f845572813 100644
+--- a/drivers/clk/bcm/clk-raspberrypi.c
++++ b/drivers/clk/bcm/clk-raspberrypi.c
+@@ -375,9 +375,9 @@ static int raspberrypi_discover_clocks(struct raspberrypi_clk *rpi,
+ while (clks->id) {
+ struct raspberrypi_clk_variant *variant;
+
+- if (clks->id > RPI_FIRMWARE_NUM_CLK_ID) {
++ if (clks->id >= RPI_FIRMWARE_NUM_CLK_ID) {
+ dev_err(rpi->dev, "Unknown clock id: %u (max: %u)\n",
+- clks->id, RPI_FIRMWARE_NUM_CLK_ID);
++ clks->id, RPI_FIRMWARE_NUM_CLK_ID - 1);
+ return -EINVAL;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 05269ac8be5fb66c44533214e805d73cd10d24b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 12:39:07 +0300
+Subject: clk: cdce925: check return value of kasprintf()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit bb7d09ddbf361d51eae46f38e7c8a2b85914ea2a ]
+
+kasprintf() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: 19fbbbbcd3a3 ("Add TI CDCE925 I2C controlled clock synthesizer driver")
+Depends-on: e665f029a283 ("clk: Convert to using %pOFn instead of device_node.name")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230530093913.1656095-3-claudiu.beznea@microchip.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-cdce925.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/clk/clk-cdce925.c b/drivers/clk/clk-cdce925.c
+index ef9a2d44e40c3..d88e1d681a2ce 100644
+--- a/drivers/clk/clk-cdce925.c
++++ b/drivers/clk/clk-cdce925.c
+@@ -714,6 +714,10 @@ static int cdce925_probe(struct i2c_client *client)
+ for (i = 0; i < data->chip_info->num_plls; ++i) {
+ pll_clk_name[i] = kasprintf(GFP_KERNEL, "%pOFn.pll%d",
+ client->dev.of_node, i);
++ if (!pll_clk_name[i]) {
++ err = -ENOMEM;
++ goto error;
++ }
+ init.name = pll_clk_name[i];
+ data->pll[i].chip = data;
+ data->pll[i].hw.init = &init;
+@@ -755,6 +759,10 @@ static int cdce925_probe(struct i2c_client *client)
+ init.num_parents = 1;
+ init.parent_names = &parent_name; /* Mux Y1 to input */
+ init.name = kasprintf(GFP_KERNEL, "%pOFn.Y1", client->dev.of_node);
++ if (!init.name) {
++ err = -ENOMEM;
++ goto error;
++ }
+ data->clk[0].chip = data;
+ data->clk[0].hw.init = &init;
+ data->clk[0].index = 0;
+@@ -773,6 +781,10 @@ static int cdce925_probe(struct i2c_client *client)
+ for (i = 1; i < data->chip_info->num_outputs; ++i) {
+ init.name = kasprintf(GFP_KERNEL, "%pOFn.Y%d",
+ client->dev.of_node, i+1);
++ if (!init.name) {
++ err = -ENOMEM;
++ goto error;
++ }
+ data->clk[i].chip = data;
+ data->clk[i].hw.init = &init;
+ data->clk[i].index = i;
+--
+2.39.2
+
--- /dev/null
+From 440417a3c14fc28382c09620dddee82df91b3835 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 12:39:13 +0300
+Subject: clk: clocking-wizard: check return value of devm_kasprintf()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit b1356ed1a4461de06dfdc02bf549c3e8750162e5 ]
+
+devm_kasprintf() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: 2046338dcbc6 ("ARM: mxs: Use soc bus infrastructure")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230530093913.1656095-9-claudiu.beznea@microchip.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+index 5c362c622a866..77532c12b140d 100644
+--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
++++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+@@ -648,6 +648,11 @@ static int clk_wzrd_probe(struct platform_device *pdev)
+ }
+
+ clkout_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_out0", dev_name(&pdev->dev));
++ if (!clkout_name) {
++ ret = -ENOMEM;
++ goto err_disable_clk;
++ }
++
+ if (nr_outputs == 1) {
+ clk_wzrd->clkout[0] = clk_wzrd_register_divider
+ (&pdev->dev, clkout_name,
+--
+2.39.2
+
--- /dev/null
+From 190fdd8b43119b940d2c7456498ef4649ff52437 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 May 2023 20:01:20 +0300
+Subject: clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 9c632a6396505a019ea6d12b5ab45e659a542a93 ]
+
+Smatch detected this potential error pointer dereference
+clk_wzrd_register_divider(). If devm_clk_hw_register() fails then
+it sets "hw" to an error pointer and then dereferences it on the
+next line. Return the error directly instead.
+
+Fixes: 5a853722eb32 ("staging: clocking-wizard: Add support for dynamic reconfiguration")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/f0e39b5c-4554-41e0-80d9-54ca3fabd060@kili.mountain
+Reviewed-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+index eb1dfe7ecc1b4..4a23583933bcc 100644
+--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
++++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+@@ -354,7 +354,7 @@ static struct clk *clk_wzrd_register_divider(struct device *dev,
+ hw = &div->hw;
+ ret = devm_clk_hw_register(dev, hw);
+ if (ret)
+- hw = ERR_PTR(ret);
++ return ERR_PTR(ret);
+
+ return hw->clk;
+ }
+--
+2.39.2
+
--- /dev/null
+From 4bca1e5f69b3f1b87dd6cc2f6b3685d757bb6203 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 13:25:03 +0200
+Subject: clk: Export clk_hw_forward_rate_request()
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit ed046ac74da0b5602566073023a1519b5ae657b7 ]
+
+Commit 262ca38f4b6e ("clk: Stop forwarding clk_rate_requests to the
+parent") introduced the public clk_hw_forward_rate_request() function,
+but didn't export the symbol. Make sure it's the case.
+
+Fixes: 262ca38f4b6e ("clk: Stop forwarding clk_rate_requests to the parent")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20221018-clk-range-checks-fixes-v4-1-971d5077e7d2@cerno.tech
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 57b83665e5c3a..d4a74759fe292 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -1525,6 +1525,7 @@ void clk_hw_forward_rate_request(const struct clk_hw *hw,
+ parent->core, req,
+ parent_rate);
+ }
++EXPORT_SYMBOL_GPL(clk_hw_forward_rate_request);
+
+ static bool clk_core_can_round(struct clk_core * const core)
+ {
+--
+2.39.2
+
--- /dev/null
+From 3aee52681fabbba2ec8e2ced48ea336ee26bb3e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jun 2023 11:22:53 +0800
+Subject: clk: Fix memory leak in devm_clk_notifier_register()
+
+From: Fei Shao <fshao@chromium.org>
+
+[ Upstream commit 7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff ]
+
+devm_clk_notifier_register() allocates a devres resource for clk
+notifier but didn't register that to the device, so the notifier didn't
+get unregistered on device detach and the allocated resource was leaked.
+
+Fix the issue by registering the resource through devres_add().
+
+This issue was found with kmemleak on a Chromebook.
+
+Fixes: 6d30d50d037d ("clk: add devm variant of clk_notifier_register")
+Signed-off-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20230619112253.v2.1.I13f060c10549ef181603e921291bdea95f83033c@changeid
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index d4a74759fe292..e0de6565800d2 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -4651,6 +4651,7 @@ int devm_clk_notifier_register(struct device *dev, struct clk *clk,
+ if (!ret) {
+ devres->clk = clk;
+ devres->nb = nb;
++ devres_add(dev, devres);
+ } else {
+ devres_free(devres);
+ }
+--
+2.39.2
+
--- /dev/null
+From 11a6dd6ae43d28b905b073c438d714b3c9964ee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 09:51:07 +0800
+Subject: clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe
+
+From: Hao Luo <m202171776@hust.edu.cn>
+
+[ Upstream commit 188d070de9132667956f5aadd98d2bd87d3eac89 ]
+
+Use devm_of_iomap() instead of of_iomap() to automatically handle
+the unused ioremap region.
+
+If any error occurs, regions allocated by kzalloc() will leak,
+but using devm_kzalloc() instead will automatically free the memory
+using devm_kfree().
+
+Fixes: daeb14545514 ("clk: imx: imx8mn: Switch to clk_hw based API")
+Fixes: 96d6392b54db ("clk: imx: Add support for i.MX8MN clock driver")
+Signed-off-by: Hao Luo <m202171776@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/20230411015107.2645-1-m202171776@hust.edu.cn
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8mn.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8mn.c b/drivers/clk/imx/clk-imx8mn.c
+index 2afea905f7f3c..b2b8b8b3f0ab8 100644
+--- a/drivers/clk/imx/clk-imx8mn.c
++++ b/drivers/clk/imx/clk-imx8mn.c
+@@ -323,7 +323,7 @@ static int imx8mn_clocks_probe(struct platform_device *pdev)
+ void __iomem *base;
+ int ret;
+
+- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
++ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws,
+ IMX8MN_CLK_END), GFP_KERNEL);
+ if (WARN_ON(!clk_hw_data))
+ return -ENOMEM;
+@@ -340,10 +340,10 @@ static int imx8mn_clocks_probe(struct platform_device *pdev)
+ hws[IMX8MN_CLK_EXT4] = imx_obtain_fixed_clk_hw(np, "clk_ext4");
+
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx8mn-anatop");
+- base = of_iomap(np, 0);
++ base = devm_of_iomap(dev, np, 0, NULL);
+ of_node_put(np);
+- if (WARN_ON(!base)) {
+- ret = -ENOMEM;
++ if (WARN_ON(IS_ERR(base))) {
++ ret = PTR_ERR(base);
+ goto unregister_hws;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 3dd94b1305bcb156ac187a998c3f03f563db1f47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 07:06:07 +0000
+Subject: clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()
+
+From: Yuxing Liu <lyx2022@hust.edu.cn>
+
+[ Upstream commit 878b02d5f3b56cb090dbe2c70c89273be144087f ]
+
+Replace of_iomap() and kzalloc() with devm_of_iomap() and devm_kzalloc()
+which can automatically release the related memory when the device
+or driver is removed or unloaded to avoid potential memory leak.
+
+In this case, iounmap(anatop_base) in line 427,433 are removed
+as manual release is not required.
+
+Besides, referring to clk-imx8mq.c, check the return code of
+of_clk_add_hw_provider, if it returns negtive, print error info
+and unregister hws, which makes the program more robust.
+
+Fixes: 9c140d992676 ("clk: imx: Add support for i.MX8MP clock driver")
+Signed-off-by: Yuxing Liu <lyx2022@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20230503070607.2462-1-lyx2022@hust.edu.cn
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8mp.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c
+index 5d68d975b4eb1..05c02f4e2a143 100644
+--- a/drivers/clk/imx/clk-imx8mp.c
++++ b/drivers/clk/imx/clk-imx8mp.c
+@@ -413,25 +413,22 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
+ struct device *dev = &pdev->dev;
+ struct device_node *np;
+ void __iomem *anatop_base, *ccm_base;
++ int err;
+
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx8mp-anatop");
+- anatop_base = of_iomap(np, 0);
++ anatop_base = devm_of_iomap(dev, np, 0, NULL);
+ of_node_put(np);
+- if (WARN_ON(!anatop_base))
+- return -ENOMEM;
++ if (WARN_ON(IS_ERR(anatop_base)))
++ return PTR_ERR(anatop_base);
+
+ np = dev->of_node;
+ ccm_base = devm_platform_ioremap_resource(pdev, 0);
+- if (WARN_ON(IS_ERR(ccm_base))) {
+- iounmap(anatop_base);
++ if (WARN_ON(IS_ERR(ccm_base)))
+ return PTR_ERR(ccm_base);
+- }
+
+- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, IMX8MP_CLK_END), GFP_KERNEL);
+- if (WARN_ON(!clk_hw_data)) {
+- iounmap(anatop_base);
++ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws, IMX8MP_CLK_END), GFP_KERNEL);
++ if (WARN_ON(!clk_hw_data))
+ return -ENOMEM;
+- }
+
+ clk_hw_data->num = IMX8MP_CLK_END;
+ hws = clk_hw_data->hws;
+@@ -711,7 +708,12 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
+
+ imx_check_clk_hws(hws, IMX8MP_CLK_END);
+
+- of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data);
++ err = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data);
++ if (err < 0) {
++ dev_err(dev, "failed to register hws for i.MX8MP\n");
++ imx_unregister_hw_clocks(hws, IMX8MP_CLK_END);
++ return err;
++ }
+
+ imx_register_uart_clocks(4);
+
+--
+2.39.2
+
--- /dev/null
+From 144b0c747d3c52def686128b18006ba7ff1ce933 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 11:34:51 +0000
+Subject: clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probe
+
+From: Kai Ma <kaima@hust.edu.cn>
+
+[ Upstream commit 1b280598ab3bd8a2dc8b96a12530d5b1ee7a8f4a ]
+
+Use devm_of_iomap() instead of of_iomap() to automatically
+handle the unused ioremap region. If any error occurs, regions allocated by
+kzalloc() will leak, but using devm_kzalloc() instead will automatically
+free the memory using devm_kfree().
+
+Also, fix error handling of hws by adding unregister_hws label, which
+unregisters remaining hws when iomap failed.
+
+Fixes: 7154b046d8f3 ("clk: imx: Add initial support for i.MXRT1050 clock driver")
+Signed-off-by: Kai Ma <kaima@hust.edu.cn>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Acked-by: Jesse Taube <Mr.Bossman075@gmail.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20230418113451.151312-1-kaima@hust.edu.cn
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imxrt1050.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imxrt1050.c b/drivers/clk/imx/clk-imxrt1050.c
+index 26108e9f7e67a..64d8b65a81040 100644
+--- a/drivers/clk/imx/clk-imxrt1050.c
++++ b/drivers/clk/imx/clk-imxrt1050.c
+@@ -42,7 +42,7 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev)
+ struct device_node *anp;
+ int ret;
+
+- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
++ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws,
+ IMXRT1050_CLK_END), GFP_KERNEL);
+ if (WARN_ON(!clk_hw_data))
+ return -ENOMEM;
+@@ -53,10 +53,12 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev)
+ hws[IMXRT1050_CLK_OSC] = imx_obtain_fixed_clk_hw(np, "osc");
+
+ anp = of_find_compatible_node(NULL, NULL, "fsl,imxrt-anatop");
+- pll_base = of_iomap(anp, 0);
++ pll_base = devm_of_iomap(dev, anp, 0, NULL);
+ of_node_put(anp);
+- if (WARN_ON(!pll_base))
+- return -ENOMEM;
++ if (WARN_ON(IS_ERR(pll_base))) {
++ ret = PTR_ERR(pll_base);
++ goto unregister_hws;
++ }
+
+ /* Anatop clocks */
+ hws[IMXRT1050_CLK_DUMMY] = imx_clk_hw_fixed("dummy", 0UL);
+@@ -104,8 +106,10 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev)
+
+ /* CCM clocks */
+ ccm_base = devm_platform_ioremap_resource(pdev, 0);
+- if (WARN_ON(IS_ERR(ccm_base)))
+- return PTR_ERR(ccm_base);
++ if (WARN_ON(IS_ERR(ccm_base))) {
++ ret = PTR_ERR(ccm_base);
++ goto unregister_hws;
++ }
+
+ hws[IMXRT1050_CLK_ARM_PODF] = imx_clk_hw_divider("arm_podf", "pll1_arm", ccm_base + 0x10, 0, 3);
+ hws[IMXRT1050_CLK_PRE_PERIPH_SEL] = imx_clk_hw_mux("pre_periph_sel", ccm_base + 0x18, 18, 2,
+@@ -148,8 +152,12 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev)
+ ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data);
+ if (ret < 0) {
+ dev_err(dev, "Failed to register clks for i.MXRT1050.\n");
+- imx_unregister_hw_clocks(hws, IMXRT1050_CLK_END);
++ goto unregister_hws;
+ }
++ return 0;
++
++unregister_hws:
++ imx_unregister_hw_clocks(hws, IMXRT1050_CLK_END);
+ return ret;
+ }
+ static const struct of_device_id imxrt1050_clk_of_match[] = {
+--
+2.39.2
+
--- /dev/null
+From 809fb96797d9bab0fc81304b7fb60d439e446118 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 17:23:01 +0300
+Subject: clk: imx: scu: use _safe list iterator to avoid a use after free
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 632c60ecd25dbacee54d5581fe3aeb834b57010a ]
+
+This loop is freeing "clk" so it needs to use list_for_each_entry_safe().
+Otherwise it dereferences a freed variable to get the next item on the
+loop.
+
+Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/0793fbd1-d2b5-4ec2-9403-3c39343a3e2d@kili.mountain
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-scu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c
+index 1e6870f3671f6..db307890e4c16 100644
+--- a/drivers/clk/imx/clk-scu.c
++++ b/drivers/clk/imx/clk-scu.c
+@@ -707,11 +707,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name,
+
+ void imx_clk_scu_unregister(void)
+ {
+- struct imx_scu_clk_node *clk;
++ struct imx_scu_clk_node *clk, *n;
+ int i;
+
+ for (i = 0; i < IMX_SC_R_LAST; i++) {
+- list_for_each_entry(clk, &imx_scu_clks[i], node) {
++ list_for_each_entry_safe(clk, n, &imx_scu_clks[i], node) {
+ clk_hw_unregister(clk->hw);
+ kfree(clk);
+ }
+--
+2.39.2
+
--- /dev/null
+From 6b2a85edefab9edbe2036b637a012ad8a2485ca9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 03:38:25 +0000
+Subject: clk: imx93: fix memory leak and missing unwind goto in
+ imx93_clocks_probe
+
+From: Zhanhao Hu <zero12113@hust.edu.cn>
+
+[ Upstream commit e02ba11b457647050cb16e7cad16cec3c252fade ]
+
+In function probe(), it returns directly without unregistered hws
+when error occurs.
+
+Fix this by adding 'goto unregister_hws;' on line 295 and
+line 310.
+
+Use devm_kzalloc() instead of kzalloc() to automatically
+free the memory using devm_kfree() when error occurs.
+
+Replace of_iomap() with devm_of_iomap() to automatically
+handle the unused ioremap region and delete 'iounmap(anatop_base);'
+in unregister_hws.
+
+Fixes: 24defbe194b6 ("clk: imx: add i.MX93 clk")
+Signed-off-by: Zhanhao Hu <zero12113@hust.edu.cn>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20230601033825.336558-1-zero12113@hust.edu.cn
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx93.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx93.c b/drivers/clk/imx/clk-imx93.c
+index 02d6a9894521d..5e3d299190c89 100644
+--- a/drivers/clk/imx/clk-imx93.c
++++ b/drivers/clk/imx/clk-imx93.c
+@@ -261,7 +261,7 @@ static int imx93_clocks_probe(struct platform_device *pdev)
+ void __iomem *base, *anatop_base;
+ int i, ret;
+
+- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
++ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws,
+ IMX93_CLK_END), GFP_KERNEL);
+ if (!clk_hw_data)
+ return -ENOMEM;
+@@ -285,10 +285,12 @@ static int imx93_clocks_probe(struct platform_device *pdev)
+ "sys_pll_pfd2", 1, 2);
+
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx93-anatop");
+- anatop_base = of_iomap(np, 0);
++ anatop_base = devm_of_iomap(dev, np, 0, NULL);
+ of_node_put(np);
+- if (WARN_ON(!anatop_base))
+- return -ENOMEM;
++ if (WARN_ON(IS_ERR(anatop_base))) {
++ ret = PTR_ERR(base);
++ goto unregister_hws;
++ }
+
+ clks[IMX93_CLK_AUDIO_PLL] = imx_clk_fracn_gppll("audio_pll", "osc_24m", anatop_base + 0x1200,
+ &imx_fracn_gppll);
+@@ -298,8 +300,8 @@ static int imx93_clocks_probe(struct platform_device *pdev)
+ np = dev->of_node;
+ base = devm_platform_ioremap_resource(pdev, 0);
+ if (WARN_ON(IS_ERR(base))) {
+- iounmap(anatop_base);
+- return PTR_ERR(base);
++ ret = PTR_ERR(base);
++ goto unregister_hws;
+ }
+
+ for (i = 0; i < ARRAY_SIZE(root_array); i++) {
+@@ -329,7 +331,6 @@ static int imx93_clocks_probe(struct platform_device *pdev)
+
+ unregister_hws:
+ imx_unregister_hw_clocks(clks, IMX93_CLK_END);
+- iounmap(anatop_base);
+
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From 74daa64c97e30934125aec61c305f31e42bae4f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 12:39:11 +0300
+Subject: clk: keystone: sci-clk: check return value of kasprintf()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit b73ed981da6d25c921aaefa7ca3df85bbd85b7fc ]
+
+kasprintf() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: b745c0794e2f ("clk: keystone: Add sci-clk driver support")
+Depends-on: 96488c09b0f4 ("clk: keystone: sci-clk: cut down the clock name length")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230530093913.1656095-7-claudiu.beznea@microchip.com
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/keystone/sci-clk.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/keystone/sci-clk.c b/drivers/clk/keystone/sci-clk.c
+index d4b4e74e22da6..254f2cf24be21 100644
+--- a/drivers/clk/keystone/sci-clk.c
++++ b/drivers/clk/keystone/sci-clk.c
+@@ -294,6 +294,8 @@ static int _sci_clk_build(struct sci_clk_provider *provider,
+
+ name = kasprintf(GFP_KERNEL, "clk:%d:%d", sci_clk->dev_id,
+ sci_clk->clk_id);
++ if (!name)
++ return -ENOMEM;
+
+ init.name = name;
+
+--
+2.39.2
+
--- /dev/null
+From 9be0cd0c896be81d1ec3af652ab5fcee9f87589e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 10:20:33 +0100
+Subject: clk: mediatek: clk-gate: Propagate struct device with
+ mtk_clk_register_gates()
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 20498d52c9c1a68b1d92c42bce1dc893d3e74f30 ]
+
+Commit e4c23e19aa2a ("clk: mediatek: Register clock gate with device")
+introduces a helper function for the sole purpose of propagating a
+struct device pointer to the clk API when registering the mtk-gate
+clocks to take advantage of Runtime PM when/where needed and where
+a power domain is defined in devicetree.
+
+Function mtk_clk_register_gates() then becomes a wrapper around the
+new mtk_clk_register_gates_with_dev() function that will simply pass
+NULL as struct device: this is essential when registering drivers
+with CLK_OF_DECLARE instead of as a platform device, as there will
+be no struct device to pass... but we can as well simply have only
+one function that always takes such pointer as a param and pass NULL
+when unavoidable.
+
+This commit removes the mtk_clk_register_gates() wrapper and renames
+mtk_clk_register_gates_with_dev() to the former and all of the calls
+to either of the two functions were fixed in all drivers in order to
+reflect this change; also, to improve consistency with other kernel
+functions, the pointer to struct device was moved as the first param.
+
+Since a lot of MediaTek clock drivers are actually registering as a
+platform device, but were still registering the mtk-gate clocks
+without passing any struct device to the clock framework, they've
+been changed to pass a valid one now, as to make all those platforms
+able to use runtime power management where available.
+
+While at it, some much needed indentation changes were also done.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Tested-by: Miles Chen <miles.chen@mediatek.com>
+Link: https://lore.kernel.org/r/20230120092053.182923-4-angelogioacchino.delregno@collabora.com
+Tested-by: Mingming Su <mingming.su@mediatek.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-gate.c | 23 ++++++-------------
+ drivers/clk/mediatek/clk-gate.h | 7 +-----
+ drivers/clk/mediatek/clk-mt2701-aud.c | 4 ++--
+ drivers/clk/mediatek/clk-mt2701-eth.c | 4 ++--
+ drivers/clk/mediatek/clk-mt2701-g3d.c | 2 +-
+ drivers/clk/mediatek/clk-mt2701-hif.c | 4 ++--
+ drivers/clk/mediatek/clk-mt2701-mm.c | 4 ++--
+ drivers/clk/mediatek/clk-mt2701.c | 12 +++++-----
+ drivers/clk/mediatek/clk-mt2712-mm.c | 4 ++--
+ drivers/clk/mediatek/clk-mt2712.c | 12 +++++-----
+ drivers/clk/mediatek/clk-mt6765.c | 10 ++++----
+ drivers/clk/mediatek/clk-mt6779-mm.c | 4 ++--
+ drivers/clk/mediatek/clk-mt6779.c | 6 ++---
+ drivers/clk/mediatek/clk-mt6795-infracfg.c | 3 ++-
+ drivers/clk/mediatek/clk-mt6795-mm.c | 3 ++-
+ drivers/clk/mediatek/clk-mt6795-pericfg.c | 3 ++-
+ drivers/clk/mediatek/clk-mt6797-mm.c | 4 ++--
+ drivers/clk/mediatek/clk-mt6797.c | 4 ++--
+ drivers/clk/mediatek/clk-mt7622-aud.c | 4 ++--
+ drivers/clk/mediatek/clk-mt7622-eth.c | 8 +++----
+ drivers/clk/mediatek/clk-mt7622-hif.c | 8 +++----
+ drivers/clk/mediatek/clk-mt7622.c | 14 ++++++------
+ drivers/clk/mediatek/clk-mt7629-eth.c | 7 +++---
+ drivers/clk/mediatek/clk-mt7629-hif.c | 8 +++----
+ drivers/clk/mediatek/clk-mt7629.c | 10 ++++----
+ drivers/clk/mediatek/clk-mt7986-eth.c | 10 ++++----
+ drivers/clk/mediatek/clk-mt7986-infracfg.c | 4 ++--
+ drivers/clk/mediatek/clk-mt8135.c | 8 +++----
+ drivers/clk/mediatek/clk-mt8167-aud.c | 2 +-
+ drivers/clk/mediatek/clk-mt8167-img.c | 2 +-
+ drivers/clk/mediatek/clk-mt8167-mfgcfg.c | 2 +-
+ drivers/clk/mediatek/clk-mt8167-mm.c | 4 ++--
+ drivers/clk/mediatek/clk-mt8167-vdec.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8167.c | 2 +-
+ drivers/clk/mediatek/clk-mt8173-mm.c | 4 ++--
+ drivers/clk/mediatek/clk-mt8173.c | 24 ++++++++++----------
+ drivers/clk/mediatek/clk-mt8183-audio.c | 4 ++--
+ drivers/clk/mediatek/clk-mt8183-mm.c | 4 ++--
+ drivers/clk/mediatek/clk-mt8183.c | 16 ++++++-------
+ drivers/clk/mediatek/clk-mt8186-mm.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8192-aud.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8192-mm.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8192.c | 17 +++++++-------
+ drivers/clk/mediatek/clk-mt8195-apmixedsys.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8195-topckgen.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8195-vdo0.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8195-vdo1.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8365-mm.c | 5 ++--
+ drivers/clk/mediatek/clk-mt8365.c | 4 ++--
+ drivers/clk/mediatek/clk-mt8516-aud.c | 2 +-
+ drivers/clk/mediatek/clk-mt8516.c | 2 +-
+ drivers/clk/mediatek/clk-mtk.c | 4 ++--
+ 52 files changed, 156 insertions(+), 160 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-gate.c b/drivers/clk/mediatek/clk-gate.c
+index 0c867136e49d7..67d9e741c5e73 100644
+--- a/drivers/clk/mediatek/clk-gate.c
++++ b/drivers/clk/mediatek/clk-gate.c
+@@ -152,12 +152,12 @@ const struct clk_ops mtk_clk_gate_ops_no_setclr_inv = {
+ };
+ EXPORT_SYMBOL_GPL(mtk_clk_gate_ops_no_setclr_inv);
+
+-static struct clk_hw *mtk_clk_register_gate(const char *name,
++static struct clk_hw *mtk_clk_register_gate(struct device *dev, const char *name,
+ const char *parent_name,
+ struct regmap *regmap, int set_ofs,
+ int clr_ofs, int sta_ofs, u8 bit,
+ const struct clk_ops *ops,
+- unsigned long flags, struct device *dev)
++ unsigned long flags)
+ {
+ struct mtk_clk_gate *cg;
+ int ret;
+@@ -202,10 +202,9 @@ static void mtk_clk_unregister_gate(struct clk_hw *hw)
+ kfree(cg);
+ }
+
+-int mtk_clk_register_gates_with_dev(struct device_node *node,
+- const struct mtk_gate *clks, int num,
+- struct clk_hw_onecell_data *clk_data,
+- struct device *dev)
++int mtk_clk_register_gates(struct device *dev, struct device_node *node,
++ const struct mtk_gate *clks, int num,
++ struct clk_hw_onecell_data *clk_data)
+ {
+ int i;
+ struct clk_hw *hw;
+@@ -229,13 +228,13 @@ int mtk_clk_register_gates_with_dev(struct device_node *node,
+ continue;
+ }
+
+- hw = mtk_clk_register_gate(gate->name, gate->parent_name,
++ hw = mtk_clk_register_gate(dev, gate->name, gate->parent_name,
+ regmap,
+ gate->regs->set_ofs,
+ gate->regs->clr_ofs,
+ gate->regs->sta_ofs,
+ gate->shift, gate->ops,
+- gate->flags, dev);
++ gate->flags);
+
+ if (IS_ERR(hw)) {
+ pr_err("Failed to register clk %s: %pe\n", gate->name,
+@@ -261,14 +260,6 @@ int mtk_clk_register_gates_with_dev(struct device_node *node,
+
+ return PTR_ERR(hw);
+ }
+-EXPORT_SYMBOL_GPL(mtk_clk_register_gates_with_dev);
+-
+-int mtk_clk_register_gates(struct device_node *node,
+- const struct mtk_gate *clks, int num,
+- struct clk_hw_onecell_data *clk_data)
+-{
+- return mtk_clk_register_gates_with_dev(node, clks, num, clk_data, NULL);
+-}
+ EXPORT_SYMBOL_GPL(mtk_clk_register_gates);
+
+ void mtk_clk_unregister_gates(const struct mtk_gate *clks, int num,
+diff --git a/drivers/clk/mediatek/clk-gate.h b/drivers/clk/mediatek/clk-gate.h
+index d9897ef535284..1a46b4c56fc5d 100644
+--- a/drivers/clk/mediatek/clk-gate.h
++++ b/drivers/clk/mediatek/clk-gate.h
+@@ -50,15 +50,10 @@ struct mtk_gate {
+ #define GATE_MTK(_id, _name, _parent, _regs, _shift, _ops) \
+ GATE_MTK_FLAGS(_id, _name, _parent, _regs, _shift, _ops, 0)
+
+-int mtk_clk_register_gates(struct device_node *node,
++int mtk_clk_register_gates(struct device *dev, struct device_node *node,
+ const struct mtk_gate *clks, int num,
+ struct clk_hw_onecell_data *clk_data);
+
+-int mtk_clk_register_gates_with_dev(struct device_node *node,
+- const struct mtk_gate *clks, int num,
+- struct clk_hw_onecell_data *clk_data,
+- struct device *dev);
+-
+ void mtk_clk_unregister_gates(const struct mtk_gate *clks, int num,
+ struct clk_hw_onecell_data *clk_data);
+
+diff --git a/drivers/clk/mediatek/clk-mt2701-aud.c b/drivers/clk/mediatek/clk-mt2701-aud.c
+index 4287bd3f545ee..03ab212aa7f4e 100644
+--- a/drivers/clk/mediatek/clk-mt2701-aud.c
++++ b/drivers/clk/mediatek/clk-mt2701-aud.c
+@@ -127,8 +127,8 @@ static int clk_mt2701_aud_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_AUD_NR);
+
+- mtk_clk_register_gates(node, audio_clks, ARRAY_SIZE(audio_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, audio_clks,
++ ARRAY_SIZE(audio_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r) {
+diff --git a/drivers/clk/mediatek/clk-mt2701-eth.c b/drivers/clk/mediatek/clk-mt2701-eth.c
+index 601358748750e..924725d67c13e 100644
+--- a/drivers/clk/mediatek/clk-mt2701-eth.c
++++ b/drivers/clk/mediatek/clk-mt2701-eth.c
+@@ -51,8 +51,8 @@ static int clk_mt2701_eth_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_ETHSYS_NR);
+
+- mtk_clk_register_gates(node, eth_clks, ARRAY_SIZE(eth_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, eth_clks,
++ ARRAY_SIZE(eth_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt2701-g3d.c b/drivers/clk/mediatek/clk-mt2701-g3d.c
+index 8d1fc8e3336eb..501fb99bb41a2 100644
+--- a/drivers/clk/mediatek/clk-mt2701-g3d.c
++++ b/drivers/clk/mediatek/clk-mt2701-g3d.c
+@@ -45,7 +45,7 @@ static int clk_mt2701_g3dsys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_G3DSYS_NR);
+
+- mtk_clk_register_gates(node, g3d_clks, ARRAY_SIZE(g3d_clks),
++ mtk_clk_register_gates(&pdev->dev, node, g3d_clks, ARRAY_SIZE(g3d_clks),
+ clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+diff --git a/drivers/clk/mediatek/clk-mt2701-hif.c b/drivers/clk/mediatek/clk-mt2701-hif.c
+index edeeb033a2350..1ddefc21d6a0d 100644
+--- a/drivers/clk/mediatek/clk-mt2701-hif.c
++++ b/drivers/clk/mediatek/clk-mt2701-hif.c
+@@ -48,8 +48,8 @@ static int clk_mt2701_hif_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_HIFSYS_NR);
+
+- mtk_clk_register_gates(node, hif_clks, ARRAY_SIZE(hif_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, hif_clks,
++ ARRAY_SIZE(hif_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r) {
+diff --git a/drivers/clk/mediatek/clk-mt2701-mm.c b/drivers/clk/mediatek/clk-mt2701-mm.c
+index eb069f3bc9a2b..f4885dffb324f 100644
+--- a/drivers/clk/mediatek/clk-mt2701-mm.c
++++ b/drivers/clk/mediatek/clk-mt2701-mm.c
+@@ -76,8 +76,8 @@ static int clk_mt2701_mm_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_MM_NR);
+
+- mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, mm_clks,
++ ARRAY_SIZE(mm_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt2701.c b/drivers/clk/mediatek/clk-mt2701.c
+index 1c3a93143dc5e..6c9350e1240fa 100644
+--- a/drivers/clk/mediatek/clk-mt2701.c
++++ b/drivers/clk/mediatek/clk-mt2701.c
+@@ -683,8 +683,8 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs),
+ base, &mt2701_clk_lock, clk_data);
+
+- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, top_clks,
++ ARRAY_SIZE(top_clks), clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ }
+@@ -783,8 +783,8 @@ static int mtk_infrasys_init(struct platform_device *pdev)
+ }
+ }
+
+- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+- infra_clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, infra_clks,
++ ARRAY_SIZE(infra_clks), infra_clk_data);
+ mtk_clk_register_factors(infra_fixed_divs, ARRAY_SIZE(infra_fixed_divs),
+ infra_clk_data);
+
+@@ -894,8 +894,8 @@ static int mtk_pericfg_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_PERI_NR);
+
+- mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, peri_clks,
++ ARRAY_SIZE(peri_clks), clk_data);
+
+ mtk_clk_register_composites(peri_muxs, ARRAY_SIZE(peri_muxs), base,
+ &mt2701_clk_lock, clk_data);
+diff --git a/drivers/clk/mediatek/clk-mt2712-mm.c b/drivers/clk/mediatek/clk-mt2712-mm.c
+index ad6daa8f28a83..e5264f1ce60d0 100644
+--- a/drivers/clk/mediatek/clk-mt2712-mm.c
++++ b/drivers/clk/mediatek/clk-mt2712-mm.c
+@@ -117,8 +117,8 @@ static int clk_mt2712_mm_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_MM_NR_CLK);
+
+- mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, mm_clks,
++ ARRAY_SIZE(mm_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+diff --git a/drivers/clk/mediatek/clk-mt2712.c b/drivers/clk/mediatek/clk-mt2712.c
+index d6c2cc183b1a1..78ebb4f2335c1 100644
+--- a/drivers/clk/mediatek/clk-mt2712.c
++++ b/drivers/clk/mediatek/clk-mt2712.c
+@@ -1324,8 +1324,8 @@ static int clk_mt2712_top_probe(struct platform_device *pdev)
+ &mt2712_clk_lock, top_clk_data);
+ mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs), base,
+ &mt2712_clk_lock, top_clk_data);
+- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks),
+- top_clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, top_clks,
++ ARRAY_SIZE(top_clks), top_clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, top_clk_data);
+
+@@ -1344,8 +1344,8 @@ static int clk_mt2712_infra_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK);
+
+- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, infra_clks,
++ ARRAY_SIZE(infra_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+@@ -1366,8 +1366,8 @@ static int clk_mt2712_peri_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK);
+
+- mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, peri_clks,
++ ARRAY_SIZE(peri_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+diff --git a/drivers/clk/mediatek/clk-mt6765.c b/drivers/clk/mediatek/clk-mt6765.c
+index 665981fc411f5..a94851d11d774 100644
+--- a/drivers/clk/mediatek/clk-mt6765.c
++++ b/drivers/clk/mediatek/clk-mt6765.c
+@@ -741,7 +741,7 @@ static int clk_mt6765_apmixed_probe(struct platform_device *pdev)
+
+ mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
+
+- mtk_clk_register_gates(node, apmixed_clks,
++ mtk_clk_register_gates(&pdev->dev, node, apmixed_clks,
+ ARRAY_SIZE(apmixed_clks), clk_data);
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+@@ -780,8 +780,8 @@ static int clk_mt6765_top_probe(struct platform_device *pdev)
+ clk_data);
+ mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node,
+ &mt6765_clk_lock, clk_data);
+- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, top_clks,
++ ARRAY_SIZE(top_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+@@ -814,8 +814,8 @@ static int clk_mt6765_ifr_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_IFR_NR_CLK);
+
+- mtk_clk_register_gates(node, ifr_clks, ARRAY_SIZE(ifr_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, ifr_clks,
++ ARRAY_SIZE(ifr_clks), clk_data);
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt6779-mm.c b/drivers/clk/mediatek/clk-mt6779-mm.c
+index eda8cbee3d234..2cccf62d3b36f 100644
+--- a/drivers/clk/mediatek/clk-mt6779-mm.c
++++ b/drivers/clk/mediatek/clk-mt6779-mm.c
+@@ -93,8 +93,8 @@ static int clk_mt6779_mm_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_MM_NR_CLK);
+
+- mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, mm_clks,
++ ARRAY_SIZE(mm_clks), clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ }
+diff --git a/drivers/clk/mediatek/clk-mt6779.c b/drivers/clk/mediatek/clk-mt6779.c
+index 0d0a90ee5eb2c..559d4d596e0c3 100644
+--- a/drivers/clk/mediatek/clk-mt6779.c
++++ b/drivers/clk/mediatek/clk-mt6779.c
+@@ -1221,7 +1221,7 @@ static int clk_mt6779_apmixed_probe(struct platform_device *pdev)
+
+ mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
+
+- mtk_clk_register_gates(node, apmixed_clks,
++ mtk_clk_register_gates(&pdev->dev, node, apmixed_clks,
+ ARRAY_SIZE(apmixed_clks), clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+@@ -1263,8 +1263,8 @@ static int clk_mt6779_infra_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK);
+
+- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, infra_clks,
++ ARRAY_SIZE(infra_clks), clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ }
+diff --git a/drivers/clk/mediatek/clk-mt6795-infracfg.c b/drivers/clk/mediatek/clk-mt6795-infracfg.c
+index df7eed6e071e3..8025d171d6923 100644
+--- a/drivers/clk/mediatek/clk-mt6795-infracfg.c
++++ b/drivers/clk/mediatek/clk-mt6795-infracfg.c
+@@ -101,7 +101,8 @@ static int clk_mt6795_infracfg_probe(struct platform_device *pdev)
+ if (ret)
+ goto free_clk_data;
+
+- ret = mtk_clk_register_gates(node, infra_gates, ARRAY_SIZE(infra_gates), clk_data);
++ ret = mtk_clk_register_gates(&pdev->dev, node, infra_gates,
++ ARRAY_SIZE(infra_gates), clk_data);
+ if (ret)
+ goto free_clk_data;
+
+diff --git a/drivers/clk/mediatek/clk-mt6795-mm.c b/drivers/clk/mediatek/clk-mt6795-mm.c
+index fd73f202f2925..eebb6143ada22 100644
+--- a/drivers/clk/mediatek/clk-mt6795-mm.c
++++ b/drivers/clk/mediatek/clk-mt6795-mm.c
+@@ -87,7 +87,8 @@ static int clk_mt6795_mm_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- ret = mtk_clk_register_gates(node, mm_gates, ARRAY_SIZE(mm_gates), clk_data);
++ ret = mtk_clk_register_gates(&pdev->dev, node, mm_gates,
++ ARRAY_SIZE(mm_gates), clk_data);
+ if (ret)
+ goto free_clk_data;
+
+diff --git a/drivers/clk/mediatek/clk-mt6795-pericfg.c b/drivers/clk/mediatek/clk-mt6795-pericfg.c
+index cb28d35dad59b..f69e715e0c1f3 100644
+--- a/drivers/clk/mediatek/clk-mt6795-pericfg.c
++++ b/drivers/clk/mediatek/clk-mt6795-pericfg.c
+@@ -109,7 +109,8 @@ static int clk_mt6795_pericfg_probe(struct platform_device *pdev)
+ if (ret)
+ goto free_clk_data;
+
+- ret = mtk_clk_register_gates(node, peri_gates, ARRAY_SIZE(peri_gates), clk_data);
++ ret = mtk_clk_register_gates(&pdev->dev, node, peri_gates,
++ ARRAY_SIZE(peri_gates), clk_data);
+ if (ret)
+ goto free_clk_data;
+
+diff --git a/drivers/clk/mediatek/clk-mt6797-mm.c b/drivers/clk/mediatek/clk-mt6797-mm.c
+index 99a63f46642fa..d5e9fe445e308 100644
+--- a/drivers/clk/mediatek/clk-mt6797-mm.c
++++ b/drivers/clk/mediatek/clk-mt6797-mm.c
+@@ -89,8 +89,8 @@ static int clk_mt6797_mm_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_MM_NR);
+
+- mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, mm_clks,
++ ARRAY_SIZE(mm_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt6797.c b/drivers/clk/mediatek/clk-mt6797.c
+index 78339cb35beb0..9cb7d4eb4918d 100644
+--- a/drivers/clk/mediatek/clk-mt6797.c
++++ b/drivers/clk/mediatek/clk-mt6797.c
+@@ -578,8 +578,8 @@ static int mtk_infrasys_init(struct platform_device *pdev)
+ }
+ }
+
+- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+- infra_clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, infra_clks,
++ ARRAY_SIZE(infra_clks), infra_clk_data);
+ mtk_clk_register_factors(infra_fixed_divs, ARRAY_SIZE(infra_fixed_divs),
+ infra_clk_data);
+
+diff --git a/drivers/clk/mediatek/clk-mt7622-aud.c b/drivers/clk/mediatek/clk-mt7622-aud.c
+index b17731fa11445..e9070d0bea8d6 100644
+--- a/drivers/clk/mediatek/clk-mt7622-aud.c
++++ b/drivers/clk/mediatek/clk-mt7622-aud.c
+@@ -114,8 +114,8 @@ static int clk_mt7622_audiosys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_AUDIO_NR_CLK);
+
+- mtk_clk_register_gates(node, audio_clks, ARRAY_SIZE(audio_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, audio_clks,
++ ARRAY_SIZE(audio_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r) {
+diff --git a/drivers/clk/mediatek/clk-mt7622-eth.c b/drivers/clk/mediatek/clk-mt7622-eth.c
+index a60190e834186..ece0f7a7c5f62 100644
+--- a/drivers/clk/mediatek/clk-mt7622-eth.c
++++ b/drivers/clk/mediatek/clk-mt7622-eth.c
+@@ -69,8 +69,8 @@ static int clk_mt7622_ethsys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_ETH_NR_CLK);
+
+- mtk_clk_register_gates(node, eth_clks, ARRAY_SIZE(eth_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, eth_clks,
++ ARRAY_SIZE(eth_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+@@ -91,8 +91,8 @@ static int clk_mt7622_sgmiisys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_SGMII_NR_CLK);
+
+- mtk_clk_register_gates(node, sgmii_clks, ARRAY_SIZE(sgmii_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, sgmii_clks,
++ ARRAY_SIZE(sgmii_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt7622-hif.c b/drivers/clk/mediatek/clk-mt7622-hif.c
+index 55baa6d06a205..c57ac2273c4e2 100644
+--- a/drivers/clk/mediatek/clk-mt7622-hif.c
++++ b/drivers/clk/mediatek/clk-mt7622-hif.c
+@@ -80,8 +80,8 @@ static int clk_mt7622_ssusbsys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_SSUSB_NR_CLK);
+
+- mtk_clk_register_gates(node, ssusb_clks, ARRAY_SIZE(ssusb_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, ssusb_clks,
++ ARRAY_SIZE(ssusb_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+@@ -102,8 +102,8 @@ static int clk_mt7622_pciesys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_PCIE_NR_CLK);
+
+- mtk_clk_register_gates(node, pcie_clks, ARRAY_SIZE(pcie_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, pcie_clks,
++ ARRAY_SIZE(pcie_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt7622.c b/drivers/clk/mediatek/clk-mt7622.c
+index eebbb87906930..bba88018f056a 100644
+--- a/drivers/clk/mediatek/clk-mt7622.c
++++ b/drivers/clk/mediatek/clk-mt7622.c
+@@ -621,8 +621,8 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs),
+ base, &mt7622_clk_lock, clk_data);
+
+- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, top_clks,
++ ARRAY_SIZE(top_clks), clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ }
+@@ -635,8 +635,8 @@ static int mtk_infrasys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK);
+
+- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, infra_clks,
++ ARRAY_SIZE(infra_clks), clk_data);
+
+ mtk_clk_register_cpumuxes(node, infra_muxes, ARRAY_SIZE(infra_muxes),
+ clk_data);
+@@ -663,7 +663,7 @@ static int mtk_apmixedsys_init(struct platform_device *pdev)
+ mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls),
+ clk_data);
+
+- mtk_clk_register_gates(node, apmixed_clks,
++ mtk_clk_register_gates(&pdev->dev, node, apmixed_clks,
+ ARRAY_SIZE(apmixed_clks), clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+@@ -682,8 +682,8 @@ static int mtk_pericfg_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK);
+
+- mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, peri_clks,
++ ARRAY_SIZE(peri_clks), clk_data);
+
+ mtk_clk_register_composites(peri_muxes, ARRAY_SIZE(peri_muxes), base,
+ &mt7622_clk_lock, clk_data);
+diff --git a/drivers/clk/mediatek/clk-mt7629-eth.c b/drivers/clk/mediatek/clk-mt7629-eth.c
+index b0c8fa3b8bbec..719a47fef7980 100644
+--- a/drivers/clk/mediatek/clk-mt7629-eth.c
++++ b/drivers/clk/mediatek/clk-mt7629-eth.c
+@@ -80,7 +80,8 @@ static int clk_mt7629_ethsys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_ETH_NR_CLK);
+
+- mtk_clk_register_gates(node, eth_clks, CLK_ETH_NR_CLK, clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, eth_clks,
++ CLK_ETH_NR_CLK, clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+@@ -102,8 +103,8 @@ static int clk_mt7629_sgmiisys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_SGMII_NR_CLK);
+
+- mtk_clk_register_gates(node, sgmii_clks[id++], CLK_SGMII_NR_CLK,
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, sgmii_clks[id++],
++ CLK_SGMII_NR_CLK, clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt7629-hif.c b/drivers/clk/mediatek/clk-mt7629-hif.c
+index 3628811a2f57f..804900792e490 100644
+--- a/drivers/clk/mediatek/clk-mt7629-hif.c
++++ b/drivers/clk/mediatek/clk-mt7629-hif.c
+@@ -75,8 +75,8 @@ static int clk_mt7629_ssusbsys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_SSUSB_NR_CLK);
+
+- mtk_clk_register_gates(node, ssusb_clks, ARRAY_SIZE(ssusb_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, ssusb_clks,
++ ARRAY_SIZE(ssusb_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+@@ -97,8 +97,8 @@ static int clk_mt7629_pciesys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_PCIE_NR_CLK);
+
+- mtk_clk_register_gates(node, pcie_clks, ARRAY_SIZE(pcie_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, pcie_clks,
++ ARRAY_SIZE(pcie_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt7629.c b/drivers/clk/mediatek/clk-mt7629.c
+index 0bc88b7d171b5..6642e00cfc7a7 100644
+--- a/drivers/clk/mediatek/clk-mt7629.c
++++ b/drivers/clk/mediatek/clk-mt7629.c
+@@ -581,8 +581,8 @@ static int mtk_infrasys_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK);
+
+- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, infra_clks,
++ ARRAY_SIZE(infra_clks), clk_data);
+
+ mtk_clk_register_cpumuxes(node, infra_muxes, ARRAY_SIZE(infra_muxes),
+ clk_data);
+@@ -604,8 +604,8 @@ static int mtk_pericfg_init(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK);
+
+- mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, peri_clks,
++ ARRAY_SIZE(peri_clks), clk_data);
+
+ mtk_clk_register_composites(peri_muxes, ARRAY_SIZE(peri_muxes), base,
+ &mt7629_clk_lock, clk_data);
+@@ -631,7 +631,7 @@ static int mtk_apmixedsys_init(struct platform_device *pdev)
+ mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls),
+ clk_data);
+
+- mtk_clk_register_gates(node, apmixed_clks,
++ mtk_clk_register_gates(&pdev->dev, node, apmixed_clks,
+ ARRAY_SIZE(apmixed_clks), clk_data);
+
+ clk_prepare_enable(clk_data->hws[CLK_APMIXED_ARMPLL]->clk);
+diff --git a/drivers/clk/mediatek/clk-mt7986-eth.c b/drivers/clk/mediatek/clk-mt7986-eth.c
+index c21e1d672384a..e04bc6845ea6d 100644
+--- a/drivers/clk/mediatek/clk-mt7986-eth.c
++++ b/drivers/clk/mediatek/clk-mt7986-eth.c
+@@ -72,8 +72,8 @@ static void __init mtk_sgmiisys_0_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(ARRAY_SIZE(sgmii0_clks));
+
+- mtk_clk_register_gates(node, sgmii0_clks, ARRAY_SIZE(sgmii0_clks),
+- clk_data);
++ mtk_clk_register_gates(NULL, node, sgmii0_clks,
++ ARRAY_SIZE(sgmii0_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+@@ -90,8 +90,8 @@ static void __init mtk_sgmiisys_1_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(ARRAY_SIZE(sgmii1_clks));
+
+- mtk_clk_register_gates(node, sgmii1_clks, ARRAY_SIZE(sgmii1_clks),
+- clk_data);
++ mtk_clk_register_gates(NULL, node, sgmii1_clks,
++ ARRAY_SIZE(sgmii1_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+@@ -109,7 +109,7 @@ static void __init mtk_ethsys_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(ARRAY_SIZE(eth_clks));
+
+- mtk_clk_register_gates(node, eth_clks, ARRAY_SIZE(eth_clks), clk_data);
++ mtk_clk_register_gates(NULL, node, eth_clks, ARRAY_SIZE(eth_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+diff --git a/drivers/clk/mediatek/clk-mt7986-infracfg.c b/drivers/clk/mediatek/clk-mt7986-infracfg.c
+index 74e68a7197301..578f150e0ee52 100644
+--- a/drivers/clk/mediatek/clk-mt7986-infracfg.c
++++ b/drivers/clk/mediatek/clk-mt7986-infracfg.c
+@@ -180,8 +180,8 @@ static int clk_mt7986_infracfg_probe(struct platform_device *pdev)
+ mtk_clk_register_factors(infra_divs, ARRAY_SIZE(infra_divs), clk_data);
+ mtk_clk_register_muxes(infra_muxes, ARRAY_SIZE(infra_muxes), node,
+ &mt7986_clk_lock, clk_data);
+- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, infra_clks,
++ ARRAY_SIZE(infra_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r) {
+diff --git a/drivers/clk/mediatek/clk-mt8135.c b/drivers/clk/mediatek/clk-mt8135.c
+index 3ea06d2ec2f11..8137cf2252724 100644
+--- a/drivers/clk/mediatek/clk-mt8135.c
++++ b/drivers/clk/mediatek/clk-mt8135.c
+@@ -553,8 +553,8 @@ static void __init mtk_infrasys_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK);
+
+- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+- clk_data);
++ mtk_clk_register_gates(NULL, node, infra_clks,
++ ARRAY_SIZE(infra_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+@@ -579,8 +579,8 @@ static void __init mtk_pericfg_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK);
+
+- mtk_clk_register_gates(node, peri_gates, ARRAY_SIZE(peri_gates),
+- clk_data);
++ mtk_clk_register_gates(NULL, node, peri_gates,
++ ARRAY_SIZE(peri_gates), clk_data);
+ mtk_clk_register_composites(peri_clks, ARRAY_SIZE(peri_clks), base,
+ &mt8135_clk_lock, clk_data);
+
+diff --git a/drivers/clk/mediatek/clk-mt8167-aud.c b/drivers/clk/mediatek/clk-mt8167-aud.c
+index b5ac196cd9454..47a7d89d5777c 100644
+--- a/drivers/clk/mediatek/clk-mt8167-aud.c
++++ b/drivers/clk/mediatek/clk-mt8167-aud.c
+@@ -50,7 +50,7 @@ static void __init mtk_audsys_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_AUD_NR_CLK);
+
+- mtk_clk_register_gates(node, aud_clks, ARRAY_SIZE(aud_clks), clk_data);
++ mtk_clk_register_gates(NULL, node, aud_clks, ARRAY_SIZE(aud_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt8167-img.c b/drivers/clk/mediatek/clk-mt8167-img.c
+index 4e7c0772b4f99..e196b3b894a16 100644
+--- a/drivers/clk/mediatek/clk-mt8167-img.c
++++ b/drivers/clk/mediatek/clk-mt8167-img.c
+@@ -42,7 +42,7 @@ static void __init mtk_imgsys_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_IMG_NR_CLK);
+
+- mtk_clk_register_gates(node, img_clks, ARRAY_SIZE(img_clks), clk_data);
++ mtk_clk_register_gates(NULL, node, img_clks, ARRAY_SIZE(img_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+diff --git a/drivers/clk/mediatek/clk-mt8167-mfgcfg.c b/drivers/clk/mediatek/clk-mt8167-mfgcfg.c
+index 192714498b2ec..602d25f4cb2e2 100644
+--- a/drivers/clk/mediatek/clk-mt8167-mfgcfg.c
++++ b/drivers/clk/mediatek/clk-mt8167-mfgcfg.c
+@@ -40,7 +40,7 @@ static void __init mtk_mfgcfg_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_MFG_NR_CLK);
+
+- mtk_clk_register_gates(node, mfg_clks, ARRAY_SIZE(mfg_clks), clk_data);
++ mtk_clk_register_gates(NULL, node, mfg_clks, ARRAY_SIZE(mfg_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+diff --git a/drivers/clk/mediatek/clk-mt8167-mm.c b/drivers/clk/mediatek/clk-mt8167-mm.c
+index a94961b7b8cc6..abc70e1221bf9 100644
+--- a/drivers/clk/mediatek/clk-mt8167-mm.c
++++ b/drivers/clk/mediatek/clk-mt8167-mm.c
+@@ -98,8 +98,8 @@ static int clk_mt8167_mm_probe(struct platform_device *pdev)
+
+ data = &mt8167_mmsys_driver_data;
+
+- ret = mtk_clk_register_gates(node, data->gates_clk, data->gates_num,
+- clk_data);
++ ret = mtk_clk_register_gates(&pdev->dev, node, data->gates_clk,
++ data->gates_num, clk_data);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/clk/mediatek/clk-mt8167-vdec.c b/drivers/clk/mediatek/clk-mt8167-vdec.c
+index 38f0ba357d599..92bc05d997985 100644
+--- a/drivers/clk/mediatek/clk-mt8167-vdec.c
++++ b/drivers/clk/mediatek/clk-mt8167-vdec.c
+@@ -49,7 +49,8 @@ static void __init mtk_vdecsys_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_VDEC_NR_CLK);
+
+- mtk_clk_register_gates(node, vdec_clks, ARRAY_SIZE(vdec_clks), clk_data);
++ mtk_clk_register_gates(NULL, node, vdec_clks, ARRAY_SIZE(vdec_clks),
++ clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+diff --git a/drivers/clk/mediatek/clk-mt8167.c b/drivers/clk/mediatek/clk-mt8167.c
+index f900ac4bf7b8d..59fe82ba5c7a1 100644
+--- a/drivers/clk/mediatek/clk-mt8167.c
++++ b/drivers/clk/mediatek/clk-mt8167.c
+@@ -937,7 +937,7 @@ static void __init mtk_topckgen_init(struct device_node *node)
+
+ mtk_clk_register_fixed_clks(fixed_clks, ARRAY_SIZE(fixed_clks),
+ clk_data);
+- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), clk_data);
++ mtk_clk_register_gates(NULL, node, top_clks, ARRAY_SIZE(top_clks), clk_data);
+
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
+ mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
+diff --git a/drivers/clk/mediatek/clk-mt8173-mm.c b/drivers/clk/mediatek/clk-mt8173-mm.c
+index 5826eabdc9c77..444a3d58c8bf5 100644
+--- a/drivers/clk/mediatek/clk-mt8173-mm.c
++++ b/drivers/clk/mediatek/clk-mt8173-mm.c
+@@ -112,8 +112,8 @@ static int clk_mt8173_mm_probe(struct platform_device *pdev)
+
+ data = &mt8173_mmsys_driver_data;
+
+- ret = mtk_clk_register_gates(node, data->gates_clk, data->gates_num,
+- clk_data);
++ ret = mtk_clk_register_gates(&pdev->dev, node, data->gates_clk,
++ data->gates_num, clk_data);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/clk/mediatek/clk-mt8173.c b/drivers/clk/mediatek/clk-mt8173.c
+index b8529ee7199da..74ed7dd129f47 100644
+--- a/drivers/clk/mediatek/clk-mt8173.c
++++ b/drivers/clk/mediatek/clk-mt8173.c
+@@ -888,8 +888,8 @@ static void __init mtk_infrasys_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK);
+
+- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+- clk_data);
++ mtk_clk_register_gates(NULL, node, infra_clks,
++ ARRAY_SIZE(infra_clks), clk_data);
+ mtk_clk_register_factors(infra_divs, ARRAY_SIZE(infra_divs), clk_data);
+
+ mtk_clk_register_cpumuxes(node, cpu_muxes, ARRAY_SIZE(cpu_muxes),
+@@ -918,8 +918,8 @@ static void __init mtk_pericfg_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK);
+
+- mtk_clk_register_gates(node, peri_gates, ARRAY_SIZE(peri_gates),
+- clk_data);
++ mtk_clk_register_gates(NULL, node, peri_gates,
++ ARRAY_SIZE(peri_gates), clk_data);
+ mtk_clk_register_composites(peri_clks, ARRAY_SIZE(peri_clks), base,
+ &mt8173_clk_lock, clk_data);
+
+@@ -1062,8 +1062,8 @@ static void __init mtk_imgsys_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_IMG_NR_CLK);
+
+- mtk_clk_register_gates(node, img_clks, ARRAY_SIZE(img_clks),
+- clk_data);
++ mtk_clk_register_gates(NULL, node, img_clks,
++ ARRAY_SIZE(img_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+@@ -1080,8 +1080,8 @@ static void __init mtk_vdecsys_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_VDEC_NR_CLK);
+
+- mtk_clk_register_gates(node, vdec_clks, ARRAY_SIZE(vdec_clks),
+- clk_data);
++ mtk_clk_register_gates(NULL, node, vdec_clks,
++ ARRAY_SIZE(vdec_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+@@ -1097,8 +1097,8 @@ static void __init mtk_vencsys_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_VENC_NR_CLK);
+
+- mtk_clk_register_gates(node, venc_clks, ARRAY_SIZE(venc_clks),
+- clk_data);
++ mtk_clk_register_gates(NULL, node, venc_clks,
++ ARRAY_SIZE(venc_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+@@ -1114,8 +1114,8 @@ static void __init mtk_vencltsys_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_VENCLT_NR_CLK);
+
+- mtk_clk_register_gates(node, venclt_clks, ARRAY_SIZE(venclt_clks),
+- clk_data);
++ mtk_clk_register_gates(NULL, node, venclt_clks,
++ ARRAY_SIZE(venclt_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt8183-audio.c b/drivers/clk/mediatek/clk-mt8183-audio.c
+index b2d7746eddbed..f358a6e7a3408 100644
+--- a/drivers/clk/mediatek/clk-mt8183-audio.c
++++ b/drivers/clk/mediatek/clk-mt8183-audio.c
+@@ -75,8 +75,8 @@ static int clk_mt8183_audio_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_AUDIO_NR_CLK);
+
+- mtk_clk_register_gates(node, audio_clks, ARRAY_SIZE(audio_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, audio_clks,
++ ARRAY_SIZE(audio_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt8183-mm.c b/drivers/clk/mediatek/clk-mt8183-mm.c
+index 11ecc6fb0065b..3580315309132 100644
+--- a/drivers/clk/mediatek/clk-mt8183-mm.c
++++ b/drivers/clk/mediatek/clk-mt8183-mm.c
+@@ -90,8 +90,8 @@ static int clk_mt8183_mm_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_MM_NR_CLK);
+
+- mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, mm_clks,
++ ARRAY_SIZE(mm_clks), clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ }
+diff --git a/drivers/clk/mediatek/clk-mt8183.c b/drivers/clk/mediatek/clk-mt8183.c
+index 1860a35a723a5..ba0d6ba10b359 100644
+--- a/drivers/clk/mediatek/clk-mt8183.c
++++ b/drivers/clk/mediatek/clk-mt8183.c
+@@ -1172,8 +1172,8 @@ static int clk_mt8183_apmixed_probe(struct platform_device *pdev)
+
+ mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
+
+- mtk_clk_register_gates(node, apmixed_clks, ARRAY_SIZE(apmixed_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, apmixed_clks,
++ ARRAY_SIZE(apmixed_clks), clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ }
+@@ -1247,8 +1247,8 @@ static int clk_mt8183_top_probe(struct platform_device *pdev)
+ mtk_clk_register_composites(top_aud_divs, ARRAY_SIZE(top_aud_divs),
+ base, &mt8183_clk_lock, top_clk_data);
+
+- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks),
+- top_clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, top_clks,
++ ARRAY_SIZE(top_clks), top_clk_data);
+
+ ret = clk_mt8183_reg_mfg_mux_notifier(&pdev->dev,
+ top_clk_data->hws[CLK_TOP_MUX_MFG]->clk);
+@@ -1267,8 +1267,8 @@ static int clk_mt8183_infra_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK);
+
+- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, infra_clks,
++ ARRAY_SIZE(infra_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r) {
+@@ -1290,8 +1290,8 @@ static int clk_mt8183_peri_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK);
+
+- mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks),
+- clk_data);
++ mtk_clk_register_gates(&pdev->dev, node, peri_clks,
++ ARRAY_SIZE(peri_clks), clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ }
+diff --git a/drivers/clk/mediatek/clk-mt8186-mm.c b/drivers/clk/mediatek/clk-mt8186-mm.c
+index 1d33be4079470..0b72607777fa1 100644
+--- a/drivers/clk/mediatek/clk-mt8186-mm.c
++++ b/drivers/clk/mediatek/clk-mt8186-mm.c
+@@ -69,7 +69,8 @@ static int clk_mt8186_mm_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- r = mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks), clk_data);
++ r = mtk_clk_register_gates(&pdev->dev, node, mm_clks,
++ ARRAY_SIZE(mm_clks), clk_data);
+ if (r)
+ goto free_mm_data;
+
+diff --git a/drivers/clk/mediatek/clk-mt8192-aud.c b/drivers/clk/mediatek/clk-mt8192-aud.c
+index 8c989bffd8c72..f524188fe4c2d 100644
+--- a/drivers/clk/mediatek/clk-mt8192-aud.c
++++ b/drivers/clk/mediatek/clk-mt8192-aud.c
+@@ -87,7 +87,8 @@ static int clk_mt8192_aud_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- r = mtk_clk_register_gates(node, aud_clks, ARRAY_SIZE(aud_clks), clk_data);
++ r = mtk_clk_register_gates(&pdev->dev, node, aud_clks,
++ ARRAY_SIZE(aud_clks), clk_data);
+ if (r)
+ return r;
+
+diff --git a/drivers/clk/mediatek/clk-mt8192-mm.c b/drivers/clk/mediatek/clk-mt8192-mm.c
+index 1be3ff4d407db..e9eb4cf8349ac 100644
+--- a/drivers/clk/mediatek/clk-mt8192-mm.c
++++ b/drivers/clk/mediatek/clk-mt8192-mm.c
+@@ -91,7 +91,8 @@ static int clk_mt8192_mm_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- r = mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks), clk_data);
++ r = mtk_clk_register_gates(&pdev->dev, node, mm_clks,
++ ARRAY_SIZE(mm_clks), clk_data);
+ if (r)
+ return r;
+
+diff --git a/drivers/clk/mediatek/clk-mt8192.c b/drivers/clk/mediatek/clk-mt8192.c
+index 508af9bbcc46c..ac1eee513649b 100644
+--- a/drivers/clk/mediatek/clk-mt8192.c
++++ b/drivers/clk/mediatek/clk-mt8192.c
+@@ -1127,8 +1127,8 @@ static int clk_mt8192_top_probe(struct platform_device *pdev)
+ if (r)
+ goto unregister_top_composites;
+
+- r = mtk_clk_register_gates_with_dev(node, top_clks, ARRAY_SIZE(top_clks),
+- top_clk_data, &pdev->dev);
++ r = mtk_clk_register_gates(&pdev->dev, node, top_clks,
++ ARRAY_SIZE(top_clks), top_clk_data);
+ if (r)
+ goto unregister_adj_divs_composites;
+
+@@ -1171,8 +1171,8 @@ static int clk_mt8192_infra_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- r = mtk_clk_register_gates_with_dev(node, infra_clks, ARRAY_SIZE(infra_clks),
+- clk_data, &pdev->dev);
++ r = mtk_clk_register_gates(&pdev->dev, node, infra_clks,
++ ARRAY_SIZE(infra_clks), clk_data);
+ if (r)
+ goto free_clk_data;
+
+@@ -1203,8 +1203,8 @@ static int clk_mt8192_peri_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- r = mtk_clk_register_gates_with_dev(node, peri_clks, ARRAY_SIZE(peri_clks),
+- clk_data, &pdev->dev);
++ r = mtk_clk_register_gates(&pdev->dev, node, peri_clks,
++ ARRAY_SIZE(peri_clks), clk_data);
+ if (r)
+ goto free_clk_data;
+
+@@ -1232,9 +1232,8 @@ static int clk_mt8192_apmixed_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
+- r = mtk_clk_register_gates_with_dev(node, apmixed_clks,
+- ARRAY_SIZE(apmixed_clks), clk_data,
+- &pdev->dev);
++ r = mtk_clk_register_gates(&pdev->dev, node, apmixed_clks,
++ ARRAY_SIZE(apmixed_clks), clk_data);
+ if (r)
+ goto free_clk_data;
+
+diff --git a/drivers/clk/mediatek/clk-mt8195-apmixedsys.c b/drivers/clk/mediatek/clk-mt8195-apmixedsys.c
+index 0dfed6ec4d155..1bc917f2667e4 100644
+--- a/drivers/clk/mediatek/clk-mt8195-apmixedsys.c
++++ b/drivers/clk/mediatek/clk-mt8195-apmixedsys.c
+@@ -124,7 +124,8 @@ static int clk_mt8195_apmixed_probe(struct platform_device *pdev)
+ if (r)
+ goto free_apmixed_data;
+
+- r = mtk_clk_register_gates(node, apmixed_clks, ARRAY_SIZE(apmixed_clks), clk_data);
++ r = mtk_clk_register_gates(&pdev->dev, node, apmixed_clks,
++ ARRAY_SIZE(apmixed_clks), clk_data);
+ if (r)
+ goto unregister_plls;
+
+diff --git a/drivers/clk/mediatek/clk-mt8195-topckgen.c b/drivers/clk/mediatek/clk-mt8195-topckgen.c
+index 1e016329c1d23..e6e0298d64494 100644
+--- a/drivers/clk/mediatek/clk-mt8195-topckgen.c
++++ b/drivers/clk/mediatek/clk-mt8195-topckgen.c
+@@ -1286,7 +1286,8 @@ static int clk_mt8195_topck_probe(struct platform_device *pdev)
+ if (r)
+ goto unregister_muxes;
+
+- r = mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), top_clk_data);
++ r = mtk_clk_register_gates(&pdev->dev, node, top_clks,
++ ARRAY_SIZE(top_clks), top_clk_data);
+ if (r)
+ goto unregister_composite_divs;
+
+diff --git a/drivers/clk/mediatek/clk-mt8195-vdo0.c b/drivers/clk/mediatek/clk-mt8195-vdo0.c
+index 07b46bfd50406..839b730688acb 100644
+--- a/drivers/clk/mediatek/clk-mt8195-vdo0.c
++++ b/drivers/clk/mediatek/clk-mt8195-vdo0.c
+@@ -104,7 +104,8 @@ static int clk_mt8195_vdo0_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- r = mtk_clk_register_gates(node, vdo0_clks, ARRAY_SIZE(vdo0_clks), clk_data);
++ r = mtk_clk_register_gates(&pdev->dev, node, vdo0_clks,
++ ARRAY_SIZE(vdo0_clks), clk_data);
+ if (r)
+ goto free_vdo0_data;
+
+diff --git a/drivers/clk/mediatek/clk-mt8195-vdo1.c b/drivers/clk/mediatek/clk-mt8195-vdo1.c
+index 835335b9d87bb..7df695b289258 100644
+--- a/drivers/clk/mediatek/clk-mt8195-vdo1.c
++++ b/drivers/clk/mediatek/clk-mt8195-vdo1.c
+@@ -131,7 +131,8 @@ static int clk_mt8195_vdo1_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- r = mtk_clk_register_gates(node, vdo1_clks, ARRAY_SIZE(vdo1_clks), clk_data);
++ r = mtk_clk_register_gates(&pdev->dev, node, vdo1_clks,
++ ARRAY_SIZE(vdo1_clks), clk_data);
+ if (r)
+ goto free_vdo1_data;
+
+diff --git a/drivers/clk/mediatek/clk-mt8365-mm.c b/drivers/clk/mediatek/clk-mt8365-mm.c
+index 5c8bf18ab1f1d..22c75a03a6452 100644
+--- a/drivers/clk/mediatek/clk-mt8365-mm.c
++++ b/drivers/clk/mediatek/clk-mt8365-mm.c
+@@ -81,9 +81,8 @@ static int clk_mt8365_mm_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_MM_NR_CLK);
+
+- ret = mtk_clk_register_gates_with_dev(node, mm_clks,
+- ARRAY_SIZE(mm_clks), clk_data,
+- dev);
++ ret = mtk_clk_register_gates(dev, node, mm_clks,
++ ARRAY_SIZE(mm_clks), clk_data);
+ if (ret)
+ goto err_free_clk_data;
+
+diff --git a/drivers/clk/mediatek/clk-mt8365.c b/drivers/clk/mediatek/clk-mt8365.c
+index adfecb618f102..b30cbeae1c3d3 100644
+--- a/drivers/clk/mediatek/clk-mt8365.c
++++ b/drivers/clk/mediatek/clk-mt8365.c
+@@ -1019,8 +1019,8 @@ static int clk_mt8365_infra_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- ret = mtk_clk_register_gates(node, ifr_clks, ARRAY_SIZE(ifr_clks),
+- clk_data);
++ ret = mtk_clk_register_gates(&pdev->dev, node, ifr_clks,
++ ARRAY_SIZE(ifr_clks), clk_data);
+ if (ret)
+ goto free_clk_data;
+
+diff --git a/drivers/clk/mediatek/clk-mt8516-aud.c b/drivers/clk/mediatek/clk-mt8516-aud.c
+index a3dafc719799c..a6ae8003b9ff6 100644
+--- a/drivers/clk/mediatek/clk-mt8516-aud.c
++++ b/drivers/clk/mediatek/clk-mt8516-aud.c
+@@ -48,7 +48,7 @@ static void __init mtk_audsys_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_AUD_NR_CLK);
+
+- mtk_clk_register_gates(node, aud_clks, ARRAY_SIZE(aud_clks), clk_data);
++ mtk_clk_register_gates(NULL, node, aud_clks, ARRAY_SIZE(aud_clks), clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt8516.c b/drivers/clk/mediatek/clk-mt8516.c
+index 056953d594c66..bde0b8c761d47 100644
+--- a/drivers/clk/mediatek/clk-mt8516.c
++++ b/drivers/clk/mediatek/clk-mt8516.c
+@@ -655,7 +655,7 @@ static void __init mtk_topckgen_init(struct device_node *node)
+
+ mtk_clk_register_fixed_clks(fixed_clks, ARRAY_SIZE(fixed_clks),
+ clk_data);
+- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), clk_data);
++ mtk_clk_register_gates(NULL, node, top_clks, ARRAY_SIZE(top_clks), clk_data);
+
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
+ mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
+diff --git a/drivers/clk/mediatek/clk-mtk.c b/drivers/clk/mediatek/clk-mtk.c
+index d31f01d0ba1c2..6123b234d3c3b 100644
+--- a/drivers/clk/mediatek/clk-mtk.c
++++ b/drivers/clk/mediatek/clk-mtk.c
+@@ -459,8 +459,8 @@ int mtk_clk_simple_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- r = mtk_clk_register_gates_with_dev(node, mcd->clks, mcd->num_clks,
+- clk_data, &pdev->dev);
++ r = mtk_clk_register_gates(&pdev->dev, node, mcd->clks, mcd->num_clks,
++ clk_data);
+ if (r)
+ goto free_data;
+
+--
+2.39.2
+
--- /dev/null
+From d737465cca1c48d0aad0e8faf2fbfd06d7df0b09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 10:20:42 +0100
+Subject: clk: mediatek: clk-mtk: Extend mtk_clk_simple_probe()
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 7b6183108c8ccf0dc295f39cdf78bd8078455636 ]
+
+As a preparation to increase probe functions commonization across
+various MediaTek SoC clock controller drivers, extend function
+mtk_clk_simple_probe() to be able to register not only gates, but
+also fixed clocks, factors, muxes and composites.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Miles Chen <miles.chen@mediatek.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Miles Chen <miles.chen@mediatek.com>
+Link: https://lore.kernel.org/r/20230120092053.182923-13-angelogioacchino.delregno@collabora.com
+Tested-by: Mingming Su <mingming.su@mediatek.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mtk.c | 101 ++++++++++++++++++++++++++++++---
+ drivers/clk/mediatek/clk-mtk.h | 10 ++++
+ 2 files changed, 103 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mtk.c b/drivers/clk/mediatek/clk-mtk.c
+index 152f3d906ef8a..bfabd94a474a5 100644
+--- a/drivers/clk/mediatek/clk-mtk.c
++++ b/drivers/clk/mediatek/clk-mtk.c
+@@ -11,12 +11,14 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
++#include <linux/of_address.h>
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+
+ #include "clk-mtk.h"
+ #include "clk-gate.h"
++#include "clk-mux.h"
+
+ static void mtk_init_clk_data(struct clk_hw_onecell_data *clk_data,
+ unsigned int clk_num)
+@@ -450,20 +452,71 @@ int mtk_clk_simple_probe(struct platform_device *pdev)
+ const struct mtk_clk_desc *mcd;
+ struct clk_hw_onecell_data *clk_data;
+ struct device_node *node = pdev->dev.of_node;
+- int r;
++ void __iomem *base;
++ int num_clks, r;
+
+ mcd = of_device_get_match_data(&pdev->dev);
+ if (!mcd)
+ return -EINVAL;
+
+- clk_data = mtk_alloc_clk_data(mcd->num_clks);
++ /* Composite clocks needs us to pass iomem pointer */
++ if (mcd->composite_clks) {
++ if (!mcd->shared_io)
++ base = devm_platform_ioremap_resource(pdev, 0);
++ else
++ base = of_iomap(node, 0);
++
++ if (IS_ERR_OR_NULL(base))
++ return IS_ERR(base) ? PTR_ERR(base) : -ENOMEM;
++ }
++
++ /* Calculate how many clk_hw_onecell_data entries to allocate */
++ num_clks = mcd->num_clks + mcd->num_composite_clks;
++ num_clks += mcd->num_fixed_clks + mcd->num_factor_clks;
++ num_clks += mcd->num_mux_clks;
++
++ clk_data = mtk_alloc_clk_data(num_clks);
+ if (!clk_data)
+ return -ENOMEM;
+
+- r = mtk_clk_register_gates(&pdev->dev, node, mcd->clks, mcd->num_clks,
+- clk_data);
+- if (r)
+- goto free_data;
++ if (mcd->fixed_clks) {
++ r = mtk_clk_register_fixed_clks(mcd->fixed_clks,
++ mcd->num_fixed_clks, clk_data);
++ if (r)
++ goto free_data;
++ }
++
++ if (mcd->factor_clks) {
++ r = mtk_clk_register_factors(mcd->factor_clks,
++ mcd->num_factor_clks, clk_data);
++ if (r)
++ goto unregister_fixed_clks;
++ }
++
++ if (mcd->mux_clks) {
++ r = mtk_clk_register_muxes(&pdev->dev, mcd->mux_clks,
++ mcd->num_mux_clks, node,
++ mcd->clk_lock, clk_data);
++ if (r)
++ goto unregister_factors;
++ };
++
++ if (mcd->composite_clks) {
++ /* We don't check composite_lock because it's optional */
++ r = mtk_clk_register_composites(&pdev->dev,
++ mcd->composite_clks,
++ mcd->num_composite_clks,
++ base, mcd->clk_lock, clk_data);
++ if (r)
++ goto unregister_muxes;
++ }
++
++ if (mcd->clks) {
++ r = mtk_clk_register_gates(&pdev->dev, node, mcd->clks,
++ mcd->num_clks, clk_data);
++ if (r)
++ goto unregister_composites;
++ }
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+@@ -481,9 +534,28 @@ int mtk_clk_simple_probe(struct platform_device *pdev)
+ return r;
+
+ unregister_clks:
+- mtk_clk_unregister_gates(mcd->clks, mcd->num_clks, clk_data);
++ if (mcd->clks)
++ mtk_clk_unregister_gates(mcd->clks, mcd->num_clks, clk_data);
++unregister_composites:
++ if (mcd->composite_clks)
++ mtk_clk_unregister_composites(mcd->composite_clks,
++ mcd->num_composite_clks, clk_data);
++unregister_muxes:
++ if (mcd->mux_clks)
++ mtk_clk_unregister_muxes(mcd->mux_clks,
++ mcd->num_mux_clks, clk_data);
++unregister_factors:
++ if (mcd->factor_clks)
++ mtk_clk_unregister_factors(mcd->factor_clks,
++ mcd->num_factor_clks, clk_data);
++unregister_fixed_clks:
++ if (mcd->fixed_clks)
++ mtk_clk_unregister_fixed_clks(mcd->fixed_clks,
++ mcd->num_fixed_clks, clk_data);
+ free_data:
+ mtk_free_clk_data(clk_data);
++ if (mcd->shared_io && base)
++ iounmap(base);
+ return r;
+ }
+ EXPORT_SYMBOL_GPL(mtk_clk_simple_probe);
+@@ -495,7 +567,20 @@ int mtk_clk_simple_remove(struct platform_device *pdev)
+ struct device_node *node = pdev->dev.of_node;
+
+ of_clk_del_provider(node);
+- mtk_clk_unregister_gates(mcd->clks, mcd->num_clks, clk_data);
++ if (mcd->clks)
++ mtk_clk_unregister_gates(mcd->clks, mcd->num_clks, clk_data);
++ if (mcd->composite_clks)
++ mtk_clk_unregister_composites(mcd->composite_clks,
++ mcd->num_composite_clks, clk_data);
++ if (mcd->mux_clks)
++ mtk_clk_unregister_muxes(mcd->mux_clks,
++ mcd->num_mux_clks, clk_data);
++ if (mcd->factor_clks)
++ mtk_clk_unregister_factors(mcd->factor_clks,
++ mcd->num_factor_clks, clk_data);
++ if (mcd->fixed_clks)
++ mtk_clk_unregister_fixed_clks(mcd->fixed_clks,
++ mcd->num_fixed_clks, clk_data);
+ mtk_free_clk_data(clk_data);
+
+ return 0;
+diff --git a/drivers/clk/mediatek/clk-mtk.h b/drivers/clk/mediatek/clk-mtk.h
+index 3993a60738c77..880b3d6d80119 100644
+--- a/drivers/clk/mediatek/clk-mtk.h
++++ b/drivers/clk/mediatek/clk-mtk.h
+@@ -196,7 +196,17 @@ void mtk_clk_unregister_ref2usb_tx(struct clk_hw *hw);
+ struct mtk_clk_desc {
+ const struct mtk_gate *clks;
+ size_t num_clks;
++ const struct mtk_composite *composite_clks;
++ size_t num_composite_clks;
++ const struct mtk_fixed_clk *fixed_clks;
++ size_t num_fixed_clks;
++ const struct mtk_fixed_factor *factor_clks;
++ size_t num_factor_clks;
++ const struct mtk_mux *mux_clks;
++ size_t num_mux_clks;
+ const struct mtk_clk_rst_desc *rst_desc;
++ spinlock_t *clk_lock;
++ bool shared_io;
+ };
+
+ int mtk_clk_simple_probe(struct platform_device *pdev);
+--
+2.39.2
+
--- /dev/null
+From da5fa141146026b6e8774f73ec8c7358fc0fe45d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 10:20:35 +0100
+Subject: clk: mediatek: clk-mtk: Propagate struct device for composites
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 01a6c1ab57c3a474c8d23c7d82c3fcce85f62612 ]
+
+Like done for cpumux clocks, propagate struct device for composite
+clocks registered through clk-mtk helpers to be able to get runtime
+pm support for MTK clocks.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Tested-by: Miles Chen <miles.chen@mediatek.com>
+Link: https://lore.kernel.org/r/20230120092053.182923-6-angelogioacchino.delregno@collabora.com
+Tested-by: Mingming Su <mingming.su@mediatek.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt2701.c | 10 ++++++----
+ drivers/clk/mediatek/clk-mt2712.c | 12 ++++++++----
+ drivers/clk/mediatek/clk-mt6779.c | 10 ++++++----
+ drivers/clk/mediatek/clk-mt6795-pericfg.c | 3 ++-
+ drivers/clk/mediatek/clk-mt6795-topckgen.c | 3 ++-
+ drivers/clk/mediatek/clk-mt6797.c | 3 ++-
+ drivers/clk/mediatek/clk-mt7622.c | 8 +++++---
+ drivers/clk/mediatek/clk-mt7629.c | 8 +++++---
+ drivers/clk/mediatek/clk-mt8135.c | 10 ++++++----
+ drivers/clk/mediatek/clk-mt8167.c | 10 ++++++----
+ drivers/clk/mediatek/clk-mt8173.c | 10 ++++++----
+ drivers/clk/mediatek/clk-mt8183.c | 15 +++++++++------
+ drivers/clk/mediatek/clk-mt8186-mcu.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8186-topckgen.c | 6 ++++--
+ drivers/clk/mediatek/clk-mt8192.c | 6 ++++--
+ drivers/clk/mediatek/clk-mt8195-topckgen.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8365.c | 7 ++++---
+ drivers/clk/mediatek/clk-mt8516.c | 10 ++++++----
+ drivers/clk/mediatek/clk-mtk.c | 11 ++++++-----
+ drivers/clk/mediatek/clk-mtk.h | 3 ++-
+ 20 files changed, 93 insertions(+), 58 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt2701.c b/drivers/clk/mediatek/clk-mt2701.c
+index 6c9350e1240fa..d63385d710f3f 100644
+--- a/drivers/clk/mediatek/clk-mt2701.c
++++ b/drivers/clk/mediatek/clk-mt2701.c
+@@ -677,8 +677,9 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ mtk_clk_register_factors(top_fixed_divs, ARRAY_SIZE(top_fixed_divs),
+ clk_data);
+
+- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes),
+- base, &mt2701_clk_lock, clk_data);
++ mtk_clk_register_composites(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), base,
++ &mt2701_clk_lock, clk_data);
+
+ mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs),
+ base, &mt2701_clk_lock, clk_data);
+@@ -897,8 +898,9 @@ static int mtk_pericfg_init(struct platform_device *pdev)
+ mtk_clk_register_gates(&pdev->dev, node, peri_clks,
+ ARRAY_SIZE(peri_clks), clk_data);
+
+- mtk_clk_register_composites(peri_muxs, ARRAY_SIZE(peri_muxs), base,
+- &mt2701_clk_lock, clk_data);
++ mtk_clk_register_composites(&pdev->dev, peri_muxs,
++ ARRAY_SIZE(peri_muxs), base,
++ &mt2701_clk_lock, clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt2712.c b/drivers/clk/mediatek/clk-mt2712.c
+index 78ebb4f2335c1..a0f0c9ed48d10 100644
+--- a/drivers/clk/mediatek/clk-mt2712.c
++++ b/drivers/clk/mediatek/clk-mt2712.c
+@@ -1320,8 +1320,9 @@ static int clk_mt2712_top_probe(struct platform_device *pdev)
+ mtk_clk_register_factors(top_early_divs, ARRAY_SIZE(top_early_divs),
+ top_clk_data);
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), top_clk_data);
+- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
+- &mt2712_clk_lock, top_clk_data);
++ mtk_clk_register_composites(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), base,
++ &mt2712_clk_lock, top_clk_data);
+ mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs), base,
+ &mt2712_clk_lock, top_clk_data);
+ mtk_clk_register_gates(&pdev->dev, node, top_clks,
+@@ -1395,8 +1396,11 @@ static int clk_mt2712_mcu_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_MCU_NR_CLK);
+
+- mtk_clk_register_composites(mcu_muxes, ARRAY_SIZE(mcu_muxes), base,
+- &mt2712_clk_lock, clk_data);
++ r = mtk_clk_register_composites(&pdev->dev, mcu_muxes,
++ ARRAY_SIZE(mcu_muxes), base,
++ &mt2712_clk_lock, clk_data);
++ if (r)
++ dev_err(&pdev->dev, "Could not register composites: %d\n", r);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+
+diff --git a/drivers/clk/mediatek/clk-mt6779.c b/drivers/clk/mediatek/clk-mt6779.c
+index 559d4d596e0c3..a1c387d9731a7 100644
+--- a/drivers/clk/mediatek/clk-mt6779.c
++++ b/drivers/clk/mediatek/clk-mt6779.c
+@@ -1247,11 +1247,13 @@ static int clk_mt6779_top_probe(struct platform_device *pdev)
+ mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes),
+ node, &mt6779_clk_lock, clk_data);
+
+- mtk_clk_register_composites(top_aud_muxes, ARRAY_SIZE(top_aud_muxes),
+- base, &mt6779_clk_lock, clk_data);
++ mtk_clk_register_composites(&pdev->dev, top_aud_muxes,
++ ARRAY_SIZE(top_aud_muxes), base,
++ &mt6779_clk_lock, clk_data);
+
+- mtk_clk_register_composites(top_aud_divs, ARRAY_SIZE(top_aud_divs),
+- base, &mt6779_clk_lock, clk_data);
++ mtk_clk_register_composites(&pdev->dev, top_aud_divs,
++ ARRAY_SIZE(top_aud_divs), base,
++ &mt6779_clk_lock, clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ }
+diff --git a/drivers/clk/mediatek/clk-mt6795-pericfg.c b/drivers/clk/mediatek/clk-mt6795-pericfg.c
+index f69e715e0c1f3..08aaa9b09c363 100644
+--- a/drivers/clk/mediatek/clk-mt6795-pericfg.c
++++ b/drivers/clk/mediatek/clk-mt6795-pericfg.c
+@@ -114,7 +114,8 @@ static int clk_mt6795_pericfg_probe(struct platform_device *pdev)
+ if (ret)
+ goto free_clk_data;
+
+- ret = mtk_clk_register_composites(peri_clks, ARRAY_SIZE(peri_clks), base,
++ ret = mtk_clk_register_composites(&pdev->dev, peri_clks,
++ ARRAY_SIZE(peri_clks), base,
+ &mt6795_peri_clk_lock, clk_data);
+ if (ret)
+ goto unregister_gates;
+diff --git a/drivers/clk/mediatek/clk-mt6795-topckgen.c b/drivers/clk/mediatek/clk-mt6795-topckgen.c
+index 2948dd1aee8fa..845cc87049303 100644
+--- a/drivers/clk/mediatek/clk-mt6795-topckgen.c
++++ b/drivers/clk/mediatek/clk-mt6795-topckgen.c
+@@ -557,7 +557,8 @@ static int clk_mt6795_topckgen_probe(struct platform_device *pdev)
+ if (ret)
+ goto unregister_factors;
+
+- ret = mtk_clk_register_composites(top_aud_divs, ARRAY_SIZE(top_aud_divs), base,
++ ret = mtk_clk_register_composites(&pdev->dev, top_aud_divs,
++ ARRAY_SIZE(top_aud_divs), base,
+ &mt6795_top_clk_lock, clk_data);
+ if (ret)
+ goto unregister_muxes;
+diff --git a/drivers/clk/mediatek/clk-mt6797.c b/drivers/clk/mediatek/clk-mt6797.c
+index 9cb7d4eb4918d..17b23ee4faee6 100644
+--- a/drivers/clk/mediatek/clk-mt6797.c
++++ b/drivers/clk/mediatek/clk-mt6797.c
+@@ -396,7 +396,8 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ mtk_clk_register_factors(top_fixed_divs, ARRAY_SIZE(top_fixed_divs),
+ clk_data);
+
+- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
++ mtk_clk_register_composites(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), base,
+ &mt6797_clk_lock, clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+diff --git a/drivers/clk/mediatek/clk-mt7622.c b/drivers/clk/mediatek/clk-mt7622.c
+index bba88018f056a..67a296646722f 100644
+--- a/drivers/clk/mediatek/clk-mt7622.c
++++ b/drivers/clk/mediatek/clk-mt7622.c
+@@ -615,8 +615,9 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs),
+ clk_data);
+
+- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes),
+- base, &mt7622_clk_lock, clk_data);
++ mtk_clk_register_composites(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), base,
++ &mt7622_clk_lock, clk_data);
+
+ mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs),
+ base, &mt7622_clk_lock, clk_data);
+@@ -685,7 +686,8 @@ static int mtk_pericfg_init(struct platform_device *pdev)
+ mtk_clk_register_gates(&pdev->dev, node, peri_clks,
+ ARRAY_SIZE(peri_clks), clk_data);
+
+- mtk_clk_register_composites(peri_muxes, ARRAY_SIZE(peri_muxes), base,
++ mtk_clk_register_composites(&pdev->dev, peri_muxes,
++ ARRAY_SIZE(peri_muxes), base,
+ &mt7622_clk_lock, clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+diff --git a/drivers/clk/mediatek/clk-mt7629.c b/drivers/clk/mediatek/clk-mt7629.c
+index 6642e00cfc7a7..ec4e506bdf459 100644
+--- a/drivers/clk/mediatek/clk-mt7629.c
++++ b/drivers/clk/mediatek/clk-mt7629.c
+@@ -564,8 +564,9 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs),
+ clk_data);
+
+- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes),
+- base, &mt7629_clk_lock, clk_data);
++ mtk_clk_register_composites(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), base,
++ &mt7629_clk_lock, clk_data);
+
+ clk_prepare_enable(clk_data->hws[CLK_TOP_AXI_SEL]->clk);
+ clk_prepare_enable(clk_data->hws[CLK_TOP_MEM_SEL]->clk);
+@@ -607,7 +608,8 @@ static int mtk_pericfg_init(struct platform_device *pdev)
+ mtk_clk_register_gates(&pdev->dev, node, peri_clks,
+ ARRAY_SIZE(peri_clks), clk_data);
+
+- mtk_clk_register_composites(peri_muxes, ARRAY_SIZE(peri_muxes), base,
++ mtk_clk_register_composites(&pdev->dev, peri_muxes,
++ ARRAY_SIZE(peri_muxes), base,
+ &mt7629_clk_lock, clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+diff --git a/drivers/clk/mediatek/clk-mt8135.c b/drivers/clk/mediatek/clk-mt8135.c
+index 8137cf2252724..a39ad58e27418 100644
+--- a/drivers/clk/mediatek/clk-mt8135.c
++++ b/drivers/clk/mediatek/clk-mt8135.c
+@@ -536,8 +536,9 @@ static void __init mtk_topckgen_init(struct device_node *node)
+
+ mtk_clk_register_factors(root_clk_alias, ARRAY_SIZE(root_clk_alias), clk_data);
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
+- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
+- &mt8135_clk_lock, clk_data);
++ mtk_clk_register_composites(NULL, top_muxes,
++ ARRAY_SIZE(top_muxes), base,
++ &mt8135_clk_lock, clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+@@ -581,8 +582,9 @@ static void __init mtk_pericfg_init(struct device_node *node)
+
+ mtk_clk_register_gates(NULL, node, peri_gates,
+ ARRAY_SIZE(peri_gates), clk_data);
+- mtk_clk_register_composites(peri_clks, ARRAY_SIZE(peri_clks), base,
+- &mt8135_clk_lock, clk_data);
++ mtk_clk_register_composites(NULL, peri_clks,
++ ARRAY_SIZE(peri_clks), base,
++ &mt8135_clk_lock, clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt8167.c b/drivers/clk/mediatek/clk-mt8167.c
+index 59fe82ba5c7a1..91669ebafaf9b 100644
+--- a/drivers/clk/mediatek/clk-mt8167.c
++++ b/drivers/clk/mediatek/clk-mt8167.c
+@@ -940,8 +940,9 @@ static void __init mtk_topckgen_init(struct device_node *node)
+ mtk_clk_register_gates(NULL, node, top_clks, ARRAY_SIZE(top_clks), clk_data);
+
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
+- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
+- &mt8167_clk_lock, clk_data);
++ mtk_clk_register_composites(NULL, top_muxes,
++ ARRAY_SIZE(top_muxes), base,
++ &mt8167_clk_lock, clk_data);
+ mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs),
+ base, &mt8167_clk_lock, clk_data);
+
+@@ -966,8 +967,9 @@ static void __init mtk_infracfg_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_IFR_NR_CLK);
+
+- mtk_clk_register_composites(ifr_muxes, ARRAY_SIZE(ifr_muxes), base,
+- &mt8167_clk_lock, clk_data);
++ mtk_clk_register_composites(NULL, ifr_muxes,
++ ARRAY_SIZE(ifr_muxes), base,
++ &mt8167_clk_lock, clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt8173.c b/drivers/clk/mediatek/clk-mt8173.c
+index 74ed7dd129f47..d05c1109b4f87 100644
+--- a/drivers/clk/mediatek/clk-mt8173.c
++++ b/drivers/clk/mediatek/clk-mt8173.c
+@@ -869,8 +869,9 @@ static void __init mtk_topckgen_init(struct device_node *node)
+
+ mtk_clk_register_fixed_clks(fixed_clks, ARRAY_SIZE(fixed_clks), clk_data);
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
+- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
+- &mt8173_clk_lock, clk_data);
++ mtk_clk_register_composites(NULL, top_muxes,
++ ARRAY_SIZE(top_muxes), base,
++ &mt8173_clk_lock, clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+@@ -920,8 +921,9 @@ static void __init mtk_pericfg_init(struct device_node *node)
+
+ mtk_clk_register_gates(NULL, node, peri_gates,
+ ARRAY_SIZE(peri_gates), clk_data);
+- mtk_clk_register_composites(peri_clks, ARRAY_SIZE(peri_clks), base,
+- &mt8173_clk_lock, clk_data);
++ mtk_clk_register_composites(NULL, peri_clks,
++ ARRAY_SIZE(peri_clks), base,
++ &mt8173_clk_lock, clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mt8183.c b/drivers/clk/mediatek/clk-mt8183.c
+index ba0d6ba10b359..bf7b342332536 100644
+--- a/drivers/clk/mediatek/clk-mt8183.c
++++ b/drivers/clk/mediatek/clk-mt8183.c
+@@ -1241,11 +1241,13 @@ static int clk_mt8183_top_probe(struct platform_device *pdev)
+ mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes),
+ node, &mt8183_clk_lock, top_clk_data);
+
+- mtk_clk_register_composites(top_aud_muxes, ARRAY_SIZE(top_aud_muxes),
+- base, &mt8183_clk_lock, top_clk_data);
++ mtk_clk_register_composites(&pdev->dev, top_aud_muxes,
++ ARRAY_SIZE(top_aud_muxes), base,
++ &mt8183_clk_lock, top_clk_data);
+
+- mtk_clk_register_composites(top_aud_divs, ARRAY_SIZE(top_aud_divs),
+- base, &mt8183_clk_lock, top_clk_data);
++ mtk_clk_register_composites(&pdev->dev, top_aud_divs,
++ ARRAY_SIZE(top_aud_divs), base,
++ &mt8183_clk_lock, top_clk_data);
+
+ mtk_clk_register_gates(&pdev->dev, node, top_clks,
+ ARRAY_SIZE(top_clks), top_clk_data);
+@@ -1308,8 +1310,9 @@ static int clk_mt8183_mcu_probe(struct platform_device *pdev)
+
+ clk_data = mtk_alloc_clk_data(CLK_MCU_NR_CLK);
+
+- mtk_clk_register_composites(mcu_muxes, ARRAY_SIZE(mcu_muxes), base,
+- &mt8183_clk_lock, clk_data);
++ mtk_clk_register_composites(&pdev->dev, mcu_muxes,
++ ARRAY_SIZE(mcu_muxes), base,
++ &mt8183_clk_lock, clk_data);
+
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ }
+diff --git a/drivers/clk/mediatek/clk-mt8186-mcu.c b/drivers/clk/mediatek/clk-mt8186-mcu.c
+index dfc305c1fc5d8..e52a2d986c99c 100644
+--- a/drivers/clk/mediatek/clk-mt8186-mcu.c
++++ b/drivers/clk/mediatek/clk-mt8186-mcu.c
+@@ -65,7 +65,8 @@ static int clk_mt8186_mcu_probe(struct platform_device *pdev)
+ goto free_mcu_data;
+ }
+
+- r = mtk_clk_register_composites(mcu_muxes, ARRAY_SIZE(mcu_muxes), base,
++ r = mtk_clk_register_composites(&pdev->dev, mcu_muxes,
++ ARRAY_SIZE(mcu_muxes), base,
+ NULL, clk_data);
+ if (r)
+ goto free_mcu_data;
+diff --git a/drivers/clk/mediatek/clk-mt8186-topckgen.c b/drivers/clk/mediatek/clk-mt8186-topckgen.c
+index d7f2c4663c853..4ac157320a6b9 100644
+--- a/drivers/clk/mediatek/clk-mt8186-topckgen.c
++++ b/drivers/clk/mediatek/clk-mt8186-topckgen.c
+@@ -720,12 +720,14 @@ static int clk_mt8186_topck_probe(struct platform_device *pdev)
+ if (r)
+ goto unregister_factors;
+
+- r = mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
++ r = mtk_clk_register_composites(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), base,
+ &mt8186_clk_lock, clk_data);
+ if (r)
+ goto unregister_muxes;
+
+- r = mtk_clk_register_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), base,
++ r = mtk_clk_register_composites(&pdev->dev, top_adj_divs,
++ ARRAY_SIZE(top_adj_divs), base,
+ &mt8186_clk_lock, clk_data);
+ if (r)
+ goto unregister_composite_muxes;
+diff --git a/drivers/clk/mediatek/clk-mt8192.c b/drivers/clk/mediatek/clk-mt8192.c
+index ac1eee513649b..ab856d0276184 100644
+--- a/drivers/clk/mediatek/clk-mt8192.c
++++ b/drivers/clk/mediatek/clk-mt8192.c
+@@ -1117,12 +1117,14 @@ static int clk_mt8192_top_probe(struct platform_device *pdev)
+ if (r)
+ goto unregister_factors;
+
+- r = mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
++ r = mtk_clk_register_composites(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), base,
+ &mt8192_clk_lock, top_clk_data);
+ if (r)
+ goto unregister_muxes;
+
+- r = mtk_clk_register_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), base,
++ r = mtk_clk_register_composites(&pdev->dev, top_adj_divs,
++ ARRAY_SIZE(top_adj_divs), base,
+ &mt8192_clk_lock, top_clk_data);
+ if (r)
+ goto unregister_top_composites;
+diff --git a/drivers/clk/mediatek/clk-mt8195-topckgen.c b/drivers/clk/mediatek/clk-mt8195-topckgen.c
+index e6e0298d64494..aae31ef3903de 100644
+--- a/drivers/clk/mediatek/clk-mt8195-topckgen.c
++++ b/drivers/clk/mediatek/clk-mt8195-topckgen.c
+@@ -1281,7 +1281,8 @@ static int clk_mt8195_topck_probe(struct platform_device *pdev)
+ if (r)
+ goto unregister_muxes;
+
+- r = mtk_clk_register_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), base,
++ r = mtk_clk_register_composites(&pdev->dev, top_adj_divs,
++ ARRAY_SIZE(top_adj_divs), base,
+ &mt8195_clk_lock, top_clk_data);
+ if (r)
+ goto unregister_muxes;
+diff --git a/drivers/clk/mediatek/clk-mt8365.c b/drivers/clk/mediatek/clk-mt8365.c
+index b30cbeae1c3d3..0482a8aa43cc9 100644
+--- a/drivers/clk/mediatek/clk-mt8365.c
++++ b/drivers/clk/mediatek/clk-mt8365.c
+@@ -952,7 +952,7 @@ static int clk_mt8365_top_probe(struct platform_device *pdev)
+ if (ret)
+ goto unregister_factors;
+
+- ret = mtk_clk_register_composites(top_misc_mux_gates,
++ ret = mtk_clk_register_composites(&pdev->dev, top_misc_mux_gates,
+ ARRAY_SIZE(top_misc_mux_gates), base,
+ &mt8365_clk_lock, clk_data);
+ if (ret)
+@@ -1080,8 +1080,9 @@ static int clk_mt8365_mcu_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- ret = mtk_clk_register_composites(mcu_muxes, ARRAY_SIZE(mcu_muxes),
+- base, &mt8365_clk_lock, clk_data);
++ ret = mtk_clk_register_composites(&pdev->dev, mcu_muxes,
++ ARRAY_SIZE(mcu_muxes), base,
++ &mt8365_clk_lock, clk_data);
+ if (ret)
+ goto free_clk_data;
+
+diff --git a/drivers/clk/mediatek/clk-mt8516.c b/drivers/clk/mediatek/clk-mt8516.c
+index bde0b8c761d47..6983d3a48dc9a 100644
+--- a/drivers/clk/mediatek/clk-mt8516.c
++++ b/drivers/clk/mediatek/clk-mt8516.c
+@@ -658,8 +658,9 @@ static void __init mtk_topckgen_init(struct device_node *node)
+ mtk_clk_register_gates(NULL, node, top_clks, ARRAY_SIZE(top_clks), clk_data);
+
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
+- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
+- &mt8516_clk_lock, clk_data);
++ mtk_clk_register_composites(NULL, top_muxes,
++ ARRAY_SIZE(top_muxes), base,
++ &mt8516_clk_lock, clk_data);
+ mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs),
+ base, &mt8516_clk_lock, clk_data);
+
+@@ -684,8 +685,9 @@ static void __init mtk_infracfg_init(struct device_node *node)
+
+ clk_data = mtk_alloc_clk_data(CLK_IFR_NR_CLK);
+
+- mtk_clk_register_composites(ifr_muxes, ARRAY_SIZE(ifr_muxes), base,
+- &mt8516_clk_lock, clk_data);
++ mtk_clk_register_composites(NULL, ifr_muxes,
++ ARRAY_SIZE(ifr_muxes), base,
++ &mt8516_clk_lock, clk_data);
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+diff --git a/drivers/clk/mediatek/clk-mtk.c b/drivers/clk/mediatek/clk-mtk.c
+index 6123b234d3c3b..152f3d906ef8a 100644
+--- a/drivers/clk/mediatek/clk-mtk.c
++++ b/drivers/clk/mediatek/clk-mtk.c
+@@ -197,8 +197,8 @@ void mtk_clk_unregister_factors(const struct mtk_fixed_factor *clks, int num,
+ }
+ EXPORT_SYMBOL_GPL(mtk_clk_unregister_factors);
+
+-static struct clk_hw *mtk_clk_register_composite(const struct mtk_composite *mc,
+- void __iomem *base, spinlock_t *lock)
++static struct clk_hw *mtk_clk_register_composite(struct device *dev,
++ const struct mtk_composite *mc, void __iomem *base, spinlock_t *lock)
+ {
+ struct clk_hw *hw;
+ struct clk_mux *mux = NULL;
+@@ -264,7 +264,7 @@ static struct clk_hw *mtk_clk_register_composite(const struct mtk_composite *mc,
+ div_ops = &clk_divider_ops;
+ }
+
+- hw = clk_hw_register_composite(NULL, mc->name, parent_names, num_parents,
++ hw = clk_hw_register_composite(dev, mc->name, parent_names, num_parents,
+ mux_hw, mux_ops,
+ div_hw, div_ops,
+ gate_hw, gate_ops,
+@@ -308,7 +308,8 @@ static void mtk_clk_unregister_composite(struct clk_hw *hw)
+ kfree(mux);
+ }
+
+-int mtk_clk_register_composites(const struct mtk_composite *mcs, int num,
++int mtk_clk_register_composites(struct device *dev,
++ const struct mtk_composite *mcs, int num,
+ void __iomem *base, spinlock_t *lock,
+ struct clk_hw_onecell_data *clk_data)
+ {
+@@ -327,7 +328,7 @@ int mtk_clk_register_composites(const struct mtk_composite *mcs, int num,
+ continue;
+ }
+
+- hw = mtk_clk_register_composite(mc, base, lock);
++ hw = mtk_clk_register_composite(dev, mc, base, lock);
+
+ if (IS_ERR(hw)) {
+ pr_err("Failed to register clk %s: %pe\n", mc->name,
+diff --git a/drivers/clk/mediatek/clk-mtk.h b/drivers/clk/mediatek/clk-mtk.h
+index 63ae7941aa92f..3993a60738c77 100644
+--- a/drivers/clk/mediatek/clk-mtk.h
++++ b/drivers/clk/mediatek/clk-mtk.h
+@@ -149,7 +149,8 @@ struct mtk_composite {
+ .flags = 0, \
+ }
+
+-int mtk_clk_register_composites(const struct mtk_composite *mcs, int num,
++int mtk_clk_register_composites(struct device *dev,
++ const struct mtk_composite *mcs, int num,
+ void __iomem *base, spinlock_t *lock,
+ struct clk_hw_onecell_data *clk_data);
+ void mtk_clk_unregister_composites(const struct mtk_composite *mcs, int num,
+--
+2.39.2
+
--- /dev/null
+From 90e4007dc588c979a45cb4c7af8c10e38bed0cb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 10:20:36 +0100
+Subject: clk: mediatek: clk-mux: Propagate struct device for mtk-mux
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit d3d6bd5e25cdc460df33ae1db4f051c4bdd3aa60 ]
+
+Like done for other clocks, propagate struct device for mtk mux clocks
+registered through clk-mux helpers to enable runtime pm support.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Tested-by: Miles Chen <miles.chen@mediatek.com>
+Link: https://lore.kernel.org/r/20230120092053.182923-7-angelogioacchino.delregno@collabora.com
+Tested-by: Mingming Su <mingming.su@mediatek.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt6765.c | 3 ++-
+ drivers/clk/mediatek/clk-mt6779.c | 5 +++--
+ drivers/clk/mediatek/clk-mt6795-topckgen.c | 3 ++-
+ drivers/clk/mediatek/clk-mt7986-infracfg.c | 3 ++-
+ drivers/clk/mediatek/clk-mt7986-topckgen.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8183.c | 5 +++--
+ drivers/clk/mediatek/clk-mt8186-topckgen.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8192.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8195-topckgen.c | 3 ++-
+ drivers/clk/mediatek/clk-mt8365.c | 3 ++-
+ drivers/clk/mediatek/clk-mux.c | 14 ++++++++------
+ drivers/clk/mediatek/clk-mux.h | 3 ++-
+ 12 files changed, 32 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt6765.c b/drivers/clk/mediatek/clk-mt6765.c
+index a94851d11d774..0c20ce678350e 100644
+--- a/drivers/clk/mediatek/clk-mt6765.c
++++ b/drivers/clk/mediatek/clk-mt6765.c
+@@ -778,7 +778,8 @@ static int clk_mt6765_top_probe(struct platform_device *pdev)
+ clk_data);
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs),
+ clk_data);
+- mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node,
++ mtk_clk_register_muxes(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), node,
+ &mt6765_clk_lock, clk_data);
+ mtk_clk_register_gates(&pdev->dev, node, top_clks,
+ ARRAY_SIZE(top_clks), clk_data);
+diff --git a/drivers/clk/mediatek/clk-mt6779.c b/drivers/clk/mediatek/clk-mt6779.c
+index a1c387d9731a7..248aaa50ced14 100644
+--- a/drivers/clk/mediatek/clk-mt6779.c
++++ b/drivers/clk/mediatek/clk-mt6779.c
+@@ -1244,8 +1244,9 @@ static int clk_mt6779_top_probe(struct platform_device *pdev)
+
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
+
+- mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes),
+- node, &mt6779_clk_lock, clk_data);
++ mtk_clk_register_muxes(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), node,
++ &mt6779_clk_lock, clk_data);
+
+ mtk_clk_register_composites(&pdev->dev, top_aud_muxes,
+ ARRAY_SIZE(top_aud_muxes), base,
+diff --git a/drivers/clk/mediatek/clk-mt6795-topckgen.c b/drivers/clk/mediatek/clk-mt6795-topckgen.c
+index 845cc87049303..2ab8bf5d6d6d9 100644
+--- a/drivers/clk/mediatek/clk-mt6795-topckgen.c
++++ b/drivers/clk/mediatek/clk-mt6795-topckgen.c
+@@ -552,7 +552,8 @@ static int clk_mt6795_topckgen_probe(struct platform_device *pdev)
+ if (ret)
+ goto unregister_fixed_clks;
+
+- ret = mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node,
++ ret = mtk_clk_register_muxes(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), node,
+ &mt6795_top_clk_lock, clk_data);
+ if (ret)
+ goto unregister_factors;
+diff --git a/drivers/clk/mediatek/clk-mt7986-infracfg.c b/drivers/clk/mediatek/clk-mt7986-infracfg.c
+index 578f150e0ee52..0a4bf87ee1607 100644
+--- a/drivers/clk/mediatek/clk-mt7986-infracfg.c
++++ b/drivers/clk/mediatek/clk-mt7986-infracfg.c
+@@ -178,7 +178,8 @@ static int clk_mt7986_infracfg_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ mtk_clk_register_factors(infra_divs, ARRAY_SIZE(infra_divs), clk_data);
+- mtk_clk_register_muxes(infra_muxes, ARRAY_SIZE(infra_muxes), node,
++ mtk_clk_register_muxes(&pdev->dev, infra_muxes,
++ ARRAY_SIZE(infra_muxes), node,
+ &mt7986_clk_lock, clk_data);
+ mtk_clk_register_gates(&pdev->dev, node, infra_clks,
+ ARRAY_SIZE(infra_clks), clk_data);
+diff --git a/drivers/clk/mediatek/clk-mt7986-topckgen.c b/drivers/clk/mediatek/clk-mt7986-topckgen.c
+index de5121cf28774..c9bf47e6098fd 100644
+--- a/drivers/clk/mediatek/clk-mt7986-topckgen.c
++++ b/drivers/clk/mediatek/clk-mt7986-topckgen.c
+@@ -303,7 +303,8 @@ static int clk_mt7986_topckgen_probe(struct platform_device *pdev)
+ mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks),
+ clk_data);
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
+- mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node,
++ mtk_clk_register_muxes(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), node,
+ &mt7986_clk_lock, clk_data);
+
+ clk_prepare_enable(clk_data->hws[CLK_TOP_SYSAXI_SEL]->clk);
+diff --git a/drivers/clk/mediatek/clk-mt8183.c b/drivers/clk/mediatek/clk-mt8183.c
+index bf7b342332536..78620244144e8 100644
+--- a/drivers/clk/mediatek/clk-mt8183.c
++++ b/drivers/clk/mediatek/clk-mt8183.c
+@@ -1238,8 +1238,9 @@ static int clk_mt8183_top_probe(struct platform_device *pdev)
+
+ mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), top_clk_data);
+
+- mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes),
+- node, &mt8183_clk_lock, top_clk_data);
++ mtk_clk_register_muxes(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), node,
++ &mt8183_clk_lock, top_clk_data);
+
+ mtk_clk_register_composites(&pdev->dev, top_aud_muxes,
+ ARRAY_SIZE(top_aud_muxes), base,
+diff --git a/drivers/clk/mediatek/clk-mt8186-topckgen.c b/drivers/clk/mediatek/clk-mt8186-topckgen.c
+index 4ac157320a6b9..70b6e008a188b 100644
+--- a/drivers/clk/mediatek/clk-mt8186-topckgen.c
++++ b/drivers/clk/mediatek/clk-mt8186-topckgen.c
+@@ -715,7 +715,8 @@ static int clk_mt8186_topck_probe(struct platform_device *pdev)
+ if (r)
+ goto unregister_fixed_clks;
+
+- r = mtk_clk_register_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), node,
++ r = mtk_clk_register_muxes(&pdev->dev, top_mtk_muxes,
++ ARRAY_SIZE(top_mtk_muxes), node,
+ &mt8186_clk_lock, clk_data);
+ if (r)
+ goto unregister_factors;
+diff --git a/drivers/clk/mediatek/clk-mt8192.c b/drivers/clk/mediatek/clk-mt8192.c
+index ab856d0276184..16feb86dcb1b8 100644
+--- a/drivers/clk/mediatek/clk-mt8192.c
++++ b/drivers/clk/mediatek/clk-mt8192.c
+@@ -1112,7 +1112,8 @@ static int clk_mt8192_top_probe(struct platform_device *pdev)
+ if (r)
+ goto unregister_early_factors;
+
+- r = mtk_clk_register_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), node,
++ r = mtk_clk_register_muxes(&pdev->dev, top_mtk_muxes,
++ ARRAY_SIZE(top_mtk_muxes), node,
+ &mt8192_clk_lock, top_clk_data);
+ if (r)
+ goto unregister_factors;
+diff --git a/drivers/clk/mediatek/clk-mt8195-topckgen.c b/drivers/clk/mediatek/clk-mt8195-topckgen.c
+index aae31ef3903de..3485ebb17ab83 100644
+--- a/drivers/clk/mediatek/clk-mt8195-topckgen.c
++++ b/drivers/clk/mediatek/clk-mt8195-topckgen.c
+@@ -1262,7 +1262,8 @@ static int clk_mt8195_topck_probe(struct platform_device *pdev)
+ if (r)
+ goto unregister_fixed_clks;
+
+- r = mtk_clk_register_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), node,
++ r = mtk_clk_register_muxes(&pdev->dev, top_mtk_muxes,
++ ARRAY_SIZE(top_mtk_muxes), node,
+ &mt8195_clk_lock, top_clk_data);
+ if (r)
+ goto unregister_factors;
+diff --git a/drivers/clk/mediatek/clk-mt8365.c b/drivers/clk/mediatek/clk-mt8365.c
+index 0482a8aa43cc9..c9faa07ec0a64 100644
+--- a/drivers/clk/mediatek/clk-mt8365.c
++++ b/drivers/clk/mediatek/clk-mt8365.c
+@@ -947,7 +947,8 @@ static int clk_mt8365_top_probe(struct platform_device *pdev)
+ if (ret)
+ goto unregister_fixed_clks;
+
+- ret = mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node,
++ ret = mtk_clk_register_muxes(&pdev->dev, top_muxes,
++ ARRAY_SIZE(top_muxes), node,
+ &mt8365_clk_lock, clk_data);
+ if (ret)
+ goto unregister_factors;
+diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c
+index ba1720b9e2310..c8593554239d6 100644
+--- a/drivers/clk/mediatek/clk-mux.c
++++ b/drivers/clk/mediatek/clk-mux.c
+@@ -154,9 +154,10 @@ const struct clk_ops mtk_mux_gate_clr_set_upd_ops = {
+ };
+ EXPORT_SYMBOL_GPL(mtk_mux_gate_clr_set_upd_ops);
+
+-static struct clk_hw *mtk_clk_register_mux(const struct mtk_mux *mux,
+- struct regmap *regmap,
+- spinlock_t *lock)
++static struct clk_hw *mtk_clk_register_mux(struct device *dev,
++ const struct mtk_mux *mux,
++ struct regmap *regmap,
++ spinlock_t *lock)
+ {
+ struct mtk_clk_mux *clk_mux;
+ struct clk_init_data init = {};
+@@ -177,7 +178,7 @@ static struct clk_hw *mtk_clk_register_mux(const struct mtk_mux *mux,
+ clk_mux->lock = lock;
+ clk_mux->hw.init = &init;
+
+- ret = clk_hw_register(NULL, &clk_mux->hw);
++ ret = clk_hw_register(dev, &clk_mux->hw);
+ if (ret) {
+ kfree(clk_mux);
+ return ERR_PTR(ret);
+@@ -198,7 +199,8 @@ static void mtk_clk_unregister_mux(struct clk_hw *hw)
+ kfree(mux);
+ }
+
+-int mtk_clk_register_muxes(const struct mtk_mux *muxes,
++int mtk_clk_register_muxes(struct device *dev,
++ const struct mtk_mux *muxes,
+ int num, struct device_node *node,
+ spinlock_t *lock,
+ struct clk_hw_onecell_data *clk_data)
+@@ -222,7 +224,7 @@ int mtk_clk_register_muxes(const struct mtk_mux *muxes,
+ continue;
+ }
+
+- hw = mtk_clk_register_mux(mux, regmap, lock);
++ hw = mtk_clk_register_mux(dev, mux, regmap, lock);
+
+ if (IS_ERR(hw)) {
+ pr_err("Failed to register clk %s: %pe\n", mux->name,
+diff --git a/drivers/clk/mediatek/clk-mux.h b/drivers/clk/mediatek/clk-mux.h
+index 83ff420f4ebe6..7ecb963b0ec68 100644
+--- a/drivers/clk/mediatek/clk-mux.h
++++ b/drivers/clk/mediatek/clk-mux.h
+@@ -83,7 +83,8 @@ extern const struct clk_ops mtk_mux_gate_clr_set_upd_ops;
+ 0, _upd_ofs, _upd, CLK_SET_RATE_PARENT, \
+ mtk_mux_clr_set_upd_ops)
+
+-int mtk_clk_register_muxes(const struct mtk_mux *muxes,
++int mtk_clk_register_muxes(struct device *dev,
++ const struct mtk_mux *muxes,
+ int num, struct device_node *node,
+ spinlock_t *lock,
+ struct clk_hw_onecell_data *clk_data);
+--
+2.39.2
+
--- /dev/null
+From 20dc2f887e6793acb93a1af56ab3c7038d56b852 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Apr 2023 08:43:31 +0000
+Subject: clk: mediatek: fix of_iomap memory leak
+
+From: Bosi Zhang <u201911157@hust.edu.cn>
+
+[ Upstream commit 3db7285e044144fd88a356f5b641b9cd4b231a77 ]
+
+Smatch reports:
+drivers/clk/mediatek/clk-mtk.c:583 mtk_clk_simple_probe() warn:
+ 'base' from of_iomap() not released on lines: 496.
+
+This problem was also found in linux-next. In mtk_clk_simple_probe(),
+base is not released when handling errors
+if clk_data is not existed, which may cause a leak.
+So free_base should be added here to release base.
+
+Fixes: c58cd0e40ffa ("clk: mediatek: Add mtk_clk_simple_probe() to simplify clock providers")
+Signed-off-by: Bosi Zhang <u201911157@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230422084331.47198-1-u201911157@hust.edu.cn
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mtk.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mtk.c b/drivers/clk/mediatek/clk-mtk.c
+index bfabd94a474a5..bb89963e5e1fa 100644
+--- a/drivers/clk/mediatek/clk-mtk.c
++++ b/drivers/clk/mediatek/clk-mtk.c
+@@ -476,8 +476,10 @@ int mtk_clk_simple_probe(struct platform_device *pdev)
+ num_clks += mcd->num_mux_clks;
+
+ clk_data = mtk_alloc_clk_data(num_clks);
+- if (!clk_data)
+- return -ENOMEM;
++ if (!clk_data) {
++ r = -ENOMEM;
++ goto free_base;
++ }
+
+ if (mcd->fixed_clks) {
+ r = mtk_clk_register_fixed_clks(mcd->fixed_clks,
+@@ -554,6 +556,7 @@ int mtk_clk_simple_probe(struct platform_device *pdev)
+ mcd->num_fixed_clks, clk_data);
+ free_data:
+ mtk_free_clk_data(clk_data);
++free_base:
+ if (mcd->shared_io && base)
+ iounmap(base);
+ return r;
+--
+2.39.2
+
--- /dev/null
+From 9c5b8c494328f83883334a908d43b8a072a9a9c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 10:20:31 +0100
+Subject: clk: mediatek: mt8192: Correctly unregister and free clocks on
+ failure
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 0cbe12694990501be92f997d987925132002dbe5 ]
+
+If anything fails during probe of the clock controller(s), unregister
+(and kfree!) whatever we have previously registered to leave with a
+clean state and prevent leaks.
+
+Fixes: 710573dee31b ("clk: mediatek: Add MT8192 basic clocks support")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Tested-by: Miles Chen <miles.chen@mediatek.com>
+Link: https://lore.kernel.org/r/20230120092053.182923-2-angelogioacchino.delregno@collabora.com
+Tested-by: Mingming Su <mingming.su@mediatek.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt8192.c | 77 ++++++++++++++++++++++++-------
+ 1 file changed, 60 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt8192.c b/drivers/clk/mediatek/clk-mt8192.c
+index d0f2269310706..74bd8bac94a35 100644
+--- a/drivers/clk/mediatek/clk-mt8192.c
++++ b/drivers/clk/mediatek/clk-mt8192.c
+@@ -1100,27 +1100,64 @@ static int clk_mt8192_top_probe(struct platform_device *pdev)
+ if (IS_ERR(base))
+ return PTR_ERR(base);
+
+- mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks), top_clk_data);
+- mtk_clk_register_factors(top_early_divs, ARRAY_SIZE(top_early_divs), top_clk_data);
+- mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), top_clk_data);
+- mtk_clk_register_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), node, &mt8192_clk_lock,
+- top_clk_data);
+- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, &mt8192_clk_lock,
+- top_clk_data);
+- mtk_clk_register_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), base, &mt8192_clk_lock,
+- top_clk_data);
+- r = mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), top_clk_data);
++ r = mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks), top_clk_data);
+ if (r)
+ return r;
+
++ r = mtk_clk_register_factors(top_early_divs, ARRAY_SIZE(top_early_divs), top_clk_data);
++ if (r)
++ goto unregister_fixed_clks;
++
++ r = mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), top_clk_data);
++ if (r)
++ goto unregister_early_factors;
++
++ r = mtk_clk_register_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), node,
++ &mt8192_clk_lock, top_clk_data);
++ if (r)
++ goto unregister_factors;
++
++ r = mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
++ &mt8192_clk_lock, top_clk_data);
++ if (r)
++ goto unregister_muxes;
++
++ r = mtk_clk_register_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), base,
++ &mt8192_clk_lock, top_clk_data);
++ if (r)
++ goto unregister_top_composites;
++
++ r = mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), top_clk_data);
++ if (r)
++ goto unregister_adj_divs_composites;
++
+ r = clk_mt8192_reg_mfg_mux_notifier(&pdev->dev,
+ top_clk_data->hws[CLK_TOP_MFG_PLL_SEL]->clk);
+ if (r)
+- return r;
+-
++ goto unregister_gates;
+
+- return of_clk_add_hw_provider(node, of_clk_hw_onecell_get,
++ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, top_clk_data);
++ if (r)
++ goto unregister_gates;
++
++ return 0;
++
++unregister_gates:
++ mtk_clk_unregister_gates(top_clks, ARRAY_SIZE(top_clks), top_clk_data);
++unregister_adj_divs_composites:
++ mtk_clk_unregister_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), top_clk_data);
++unregister_top_composites:
++ mtk_clk_unregister_composites(top_muxes, ARRAY_SIZE(top_muxes), top_clk_data);
++unregister_muxes:
++ mtk_clk_unregister_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), top_clk_data);
++unregister_factors:
++ mtk_clk_unregister_factors(top_divs, ARRAY_SIZE(top_divs), top_clk_data);
++unregister_early_factors:
++ mtk_clk_unregister_factors(top_early_divs, ARRAY_SIZE(top_early_divs), top_clk_data);
++unregister_fixed_clks:
++ mtk_clk_unregister_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks),
+ top_clk_data);
++ return r;
+ }
+
+ static int clk_mt8192_infra_probe(struct platform_device *pdev)
+@@ -1139,14 +1176,16 @@ static int clk_mt8192_infra_probe(struct platform_device *pdev)
+
+ r = mtk_register_reset_controller_with_dev(&pdev->dev, &clk_rst_desc);
+ if (r)
+- goto free_clk_data;
++ goto unregister_gates;
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+- goto free_clk_data;
++ goto unregister_gates;
+
+ return r;
+
++unregister_gates:
++ mtk_clk_unregister_gates(infra_clks, ARRAY_SIZE(infra_clks), clk_data);
+ free_clk_data:
+ mtk_free_clk_data(clk_data);
+ return r;
+@@ -1168,10 +1207,12 @@ static int clk_mt8192_peri_probe(struct platform_device *pdev)
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+- goto free_clk_data;
++ goto unregister_gates;
+
+ return r;
+
++unregister_gates:
++ mtk_clk_unregister_gates(peri_clks, ARRAY_SIZE(peri_clks), clk_data);
+ free_clk_data:
+ mtk_free_clk_data(clk_data);
+ return r;
+@@ -1194,10 +1235,12 @@ static int clk_mt8192_apmixed_probe(struct platform_device *pdev)
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+- goto free_clk_data;
++ goto unregister_gates;
+
+ return r;
+
++unregister_gates:
++ mtk_clk_unregister_gates(apmixed_clks, ARRAY_SIZE(apmixed_clks), clk_data);
+ free_clk_data:
+ mtk_free_clk_data(clk_data);
+ return r;
+--
+2.39.2
+
--- /dev/null
+From 2d3bb8ca091ed11a86744720d6daa56d9d206f07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 10:20:32 +0100
+Subject: clk: mediatek: mt8192: Propagate struct device for gate clocks
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit fdc325c8f79cb4155009db8394db19793c4d07cd ]
+
+Convert instances of mtk_clk_register_gates() to use the newer
+mtk_clk_register_gates_with_dev() to propagate struct device to
+the clk framework.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Miles Chen <miles.chen@mediatek.com>
+Link: https://lore.kernel.org/r/20230120092053.182923-3-angelogioacchino.delregno@collabora.com
+Tested-by: Mingming Su <mingming.su@mediatek.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt8192.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt8192.c b/drivers/clk/mediatek/clk-mt8192.c
+index 74bd8bac94a35..508af9bbcc46c 100644
+--- a/drivers/clk/mediatek/clk-mt8192.c
++++ b/drivers/clk/mediatek/clk-mt8192.c
+@@ -1127,7 +1127,8 @@ static int clk_mt8192_top_probe(struct platform_device *pdev)
+ if (r)
+ goto unregister_top_composites;
+
+- r = mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), top_clk_data);
++ r = mtk_clk_register_gates_with_dev(node, top_clks, ARRAY_SIZE(top_clks),
++ top_clk_data, &pdev->dev);
+ if (r)
+ goto unregister_adj_divs_composites;
+
+@@ -1170,7 +1171,8 @@ static int clk_mt8192_infra_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- r = mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), clk_data);
++ r = mtk_clk_register_gates_with_dev(node, infra_clks, ARRAY_SIZE(infra_clks),
++ clk_data, &pdev->dev);
+ if (r)
+ goto free_clk_data;
+
+@@ -1201,7 +1203,8 @@ static int clk_mt8192_peri_probe(struct platform_device *pdev)
+ if (!clk_data)
+ return -ENOMEM;
+
+- r = mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks), clk_data);
++ r = mtk_clk_register_gates_with_dev(node, peri_clks, ARRAY_SIZE(peri_clks),
++ clk_data, &pdev->dev);
+ if (r)
+ goto free_clk_data;
+
+@@ -1229,7 +1232,9 @@ static int clk_mt8192_apmixed_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
+- r = mtk_clk_register_gates(node, apmixed_clks, ARRAY_SIZE(apmixed_clks), clk_data);
++ r = mtk_clk_register_gates_with_dev(node, apmixed_clks,
++ ARRAY_SIZE(apmixed_clks), clk_data,
++ &pdev->dev);
+ if (r)
+ goto free_clk_data;
+
+--
+2.39.2
+
--- /dev/null
+From 657ad75f80e771da9db4c651e1ca6f4dbb43e330 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 16:23:34 +0100
+Subject: clk: renesas: rzg2l: Fix CPG_SIPLL5_CLK1 register write
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit d1c20885d3b01e6a62e920af4b227abd294d22f3 ]
+
+As per the RZ/G2L HW(Rev.1.30 May2023) manual, there are no "write enable"
+bits in the CPG_SIPLL5_CLK1 register. So fix the CPG_SIPLL5_CLK register
+write by removing the "write enable" bits.
+
+Fixes: 1561380ee72f ("clk: renesas: rzg2l: Add FOUTPOSTDIV clk support")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230518152334.514922-1-biju.das.jz@bp.renesas.com
+[geert: Remove CPG_SIPLL5_CLK1_*_WEN bit definitions]
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 6 ++----
+ drivers/clk/renesas/rzg2l-cpg.h | 3 ---
+ 2 files changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index 3ff6ecd617565..2c877576c5729 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -600,10 +600,8 @@ static int rzg2l_cpg_sipll5_set_rate(struct clk_hw *hw,
+ }
+
+ /* Output clock setting 1 */
+- writel(CPG_SIPLL5_CLK1_POSTDIV1_WEN | CPG_SIPLL5_CLK1_POSTDIV2_WEN |
+- CPG_SIPLL5_CLK1_REFDIV_WEN | (params.pl5_postdiv1 << 0) |
+- (params.pl5_postdiv2 << 4) | (params.pl5_refdiv << 8),
+- priv->base + CPG_SIPLL5_CLK1);
++ writel((params.pl5_postdiv1 << 0) | (params.pl5_postdiv2 << 4) |
++ (params.pl5_refdiv << 8), priv->base + CPG_SIPLL5_CLK1);
+
+ /* Output clock setting, SSCG modulation value setting 3 */
+ writel((params.pl5_fracin << 8), priv->base + CPG_SIPLL5_CLK3);
+diff --git a/drivers/clk/renesas/rzg2l-cpg.h b/drivers/clk/renesas/rzg2l-cpg.h
+index cecbdf5e4f93a..b33a3e79161b6 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.h
++++ b/drivers/clk/renesas/rzg2l-cpg.h
+@@ -32,9 +32,6 @@
+ #define CPG_SIPLL5_STBY_RESETB_WEN BIT(16)
+ #define CPG_SIPLL5_STBY_SSCG_EN_WEN BIT(18)
+ #define CPG_SIPLL5_STBY_DOWNSPREAD_WEN BIT(20)
+-#define CPG_SIPLL5_CLK1_POSTDIV1_WEN BIT(16)
+-#define CPG_SIPLL5_CLK1_POSTDIV2_WEN BIT(20)
+-#define CPG_SIPLL5_CLK1_REFDIV_WEN BIT(24)
+ #define CPG_SIPLL5_CLK4_RESV_LSB (0xFF)
+ #define CPG_SIPLL5_MON_PLL5_LOCK BIT(4)
+
+--
+2.39.2
+
--- /dev/null
+From 743ce560e19703c8c7294288f3a87d752ac2e73a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 May 2023 15:39:06 +0200
+Subject: clk: rs9: Fix .driver_data content in i2c_device_id
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit ad527ca87e4ea42d7baad2ce710b44069287931b ]
+
+The .driver_data content in i2c_device_id table must match the
+.data content in of_device_id table, else device_get_match_data()
+would return bogus value on i2c_device_id match. Align the two
+tables.
+
+The i2c_device_id table is now converted from of_device_id using
+'s@.compatible = "renesas,\([^"]\+"\), .data = \(.*\)@"\1, .driver_data = (kernel_ulong_t)\2@'
+
+Fixes: 892e0ddea1aa ("clk: rs9: Add Renesas 9-series PCIe clock generator driver")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Link: https://lore.kernel.org/r/20230507133906.15061-3-marek.vasut+renesas@mailbox.org
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-renesas-pcie.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk-renesas-pcie.c b/drivers/clk/clk-renesas-pcie.c
+index 3e98a16eba6bb..35b2519f16961 100644
+--- a/drivers/clk/clk-renesas-pcie.c
++++ b/drivers/clk/clk-renesas-pcie.c
+@@ -353,7 +353,7 @@ static const struct rs9_chip_info renesas_9fgv0241_info = {
+ };
+
+ static const struct i2c_device_id rs9_id[] = {
+- { "9fgv0241", .driver_data = RENESAS_9FGV0241 },
++ { "9fgv0241", .driver_data = (kernel_ulong_t)&renesas_9fgv0241_info },
+ { }
+ };
+ MODULE_DEVICE_TABLE(i2c, rs9_id);
+--
+2.39.2
+
--- /dev/null
+From e9f0b29ee563de20777d882554978ef2ebae4814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 12:39:09 +0300
+Subject: clk: si5341: check return value of {devm_}kasprintf()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 36e4ef82016a2b785cf2317eade77e76699b7bff ]
+
+{devm_}kasprintf() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230530093913.1656095-5-claudiu.beznea@microchip.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-si5341.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c
+index 6dca3288c8940..b2cf7edc8b308 100644
+--- a/drivers/clk/clk-si5341.c
++++ b/drivers/clk/clk-si5341.c
+@@ -1697,6 +1697,10 @@ static int si5341_probe(struct i2c_client *client)
+ for (i = 0; i < data->num_synth; ++i) {
+ synth_clock_names[i] = devm_kasprintf(&client->dev, GFP_KERNEL,
+ "%s.N%u", client->dev.of_node->name, i);
++ if (!synth_clock_names[i]) {
++ err = -ENOMEM;
++ goto free_clk_names;
++ }
+ init.name = synth_clock_names[i];
+ data->synth[i].index = i;
+ data->synth[i].data = data;
+@@ -1715,6 +1719,10 @@ static int si5341_probe(struct i2c_client *client)
+ for (i = 0; i < data->num_outputs; ++i) {
+ init.name = kasprintf(GFP_KERNEL, "%s.%d",
+ client->dev.of_node->name, i);
++ if (!init.name) {
++ err = -ENOMEM;
++ goto free_clk_names;
++ }
+ init.flags = config[i].synth_master ? CLK_SET_RATE_PARENT : 0;
+ data->clk[i].index = i;
+ data->clk[i].data = data;
+--
+2.39.2
+
--- /dev/null
+From 62c7d403a3ef7907f4e53763d5d750a62266a6a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 12:39:10 +0300
+Subject: clk: si5341: free unused memory on probe failure
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 267ad94b13c53d8c99a336f0841b1fa1595b1d0f ]
+
+Pointers from synth_clock_names[] should be freed at the end of probe
+either on probe success or failure path.
+
+Fixes: b7bbf6ec4940 ("clk: si5341: Allow different output VDD_SEL values")
+Fixes: 9b13ff4340df ("clk: si5341: Add sysfs properties to allow checking/resetting device faults")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230530093913.1656095-6-claudiu.beznea@microchip.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-si5341.c | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c
+index b2cf7edc8b308..c7d8cbd22bacc 100644
+--- a/drivers/clk/clk-si5341.c
++++ b/drivers/clk/clk-si5341.c
+@@ -1744,7 +1744,7 @@ static int si5341_probe(struct i2c_client *client)
+ if (err) {
+ dev_err(&client->dev,
+ "output %u registration failed\n", i);
+- goto cleanup;
++ goto free_clk_names;
+ }
+ if (config[i].always_on)
+ clk_prepare(data->clk[i].hw.clk);
+@@ -1754,7 +1754,7 @@ static int si5341_probe(struct i2c_client *client)
+ data);
+ if (err) {
+ dev_err(&client->dev, "unable to add clk provider\n");
+- goto cleanup;
++ goto free_clk_names;
+ }
+
+ if (initialization_required) {
+@@ -1762,11 +1762,11 @@ static int si5341_probe(struct i2c_client *client)
+ regcache_cache_only(data->regmap, false);
+ err = regcache_sync(data->regmap);
+ if (err < 0)
+- goto cleanup;
++ goto free_clk_names;
+
+ err = si5341_finalize_defaults(data);
+ if (err < 0)
+- goto cleanup;
++ goto free_clk_names;
+ }
+
+ /* wait for device to report input clock present and PLL lock */
+@@ -1775,21 +1775,19 @@ static int si5341_probe(struct i2c_client *client)
+ 10000, 250000);
+ if (err) {
+ dev_err(&client->dev, "Error waiting for input clock or PLL lock\n");
+- goto cleanup;
++ goto free_clk_names;
+ }
+
+ /* clear sticky alarm bits from initialization */
+ err = regmap_write(data->regmap, SI5341_STATUS_STICKY, 0);
+ if (err) {
+ dev_err(&client->dev, "unable to clear sticky status\n");
+- goto cleanup;
++ goto free_clk_names;
+ }
+
+ err = sysfs_create_files(&client->dev.kobj, si5341_attributes);
+- if (err) {
++ if (err)
+ dev_err(&client->dev, "unable to create sysfs files\n");
+- goto cleanup;
+- }
+
+ free_clk_names:
+ /* Free the names, clk framework makes copies */
+--
+2.39.2
+
--- /dev/null
+From f724f68f6d43d78c447f972663d0223f1469b67c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 12:39:08 +0300
+Subject: clk: si5341: return error if one synth clock registration fails
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 2560114c06d7a752b3f4639f28cece58fed11267 ]
+
+In case devm_clk_hw_register() fails for one of synth clocks the probe
+continues. Later on, when registering output clocks which have as parents
+all the synth clocks, in case there is registration failure for at least
+one synth clock the information passed to clk core for registering output
+clock is not right: init.num_parents is fixed but init.parents may contain
+an array with less parents.
+
+Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230530093913.1656095-4-claudiu.beznea@microchip.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-si5341.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c
+index 0e528d7ba656e..6dca3288c8940 100644
+--- a/drivers/clk/clk-si5341.c
++++ b/drivers/clk/clk-si5341.c
+@@ -1553,7 +1553,7 @@ static int si5341_probe(struct i2c_client *client)
+ struct clk_init_data init;
+ struct clk *input;
+ const char *root_clock_name;
+- const char *synth_clock_names[SI5341_NUM_SYNTH];
++ const char *synth_clock_names[SI5341_NUM_SYNTH] = { NULL };
+ int err;
+ unsigned int i;
+ struct clk_si5341_output_config config[SI5341_MAX_NUM_OUTPUTS];
+@@ -1705,6 +1705,7 @@ static int si5341_probe(struct i2c_client *client)
+ if (err) {
+ dev_err(&client->dev,
+ "synth N%u registration failed\n", i);
++ goto free_clk_names;
+ }
+ }
+
+@@ -1782,16 +1783,17 @@ static int si5341_probe(struct i2c_client *client)
+ goto cleanup;
+ }
+
++free_clk_names:
+ /* Free the names, clk framework makes copies */
+ for (i = 0; i < data->num_synth; ++i)
+ devm_kfree(&client->dev, (void *)synth_clock_names[i]);
+
+- return 0;
+-
+ cleanup:
+- for (i = 0; i < SI5341_MAX_NUM_OUTPUTS; ++i) {
+- if (data->clk[i].vddo_reg)
+- regulator_disable(data->clk[i].vddo_reg);
++ if (err) {
++ for (i = 0; i < SI5341_MAX_NUM_OUTPUTS; ++i) {
++ if (data->clk[i].vddo_reg)
++ regulator_disable(data->clk[i].vddo_reg);
++ }
+ }
+ return err;
+ }
+--
+2.39.2
+
--- /dev/null
+From 01b81d38b3568d9bc93dffb69b52c29d11a01074 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Dec 2022 09:41:24 +0000
+Subject: clk: tegra: tegra124-emc: Fix potential memory leak
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 53a06e5924c0d43c11379a08c5a78529c3e61595 ]
+
+The tegra and tegra needs to be freed in the error handling path, otherwise
+it will be leaked.
+
+Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Link: https://lore.kernel.org/r/20221209094124.71043-1-yuancan@huawei.com
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-tegra124-emc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
+index 219c80653dbdb..2a6db04342815 100644
+--- a/drivers/clk/tegra/clk-tegra124-emc.c
++++ b/drivers/clk/tegra/clk-tegra124-emc.c
+@@ -464,6 +464,7 @@ static int load_timings_from_dt(struct tegra_clk_emc *tegra,
+ err = load_one_timing_from_dt(tegra, timing, child);
+ if (err) {
+ of_node_put(child);
++ kfree(tegra->timings);
+ return err;
+ }
+
+@@ -515,6 +516,7 @@ struct clk *tegra124_clk_register_emc(void __iomem *base, struct device_node *np
+ err = load_timings_from_dt(tegra, node, node_ram_code);
+ if (err) {
+ of_node_put(node);
++ kfree(tegra);
+ return ERR_PTR(err);
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From f66c7776f72f482b69a26727a78e529ead7a0104 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 12:39:12 +0300
+Subject: clk: ti: clkctrl: check return value of kasprintf()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit bd46cd0b802d9c9576ca78007aa084ae3e74907b ]
+
+kasprintf() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: 852049594b9a ("clk: ti: clkctrl: convert subclocks to use proper names also")
+Fixes: 6c3090520554 ("clk: ti: clkctrl: Fix hidden dependency to node name")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230530093913.1656095-8-claudiu.beznea@microchip.com
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clkctrl.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
+index ae58628794176..57611bfb299c1 100644
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -258,6 +258,9 @@ static const char * __init clkctrl_get_clock_name(struct device_node *np,
+ if (clkctrl_name && !legacy_naming) {
+ clock_name = kasprintf(GFP_KERNEL, "%s-clkctrl:%04x:%d",
+ clkctrl_name, offset, index);
++ if (!clock_name)
++ return NULL;
++
+ strreplace(clock_name, '_', '-');
+
+ return clock_name;
+@@ -586,6 +589,10 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node)
+ if (clkctrl_name) {
+ provider->clkdm_name = kasprintf(GFP_KERNEL,
+ "%s_clkdm", clkctrl_name);
++ if (!provider->clkdm_name) {
++ kfree(provider);
++ return;
++ }
+ goto clkdm_found;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 7a86f295ea30b9ee101b1d8a1181ca5ed682e5ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 12:39:06 +0300
+Subject: clk: vc5: check memory returned by kasprintf()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 144601f6228de5598f03e693822b60a95c367a17 ]
+
+kasprintf() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: f491276a5168 ("clk: vc5: Allow Versaclock driver to support multiple instances")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230530093913.1656095-2-claudiu.beznea@microchip.com
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-versaclock5.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
+index 5f2c9093c5b94..ef50ab78dd90d 100644
+--- a/drivers/clk/clk-versaclock5.c
++++ b/drivers/clk/clk-versaclock5.c
+@@ -1027,6 +1027,11 @@ static int vc5_probe(struct i2c_client *client)
+ }
+
+ init.name = kasprintf(GFP_KERNEL, "%pOFn.mux", client->dev.of_node);
++ if (!init.name) {
++ ret = -ENOMEM;
++ goto err_clk;
++ }
++
+ init.ops = &vc5_mux_ops;
+ init.flags = 0;
+ init.parent_names = parent_names;
+@@ -1041,6 +1046,10 @@ static int vc5_probe(struct i2c_client *client)
+ memset(&init, 0, sizeof(init));
+ init.name = kasprintf(GFP_KERNEL, "%pOFn.dbl",
+ client->dev.of_node);
++ if (!init.name) {
++ ret = -ENOMEM;
++ goto err_clk;
++ }
+ init.ops = &vc5_dbl_ops;
+ init.flags = CLK_SET_RATE_PARENT;
+ init.parent_names = parent_names;
+@@ -1056,6 +1065,10 @@ static int vc5_probe(struct i2c_client *client)
+ /* Register PFD */
+ memset(&init, 0, sizeof(init));
+ init.name = kasprintf(GFP_KERNEL, "%pOFn.pfd", client->dev.of_node);
++ if (!init.name) {
++ ret = -ENOMEM;
++ goto err_clk;
++ }
+ init.ops = &vc5_pfd_ops;
+ init.flags = CLK_SET_RATE_PARENT;
+ init.parent_names = parent_names;
+@@ -1073,6 +1086,10 @@ static int vc5_probe(struct i2c_client *client)
+ /* Register PLL */
+ memset(&init, 0, sizeof(init));
+ init.name = kasprintf(GFP_KERNEL, "%pOFn.pll", client->dev.of_node);
++ if (!init.name) {
++ ret = -ENOMEM;
++ goto err_clk;
++ }
+ init.ops = &vc5_pll_ops;
+ init.flags = CLK_SET_RATE_PARENT;
+ init.parent_names = parent_names;
+@@ -1092,6 +1109,10 @@ static int vc5_probe(struct i2c_client *client)
+ memset(&init, 0, sizeof(init));
+ init.name = kasprintf(GFP_KERNEL, "%pOFn.fod%d",
+ client->dev.of_node, idx);
++ if (!init.name) {
++ ret = -ENOMEM;
++ goto err_clk;
++ }
+ init.ops = &vc5_fod_ops;
+ init.flags = CLK_SET_RATE_PARENT;
+ init.parent_names = parent_names;
+@@ -1110,6 +1131,10 @@ static int vc5_probe(struct i2c_client *client)
+ memset(&init, 0, sizeof(init));
+ init.name = kasprintf(GFP_KERNEL, "%pOFn.out0_sel_i2cb",
+ client->dev.of_node);
++ if (!init.name) {
++ ret = -ENOMEM;
++ goto err_clk;
++ }
+ init.ops = &vc5_clk_out_ops;
+ init.flags = CLK_SET_RATE_PARENT;
+ init.parent_names = parent_names;
+@@ -1136,6 +1161,10 @@ static int vc5_probe(struct i2c_client *client)
+ memset(&init, 0, sizeof(init));
+ init.name = kasprintf(GFP_KERNEL, "%pOFn.out%d",
+ client->dev.of_node, idx + 1);
++ if (!init.name) {
++ ret = -ENOMEM;
++ goto err_clk;
++ }
+ init.ops = &vc5_clk_out_ops;
+ init.flags = CLK_SET_RATE_PARENT;
+ init.parent_names = parent_names;
+--
+2.39.2
+
--- /dev/null
+From f67113914350c27689b18c59114d777591de3eb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 May 2023 15:39:04 +0200
+Subject: clk: vc5: Fix .driver_data content in i2c_device_id
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit be3471c5bd9b921c9adfab7948e8021611639164 ]
+
+The .driver_data content in i2c_device_id table must match the
+.data content in of_device_id table, else device_get_match_data()
+would return bogus value on i2c_device_id match. Align the two
+tables.
+
+The i2c_device_id table is now converted from of_device_id using
+'s@.compatible = "idt,\([^"]\+"\), .data = \(.*\)@"\1, .driver_data = (kernel_ulong_t)\2@'
+
+Fixes: 9adddb01ce5f ("clk: vc5: Add structure to describe particular chip features")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Link: https://lore.kernel.org/r/20230507133906.15061-1-marek.vasut+renesas@mailbox.org
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-versaclock5.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
+index abfe59ac4e487..5f2c9093c5b94 100644
+--- a/drivers/clk/clk-versaclock5.c
++++ b/drivers/clk/clk-versaclock5.c
+@@ -1255,13 +1255,13 @@ static const struct vc5_chip_info idt_5p49v6975_info = {
+ };
+
+ static const struct i2c_device_id vc5_id[] = {
+- { "5p49v5923", .driver_data = IDT_VC5_5P49V5923 },
+- { "5p49v5925", .driver_data = IDT_VC5_5P49V5925 },
+- { "5p49v5933", .driver_data = IDT_VC5_5P49V5933 },
+- { "5p49v5935", .driver_data = IDT_VC5_5P49V5935 },
+- { "5p49v6901", .driver_data = IDT_VC6_5P49V6901 },
+- { "5p49v6965", .driver_data = IDT_VC6_5P49V6965 },
+- { "5p49v6975", .driver_data = IDT_VC6_5P49V6975 },
++ { "5p49v5923", .driver_data = (kernel_ulong_t)&idt_5p49v5923_info },
++ { "5p49v5925", .driver_data = (kernel_ulong_t)&idt_5p49v5925_info },
++ { "5p49v5933", .driver_data = (kernel_ulong_t)&idt_5p49v5933_info },
++ { "5p49v5935", .driver_data = (kernel_ulong_t)&idt_5p49v5935_info },
++ { "5p49v6901", .driver_data = (kernel_ulong_t)&idt_5p49v6901_info },
++ { "5p49v6965", .driver_data = (kernel_ulong_t)&idt_5p49v6965_info },
++ { "5p49v6975", .driver_data = (kernel_ulong_t)&idt_5p49v6975_info },
+ { }
+ };
+ MODULE_DEVICE_TABLE(i2c, vc5_id);
+--
+2.39.2
+
--- /dev/null
+From 199c1b56c309c06378cf291d3cca9985f4ff6158 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jan 2023 15:34:58 -0800
+Subject: clk: vc5: Use `clamp()` to restrict PLL range
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+[ Upstream commit 3ed741db04f58e8df0d46cec7ecfc4bfd075f047 ]
+
+The VCO frequency needs to be within a certain range and the driver
+enforces this.
+
+Make use of the clamp macro to implement this instead of open-coding it.
+This makes the code a bit shorter and also semanticly stronger.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Link: https://lore.kernel.org/r/20230114233500.3294789-1-lars@metafoo.de
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Stable-dep-of: be3471c5bd9b ("clk: vc5: Fix .driver_data content in i2c_device_id")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-versaclock5.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
+index 88689415aff9c..abfe59ac4e487 100644
+--- a/drivers/clk/clk-versaclock5.c
++++ b/drivers/clk/clk-versaclock5.c
+@@ -450,10 +450,7 @@ static long vc5_pll_round_rate(struct clk_hw *hw, unsigned long rate,
+ u32 div_int;
+ u64 div_frc;
+
+- if (rate < VC5_PLL_VCO_MIN)
+- rate = VC5_PLL_VCO_MIN;
+- if (rate > VC5_PLL_VCO_MAX)
+- rate = VC5_PLL_VCO_MAX;
++ rate = clamp(rate, VC5_PLL_VCO_MIN, VC5_PLL_VCO_MAX);
+
+ /* Determine integer part, which is 12 bit wide */
+ div_int = rate / *parent_rate;
+--
+2.39.2
+
--- /dev/null
+From 430dc9dc9c031dd843b79e7c4c5d3d5fa2bb8c16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 May 2023 15:39:05 +0200
+Subject: clk: vc7: Fix .driver_data content in i2c_device_id
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit b5e10beeafaa3266559c582dde7534ae3fe8cefb ]
+
+The .driver_data content in i2c_device_id table must match the
+.data content in of_device_id table, else device_get_match_data()
+would return bogus value on i2c_device_id match. Align the two
+tables.
+
+The i2c_device_id table is now converted from of_device_id using
+'s@.compatible = "renesas,\([^"]\+"\), .data = \(.*\)@"\1, .driver_data = (kernel_ulong_t)\2@'
+
+Fixes: 48c5e98fedd9 ("clk: Renesas versaclock7 ccf device driver")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Link: https://lore.kernel.org/r/20230507133906.15061-2-marek.vasut+renesas@mailbox.org
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-versaclock7.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk-versaclock7.c b/drivers/clk/clk-versaclock7.c
+index 8e4f86e852aa0..0ae191f50b4b2 100644
+--- a/drivers/clk/clk-versaclock7.c
++++ b/drivers/clk/clk-versaclock7.c
+@@ -1282,7 +1282,7 @@ static const struct regmap_config vc7_regmap_config = {
+ };
+
+ static const struct i2c_device_id vc7_i2c_id[] = {
+- { "rc21008a", VC7_RC21008A },
++ { "rc21008a", .driver_data = (kernel_ulong_t)&vc7_rc21008a_info },
+ {}
+ };
+ MODULE_DEVICE_TABLE(i2c, vc7_i2c_id);
+--
+2.39.2
+
--- /dev/null
+From 73c4d4f5ed37557ff69a04021aae626425913f0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 11:56:37 +0530
+Subject: clocking-wizard: Support higher frequency accuracy
+
+From: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+
+[ Upstream commit 595c88cda65d30c6b36277c232193295a45406dc ]
+
+Change the multipliers and divisors to support a higher
+frequency accuracy if there is only one output.
+Currently only O is changed now we are changing M, D and O.
+For multiple output case the earlier behavior is retained.
+
+Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+Link: https://lore.kernel.org/r/20230327062637.22237-1-shubhrajyoti.datta@amd.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Stable-dep-of: b1356ed1a446 ("clk: clocking-wizard: check return value of devm_kasprintf()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 228 ++++++++++++++++++---
+ 1 file changed, 204 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+index 4a23583933bcc..5c362c622a866 100644
+--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
++++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+@@ -8,12 +8,14 @@
+ *
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/platform_device.h>
+ #include <linux/clk.h>
+ #include <linux/clk-provider.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
+ #include <linux/of.h>
++#include <linux/math64.h>
+ #include <linux/module.h>
+ #include <linux/err.h>
+ #include <linux/iopoll.h>
+@@ -37,6 +39,7 @@
+ #define WZRD_CLKOUT_DIVIDE_MASK (0xff << WZRD_DIVCLK_DIVIDE_SHIFT)
+ #define WZRD_CLKOUT_FRAC_SHIFT 8
+ #define WZRD_CLKOUT_FRAC_MASK 0x3ff
++#define WZRD_CLKOUT0_FRAC_MASK GENMASK(17, 8)
+
+ #define WZRD_DR_MAX_INT_DIV_VALUE 255
+ #define WZRD_DR_STATUS_REG_OFFSET 0x04
+@@ -49,6 +52,22 @@
+
+ #define WZRD_USEC_POLL 10
+ #define WZRD_TIMEOUT_POLL 1000
++
++/* Divider limits, from UG572 Table 3-4 for Ultrascale+ */
++#define DIV_O 0x01
++#define DIV_ALL 0x03
++
++#define WZRD_M_MIN 2
++#define WZRD_M_MAX 128
++#define WZRD_D_MIN 1
++#define WZRD_D_MAX 106
++#define WZRD_VCO_MIN 800000000
++#define WZRD_VCO_MAX 1600000000
++#define WZRD_O_MIN 1
++#define WZRD_O_MAX 128
++#define WZRD_MIN_ERR 20000
++#define WZRD_FRAC_POINTS 1000
++
+ /* Get the mask from width */
+ #define div_mask(width) ((1 << (width)) - 1)
+
+@@ -97,6 +116,9 @@ struct clk_wzrd {
+ * @width: width of the divider bit field
+ * @flags: clk_wzrd divider flags
+ * @table: array of value/divider pairs, last entry should have div = 0
++ * @m: value of the multiplier
++ * @d: value of the common divider
++ * @o: value of the leaf divider
+ * @lock: register lock
+ */
+ struct clk_wzrd_divider {
+@@ -107,6 +129,9 @@ struct clk_wzrd_divider {
+ u8 width;
+ u8 flags;
+ const struct clk_div_table *table;
++ u32 m;
++ u32 d;
++ u32 o;
+ spinlock_t *lock; /* divider lock */
+ };
+
+@@ -198,12 +223,155 @@ static long clk_wzrd_round_rate(struct clk_hw *hw, unsigned long rate,
+ return *prate / div;
+ }
+
++static int clk_wzrd_get_divisors(struct clk_hw *hw, unsigned long rate,
++ unsigned long parent_rate)
++{
++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw);
++ unsigned long vco_freq, freq, diff;
++ u32 m, d, o;
++
++ for (m = WZRD_M_MIN; m <= WZRD_M_MAX; m++) {
++ for (d = WZRD_D_MIN; d <= WZRD_D_MAX; d++) {
++ vco_freq = DIV_ROUND_CLOSEST((parent_rate * m), d);
++ if (vco_freq >= WZRD_VCO_MIN && vco_freq <= WZRD_VCO_MAX) {
++ for (o = WZRD_O_MIN; o <= WZRD_O_MAX; o++) {
++ freq = DIV_ROUND_CLOSEST_ULL(vco_freq, o);
++ diff = abs(freq - rate);
++
++ if (diff < WZRD_MIN_ERR) {
++ divider->m = m;
++ divider->d = d;
++ divider->o = o;
++ return 0;
++ }
++ }
++ }
++ }
++ }
++ return -EBUSY;
++}
++
++static int clk_wzrd_dynamic_all_nolock(struct clk_hw *hw, unsigned long rate,
++ unsigned long parent_rate)
++{
++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw);
++ unsigned long vco_freq, rate_div, clockout0_div;
++ u32 reg, pre, value, f;
++ int err;
++
++ err = clk_wzrd_get_divisors(hw, rate, parent_rate);
++ if (err)
++ return err;
++
++ vco_freq = DIV_ROUND_CLOSEST(parent_rate * divider->m, divider->d);
++ rate_div = DIV_ROUND_CLOSEST_ULL((vco_freq * WZRD_FRAC_POINTS), rate);
++
++ clockout0_div = div_u64(rate_div, WZRD_FRAC_POINTS);
++
++ pre = DIV_ROUND_CLOSEST_ULL(vco_freq * WZRD_FRAC_POINTS, rate);
++ f = (pre - (clockout0_div * WZRD_FRAC_POINTS));
++ f &= WZRD_CLKOUT_FRAC_MASK;
++
++ reg = FIELD_PREP(WZRD_CLKOUT_DIVIDE_MASK, clockout0_div) |
++ FIELD_PREP(WZRD_CLKOUT0_FRAC_MASK, f);
++
++ writel(reg, divider->base + WZRD_CLK_CFG_REG(2));
++ /* Set divisor and clear phase offset */
++ reg = FIELD_PREP(WZRD_CLKFBOUT_MULT_MASK, divider->m) |
++ FIELD_PREP(WZRD_DIVCLK_DIVIDE_MASK, divider->d);
++ writel(reg, divider->base + WZRD_CLK_CFG_REG(0));
++ writel(divider->o, divider->base + WZRD_CLK_CFG_REG(2));
++ writel(0, divider->base + WZRD_CLK_CFG_REG(3));
++ /* Check status register */
++ err = readl_poll_timeout(divider->base + WZRD_DR_STATUS_REG_OFFSET, value,
++ value & WZRD_DR_LOCK_BIT_MASK,
++ WZRD_USEC_POLL, WZRD_TIMEOUT_POLL);
++ if (err)
++ return -ETIMEDOUT;
++
++ /* Initiate reconfiguration */
++ writel(WZRD_DR_BEGIN_DYNA_RECONF,
++ divider->base + WZRD_DR_INIT_REG_OFFSET);
++
++ /* Check status register */
++ return readl_poll_timeout(divider->base + WZRD_DR_STATUS_REG_OFFSET, value,
++ value & WZRD_DR_LOCK_BIT_MASK,
++ WZRD_USEC_POLL, WZRD_TIMEOUT_POLL);
++}
++
++static int clk_wzrd_dynamic_all(struct clk_hw *hw, unsigned long rate,
++ unsigned long parent_rate)
++{
++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw);
++ unsigned long flags = 0;
++ int ret;
++
++ spin_lock_irqsave(divider->lock, flags);
++
++ ret = clk_wzrd_dynamic_all_nolock(hw, rate, parent_rate);
++
++ spin_unlock_irqrestore(divider->lock, flags);
++
++ return ret;
++}
++
++static unsigned long clk_wzrd_recalc_rate_all(struct clk_hw *hw,
++ unsigned long parent_rate)
++{
++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw);
++ u32 m, d, o, div, reg, f;
++
++ reg = readl(divider->base + WZRD_CLK_CFG_REG(0));
++ d = FIELD_GET(WZRD_DIVCLK_DIVIDE_MASK, reg);
++ m = FIELD_GET(WZRD_CLKFBOUT_MULT_MASK, reg);
++ reg = readl(divider->base + WZRD_CLK_CFG_REG(2));
++ o = FIELD_GET(WZRD_DIVCLK_DIVIDE_MASK, reg);
++ f = FIELD_GET(WZRD_CLKOUT0_FRAC_MASK, reg);
++
++ div = DIV_ROUND_CLOSEST(d * (WZRD_FRAC_POINTS * o + f), WZRD_FRAC_POINTS);
++ return divider_recalc_rate(hw, parent_rate * m, div, divider->table,
++ divider->flags, divider->width);
++}
++
++static long clk_wzrd_round_rate_all(struct clk_hw *hw, unsigned long rate,
++ unsigned long *prate)
++{
++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw);
++ unsigned long int_freq;
++ u32 m, d, o, div, f;
++ int err;
++
++ err = clk_wzrd_get_divisors(hw, rate, *prate);
++ if (err)
++ return err;
++
++ m = divider->m;
++ d = divider->d;
++ o = divider->o;
++
++ div = d * o;
++ int_freq = divider_recalc_rate(hw, *prate * m, div, divider->table,
++ divider->flags, divider->width);
++
++ if (rate > int_freq) {
++ f = DIV_ROUND_CLOSEST_ULL(rate * WZRD_FRAC_POINTS, int_freq);
++ rate = DIV_ROUND_CLOSEST(int_freq * f, WZRD_FRAC_POINTS);
++ }
++ return rate;
++}
++
+ static const struct clk_ops clk_wzrd_clk_divider_ops = {
+ .round_rate = clk_wzrd_round_rate,
+ .set_rate = clk_wzrd_dynamic_reconfig,
+ .recalc_rate = clk_wzrd_recalc_rate,
+ };
+
++static const struct clk_ops clk_wzrd_clk_div_all_ops = {
++ .round_rate = clk_wzrd_round_rate_all,
++ .set_rate = clk_wzrd_dynamic_all,
++ .recalc_rate = clk_wzrd_recalc_rate_all,
++};
++
+ static unsigned long clk_wzrd_recalc_ratef(struct clk_hw *hw,
+ unsigned long parent_rate)
+ {
+@@ -280,7 +448,7 @@ static struct clk *clk_wzrd_register_divf(struct device *dev,
+ void __iomem *base, u16 offset,
+ u8 shift, u8 width,
+ u8 clk_divider_flags,
+- const struct clk_div_table *table,
++ u32 div_type,
+ spinlock_t *lock)
+ {
+ struct clk_wzrd_divider *div;
+@@ -307,7 +475,6 @@ static struct clk *clk_wzrd_register_divf(struct device *dev,
+ div->flags = clk_divider_flags;
+ div->lock = lock;
+ div->hw.init = &init;
+- div->table = table;
+
+ hw = &div->hw;
+ ret = devm_clk_hw_register(dev, hw);
+@@ -324,7 +491,7 @@ static struct clk *clk_wzrd_register_divider(struct device *dev,
+ void __iomem *base, u16 offset,
+ u8 shift, u8 width,
+ u8 clk_divider_flags,
+- const struct clk_div_table *table,
++ u32 div_type,
+ spinlock_t *lock)
+ {
+ struct clk_wzrd_divider *div;
+@@ -337,7 +504,12 @@ static struct clk *clk_wzrd_register_divider(struct device *dev,
+ return ERR_PTR(-ENOMEM);
+
+ init.name = name;
+- init.ops = &clk_wzrd_clk_divider_ops;
++ if (clk_divider_flags & CLK_DIVIDER_READ_ONLY)
++ init.ops = &clk_divider_ro_ops;
++ else if (div_type == DIV_O)
++ init.ops = &clk_wzrd_clk_divider_ops;
++ else
++ init.ops = &clk_wzrd_clk_div_all_ops;
+ init.flags = flags;
+ init.parent_names = &parent_name;
+ init.num_parents = 1;
+@@ -349,7 +521,6 @@ static struct clk *clk_wzrd_register_divider(struct device *dev,
+ div->flags = clk_divider_flags;
+ div->lock = lock;
+ div->hw.init = &init;
+- div->table = table;
+
+ hw = &div->hw;
+ ret = devm_clk_hw_register(dev, hw);
+@@ -425,6 +596,7 @@ static int clk_wzrd_probe(struct platform_device *pdev)
+ const char *clk_name;
+ void __iomem *ctrl_reg;
+ struct clk_wzrd *clk_wzrd;
++ const char *clkout_name;
+ struct device_node *np = pdev->dev.of_node;
+ int nr_outputs;
+ unsigned long flags = 0;
+@@ -469,6 +641,26 @@ static int clk_wzrd_probe(struct platform_device *pdev)
+ goto err_disable_clk;
+ }
+
++ ret = of_property_read_u32(np, "xlnx,nr-outputs", &nr_outputs);
++ if (ret || nr_outputs > WZRD_NUM_OUTPUTS) {
++ ret = -EINVAL;
++ goto err_disable_clk;
++ }
++
++ clkout_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_out0", dev_name(&pdev->dev));
++ if (nr_outputs == 1) {
++ clk_wzrd->clkout[0] = clk_wzrd_register_divider
++ (&pdev->dev, clkout_name,
++ __clk_get_name(clk_wzrd->clk_in1), 0,
++ clk_wzrd->base, WZRD_CLK_CFG_REG(3),
++ WZRD_CLKOUT_DIVIDE_SHIFT,
++ WZRD_CLKOUT_DIVIDE_WIDTH,
++ CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
++ DIV_ALL, &clkwzrd_lock);
++
++ goto out;
++ }
++
+ reg = readl(clk_wzrd->base + WZRD_CLK_CFG_REG(0));
+ reg_f = reg & WZRD_CLKFBOUT_FRAC_MASK;
+ reg_f = reg_f >> WZRD_CLKFBOUT_FRAC_SHIFT;
+@@ -476,20 +668,11 @@ static int clk_wzrd_probe(struct platform_device *pdev)
+ reg = reg & WZRD_CLKFBOUT_MULT_MASK;
+ reg = reg >> WZRD_CLKFBOUT_MULT_SHIFT;
+ mult = (reg * 1000) + reg_f;
+- clk_name = kasprintf(GFP_KERNEL, "%s_mul", dev_name(&pdev->dev));
++ clk_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_mul", dev_name(&pdev->dev));
+ if (!clk_name) {
+ ret = -ENOMEM;
+ goto err_disable_clk;
+ }
+-
+- ret = of_property_read_u32(np, "xlnx,nr-outputs", &nr_outputs);
+- if (ret || nr_outputs > WZRD_NUM_OUTPUTS) {
+- ret = -EINVAL;
+- goto err_disable_clk;
+- }
+- if (nr_outputs == 1)
+- flags = CLK_SET_RATE_PARENT;
+-
+ clk_wzrd->clks_internal[wzrd_clk_mul] = clk_register_fixed_factor
+ (&pdev->dev, clk_name,
+ __clk_get_name(clk_wzrd->clk_in1),
+@@ -500,7 +683,7 @@ static int clk_wzrd_probe(struct platform_device *pdev)
+ goto err_disable_clk;
+ }
+
+- clk_name = kasprintf(GFP_KERNEL, "%s_mul_div", dev_name(&pdev->dev));
++ clk_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_mul_div", dev_name(&pdev->dev));
+ if (!clk_name) {
+ ret = -ENOMEM;
+ goto err_rm_int_clk;
+@@ -521,9 +704,8 @@ static int clk_wzrd_probe(struct platform_device *pdev)
+
+ /* register div per output */
+ for (i = nr_outputs - 1; i >= 0 ; i--) {
+- const char *clkout_name;
+-
+- clkout_name = kasprintf(GFP_KERNEL, "%s_out%d", dev_name(&pdev->dev), i);
++ clkout_name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
++ "%s_out%d", dev_name(&pdev->dev), i);
+ if (!clkout_name) {
+ ret = -ENOMEM;
+ goto err_rm_int_clk;
+@@ -537,7 +719,7 @@ static int clk_wzrd_probe(struct platform_device *pdev)
+ WZRD_CLKOUT_DIVIDE_SHIFT,
+ WZRD_CLKOUT_DIVIDE_WIDTH,
+ CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
+- NULL, &clkwzrd_lock);
++ DIV_O, &clkwzrd_lock);
+ else
+ clk_wzrd->clkout[i] = clk_wzrd_register_divider
+ (&pdev->dev, clkout_name,
+@@ -546,7 +728,7 @@ static int clk_wzrd_probe(struct platform_device *pdev)
+ WZRD_CLKOUT_DIVIDE_SHIFT,
+ WZRD_CLKOUT_DIVIDE_WIDTH,
+ CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
+- NULL, &clkwzrd_lock);
++ DIV_O, &clkwzrd_lock);
+ if (IS_ERR(clk_wzrd->clkout[i])) {
+ int j;
+
+@@ -559,8 +741,7 @@ static int clk_wzrd_probe(struct platform_device *pdev)
+ }
+ }
+
+- kfree(clk_name);
+-
++out:
+ clk_wzrd->clk_data.clks = clk_wzrd->clkout;
+ clk_wzrd->clk_data.clk_num = ARRAY_SIZE(clk_wzrd->clkout);
+ of_clk_add_provider(np, of_clk_src_onecell_get, &clk_wzrd->clk_data);
+@@ -585,7 +766,6 @@ static int clk_wzrd_probe(struct platform_device *pdev)
+ err_rm_int_clks:
+ clk_unregister(clk_wzrd->clks_internal[1]);
+ err_rm_int_clk:
+- kfree(clk_name);
+ clk_unregister(clk_wzrd->clks_internal[0]);
+ err_disable_clk:
+ clk_disable_unprepare(clk_wzrd->axi_clk);
+--
+2.39.2
+
--- /dev/null
+From 1497484de9ea811c66bf72fcb9f51bdb30de0a75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 06:56:11 +0000
+Subject: clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
+
+From: Feng Mingxi <m202271825@hust.edu.cn>
+
+[ Upstream commit 8b5bf64c89c7100c921bd807ba39b2eb003061ab ]
+
+Smatch reports:
+drivers/clocksource/timer-cadence-ttc.c:529 ttc_timer_probe()
+warn: 'timer_baseaddr' from of_iomap() not released on lines: 498,508,516.
+
+timer_baseaddr may have the problem of not being released after use,
+I replaced it with the devm_of_iomap() function and added the clk_put()
+function to cleanup the "clk_ce" and "clk_cs".
+
+Fixes: e932900a3279 ("arm: zynq: Use standard timer binding")
+Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error")
+Signed-off-by: Feng Mingxi <m202271825@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20230425065611.702917-1-m202271825@hust.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-cadence-ttc.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clocksource/timer-cadence-ttc.c b/drivers/clocksource/timer-cadence-ttc.c
+index 4efd0cf3b602d..0d52e28fea4de 100644
+--- a/drivers/clocksource/timer-cadence-ttc.c
++++ b/drivers/clocksource/timer-cadence-ttc.c
+@@ -486,10 +486,10 @@ static int __init ttc_timer_probe(struct platform_device *pdev)
+ * and use it. Note that the event timer uses the interrupt and it's the
+ * 2nd TTC hence the irq_of_parse_and_map(,1)
+ */
+- timer_baseaddr = of_iomap(timer, 0);
+- if (!timer_baseaddr) {
++ timer_baseaddr = devm_of_iomap(&pdev->dev, timer, 0, NULL);
++ if (IS_ERR(timer_baseaddr)) {
+ pr_err("ERROR: invalid timer base address\n");
+- return -ENXIO;
++ return PTR_ERR(timer_baseaddr);
+ }
+
+ irq = irq_of_parse_and_map(timer, 1);
+@@ -513,20 +513,27 @@ static int __init ttc_timer_probe(struct platform_device *pdev)
+ clk_ce = of_clk_get(timer, clksel);
+ if (IS_ERR(clk_ce)) {
+ pr_err("ERROR: timer input clock not found\n");
+- return PTR_ERR(clk_ce);
++ ret = PTR_ERR(clk_ce);
++ goto put_clk_cs;
+ }
+
+ ret = ttc_setup_clocksource(clk_cs, timer_baseaddr, timer_width);
+ if (ret)
+- return ret;
++ goto put_clk_ce;
+
+ ret = ttc_setup_clockevent(clk_ce, timer_baseaddr + 4, irq);
+ if (ret)
+- return ret;
++ goto put_clk_ce;
+
+ pr_info("%pOFn #0 at %p, irq=%d\n", timer, timer_baseaddr, irq);
+
+ return 0;
++
++put_clk_ce:
++ clk_put(clk_ce);
++put_clk_cs:
++ clk_put(clk_cs);
++ return ret;
+ }
+
+ static const struct of_device_id ttc_timer_of_match[] = {
+--
+2.39.2
+
--- /dev/null
+From e60ee600c082734943dec1116ae2e74c21073abe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 09:58:39 +0300
+Subject: cpufreq: intel_pstate: Fix energy_performance_preference for passive
+
+From: Tero Kristo <tero.kristo@linux.intel.com>
+
+[ Upstream commit 03f44ffb3d5be2fceda375d92c70ab6de4df7081 ]
+
+If the intel_pstate driver is set to passive mode, then writing the
+same value to the energy_performance_preference sysfs twice will fail.
+This is caused by the wrong return value used (index of the matched
+energy_perf_string), instead of the length of the passed in parameter.
+Fix by forcing the internal return value to zero when the same
+preference is passed in by user. This same issue is not present when
+active mode is used for the driver.
+
+Fixes: f6ebbcf08f37 ("cpufreq: intel_pstate: Implement passive mode with HWP enabled")
+Reported-by: Niklas Neronin <niklas.neronin@intel.com>
+Signed-off-by: Tero Kristo <tero.kristo@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/intel_pstate.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 6ff73c30769fa..818eb2503cdd5 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -837,6 +837,8 @@ static ssize_t store_energy_performance_preference(
+ err = cpufreq_start_governor(policy);
+ if (!ret)
+ ret = err;
++ } else {
++ ret = 0;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 48baee0a8045a9a4b117c3f67f9b341224c69766 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 19:00:05 +0200
+Subject: crypto: jitter - correct health test during initialization
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stephan Müller <smueller@chronox.de>
+
+[ Upstream commit d23659769ad1bf2cbafaa0efcbae20ef1a74f77e ]
+
+With the update of the permanent and intermittent health errors, the
+actual indicator for the health test indicates a potential error only
+for the one offending time stamp gathered in the current iteration
+round. The next iteration round will "overwrite" the health test result.
+
+Thus, the entropy collection loop in jent_gen_entropy checks for
+the health test failure upon each loop iteration. However, the
+initialization operation checked for the APT health test once for
+an APT window which implies it would not catch most errors.
+
+Thus, the check for all health errors is now invoked unconditionally
+during each loop iteration for the startup test.
+
+With the change, the error JENT_ERCT becomes unused as all health
+errors are only reported with the JENT_HEALTH return code. This
+allows the removal of the error indicator.
+
+Fixes: 3fde2fe99aa6 ("crypto: jitter - permanent and intermittent health errors"
+)
+Reported-by: Joachim Vandersmissen <git@jvdsn.com>
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/jitterentropy.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/crypto/jitterentropy.c b/crypto/jitterentropy.c
+index 22f48bf4c6f57..227cedfa4f0ae 100644
+--- a/crypto/jitterentropy.c
++++ b/crypto/jitterentropy.c
+@@ -117,7 +117,6 @@ struct rand_data {
+ * zero). */
+ #define JENT_ESTUCK 8 /* Too many stuck results during init. */
+ #define JENT_EHEALTH 9 /* Health test failed during initialization */
+-#define JENT_ERCT 10 /* RCT failed during initialization */
+
+ /*
+ * The output n bits can receive more than n bits of min entropy, of course,
+@@ -762,14 +761,12 @@ int jent_entropy_init(void)
+ if ((nonstuck % JENT_APT_WINDOW_SIZE) == 0) {
+ jent_apt_reset(&ec,
+ delta & JENT_APT_WORD_MASK);
+- if (jent_health_failure(&ec))
+- return JENT_EHEALTH;
+ }
+ }
+
+- /* Validate RCT */
+- if (jent_rct_failure(&ec))
+- return JENT_ERCT;
++ /* Validate health test result */
++ if (jent_health_failure(&ec))
++ return JENT_EHEALTH;
+
+ /* test whether we have an increasing timer */
+ if (!(time2 > time))
+--
+2.39.2
+
--- /dev/null
+From 719f6b203d4fa278388e71d412a054e81d714c2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Nov 2022 17:24:01 +0800
+Subject: crypto: kpp - Add helper to set reqsize
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 56861cbde1b9f3b34d300e6ba87f2c3de1a9c309 ]
+
+The value of reqsize should only be changed through a helper.
+To do so we need to first add a helper for this.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: eb7713f5ca97 ("crypto: qat - unmap buffer before free for DH")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/crypto/internal/kpp.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/include/crypto/internal/kpp.h b/include/crypto/internal/kpp.h
+index 9cb0662ebe871..31ff3c1986ef0 100644
+--- a/include/crypto/internal/kpp.h
++++ b/include/crypto/internal/kpp.h
+@@ -50,6 +50,12 @@ static inline void *kpp_request_ctx(struct kpp_request *req)
+ return req->__ctx;
+ }
+
++static inline void kpp_set_reqsize(struct crypto_kpp *kpp,
++ unsigned int reqsize)
++{
++ crypto_kpp_alg(kpp)->reqsize = reqsize;
++}
++
+ static inline void *kpp_tfm_ctx(struct crypto_kpp *tfm)
+ {
+ return tfm->base.__crt_ctx;
+--
+2.39.2
+
--- /dev/null
+From 9f29f880e1407141f0c40d9103c80ec497c4a4e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 10:33:04 +0200
+Subject: crypto: marvell/cesa - Fix type mismatch warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit efbc7764c4446566edb76ca05e903b5905673d2e ]
+
+Commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") uncovered
+a type mismatch in cesa 3des support that leads to a memcpy beyond the
+end of a structure:
+
+In function 'fortify_memcpy_chk',
+ inlined from 'mv_cesa_des3_ede_setkey' at drivers/crypto/marvell/cesa/cipher.c:307:2:
+include/linux/fortify-string.h:583:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
+ 583 | __write_overflow_field(p_size_field, size);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is probably harmless as the actual data that is copied has the correct
+type, but clearly worth fixing nonetheless.
+
+Fixes: 4ada48397823 ("crypto: marvell/cesa - add Triple-DES support")
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Gustavo A. R. Silva" <gustavoars@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/marvell/cesa/cipher.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/marvell/cesa/cipher.c b/drivers/crypto/marvell/cesa/cipher.c
+index c6f2fa753b7c0..0f37dfd42d850 100644
+--- a/drivers/crypto/marvell/cesa/cipher.c
++++ b/drivers/crypto/marvell/cesa/cipher.c
+@@ -297,7 +297,7 @@ static int mv_cesa_des_setkey(struct crypto_skcipher *cipher, const u8 *key,
+ static int mv_cesa_des3_ede_setkey(struct crypto_skcipher *cipher,
+ const u8 *key, unsigned int len)
+ {
+- struct mv_cesa_des_ctx *ctx = crypto_skcipher_ctx(cipher);
++ struct mv_cesa_des3_ctx *ctx = crypto_skcipher_ctx(cipher);
+ int err;
+
+ err = verify_skcipher_des3_key(cipher, key);
+--
+2.39.2
+
--- /dev/null
+From 6036f2b3eea6d00a6ce11cff03529f3d79df5662 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 May 2023 15:33:34 -0700
+Subject: crypto: nx - fix build warnings when DEBUG_FS is not enabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit b04b076fb56560b39d695ac3744db457e12278fd ]
+
+Fix build warnings when DEBUG_FS is not enabled by using an empty
+do-while loop instead of a value:
+
+In file included from ../drivers/crypto/nx/nx.c:27:
+../drivers/crypto/nx/nx.c: In function 'nx_register_algs':
+../drivers/crypto/nx/nx.h:173:33: warning: statement with no effect [-Wunused-value]
+ 173 | #define NX_DEBUGFS_INIT(drv) (0)
+../drivers/crypto/nx/nx.c:573:9: note: in expansion of macro 'NX_DEBUGFS_INIT'
+ 573 | NX_DEBUGFS_INIT(&nx_driver);
+../drivers/crypto/nx/nx.c: In function 'nx_remove':
+../drivers/crypto/nx/nx.h:174:33: warning: statement with no effect [-Wunused-value]
+ 174 | #define NX_DEBUGFS_FINI(drv) (0)
+../drivers/crypto/nx/nx.c:793:17: note: in expansion of macro 'NX_DEBUGFS_FINI'
+ 793 | NX_DEBUGFS_FINI(&nx_driver);
+
+Also, there is no need to build nx_debugfs.o when DEBUG_FS is not
+enabled, so change the Makefile to accommodate that.
+
+Fixes: ae0222b7289d ("powerpc/crypto: nx driver code supporting nx encryption")
+Fixes: aef7b31c8833 ("powerpc/crypto: Build files for the nx device driver")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Breno Leitão <leitao@debian.org>
+Cc: Nayna Jain <nayna@linux.ibm.com>
+Cc: Paulo Flabiano Smorigo <pfsmorigo@gmail.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: linux-crypto@vger.kernel.org
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: linuxppc-dev@lists.ozlabs.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/nx/Makefile | 2 +-
+ drivers/crypto/nx/nx.h | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/nx/Makefile b/drivers/crypto/nx/Makefile
+index d00181a26dd65..483cef62acee8 100644
+--- a/drivers/crypto/nx/Makefile
++++ b/drivers/crypto/nx/Makefile
+@@ -1,7 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-$(CONFIG_CRYPTO_DEV_NX_ENCRYPT) += nx-crypto.o
+ nx-crypto-objs := nx.o \
+- nx_debugfs.o \
+ nx-aes-cbc.o \
+ nx-aes-ecb.o \
+ nx-aes-gcm.o \
+@@ -11,6 +10,7 @@ nx-crypto-objs := nx.o \
+ nx-sha256.o \
+ nx-sha512.o
+
++nx-crypto-$(CONFIG_DEBUG_FS) += nx_debugfs.o
+ obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_PSERIES) += nx-compress-pseries.o nx-compress.o
+ obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_POWERNV) += nx-compress-powernv.o nx-compress.o
+ nx-compress-objs := nx-842.o
+diff --git a/drivers/crypto/nx/nx.h b/drivers/crypto/nx/nx.h
+index c6233173c612e..2697baebb6a35 100644
+--- a/drivers/crypto/nx/nx.h
++++ b/drivers/crypto/nx/nx.h
+@@ -170,8 +170,8 @@ struct nx_sg *nx_walk_and_build(struct nx_sg *, unsigned int,
+ void nx_debugfs_init(struct nx_crypto_driver *);
+ void nx_debugfs_fini(struct nx_crypto_driver *);
+ #else
+-#define NX_DEBUGFS_INIT(drv) (0)
+-#define NX_DEBUGFS_FINI(drv) (0)
++#define NX_DEBUGFS_INIT(drv) do {} while (0)
++#define NX_DEBUGFS_FINI(drv) do {} while (0)
+ #endif
+
+ #define NX_PAGE_NUM(x) ((u64)(x) & 0xfffffffffffff000ULL)
+--
+2.39.2
+
--- /dev/null
+From 3ee6cda143d2622ec2d29a7c065d883b95c17c03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jun 2023 22:06:06 +0100
+Subject: crypto: qat - unmap buffer before free for DH
+
+From: Hareshx Sankar Raj <hareshx.sankar.raj@intel.com>
+
+[ Upstream commit eb7713f5ca97697b92f225127440d1525119b8de ]
+
+The callback function for DH frees the memory allocated for the
+destination buffer before unmapping it.
+This sequence is wrong.
+
+Change the cleanup sequence to unmap the buffer before freeing it.
+
+Fixes: 029aa4624a7f ("crypto: qat - remove dma_free_coherent() for DH")
+Signed-off-by: Hareshx Sankar Raj <hareshx.sankar.raj@intel.com>
+Co-developed-by: Bolemx Sivanagaleela <bolemx.sivanagaleela@intel.com>
+Signed-off-by: Bolemx Sivanagaleela <bolemx.sivanagaleela@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/qat_asym_algs.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c
+index 935a7e012946e..8806242469a06 100644
+--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c
++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c
+@@ -170,15 +170,14 @@ static void qat_dh_cb(struct icp_qat_fw_pke_resp *resp)
+ }
+
+ areq->dst_len = req->ctx.dh->p_size;
++ dma_unmap_single(dev, req->out.dh.r, req->ctx.dh->p_size,
++ DMA_FROM_DEVICE);
+ if (req->dst_align) {
+ scatterwalk_map_and_copy(req->dst_align, areq->dst, 0,
+ areq->dst_len, 1);
+ kfree_sensitive(req->dst_align);
+ }
+
+- dma_unmap_single(dev, req->out.dh.r, req->ctx.dh->p_size,
+- DMA_FROM_DEVICE);
+-
+ dma_unmap_single(dev, req->phy_in, sizeof(struct qat_dh_input_params),
+ DMA_TO_DEVICE);
+ dma_unmap_single(dev, req->phy_out,
+--
+2.39.2
+
--- /dev/null
+From a173a0a92a2177a71d3362f21c8f3ef345effc05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jun 2023 22:06:07 +0100
+Subject: crypto: qat - unmap buffers before free for RSA
+
+From: Hareshx Sankar Raj <hareshx.sankar.raj@intel.com>
+
+[ Upstream commit d776b25495f2c71b9dbf1f5e53b642215ba72f3c ]
+
+The callback function for RSA frees the memory allocated for the source
+and destination buffers before unmapping them.
+This sequence is wrong.
+
+Change the cleanup sequence to unmap the buffers before freeing them.
+
+Fixes: 3dfaf0071ed7 ("crypto: qat - remove dma_free_coherent() for RSA")
+Signed-off-by: Hareshx Sankar Raj <hareshx.sankar.raj@intel.com>
+Co-developed-by: Bolemx Sivanagaleela <bolemx.sivanagaleela@intel.com>
+Signed-off-by: Bolemx Sivanagaleela <bolemx.sivanagaleela@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/qat_asym_algs.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c
+index 8806242469a06..4128200a90329 100644
+--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c
++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c
+@@ -520,12 +520,14 @@ static void qat_rsa_cb(struct icp_qat_fw_pke_resp *resp)
+
+ err = (err == ICP_QAT_FW_COMN_STATUS_FLAG_OK) ? 0 : -EINVAL;
+
+- kfree_sensitive(req->src_align);
+-
+ dma_unmap_single(dev, req->in.rsa.enc.m, req->ctx.rsa->key_sz,
+ DMA_TO_DEVICE);
+
++ kfree_sensitive(req->src_align);
++
+ areq->dst_len = req->ctx.rsa->key_sz;
++ dma_unmap_single(dev, req->out.rsa.enc.c, req->ctx.rsa->key_sz,
++ DMA_FROM_DEVICE);
+ if (req->dst_align) {
+ scatterwalk_map_and_copy(req->dst_align, areq->dst, 0,
+ areq->dst_len, 1);
+@@ -533,9 +535,6 @@ static void qat_rsa_cb(struct icp_qat_fw_pke_resp *resp)
+ kfree_sensitive(req->dst_align);
+ }
+
+- dma_unmap_single(dev, req->out.rsa.enc.c, req->ctx.rsa->key_sz,
+- DMA_FROM_DEVICE);
+-
+ dma_unmap_single(dev, req->phy_in, sizeof(struct qat_rsa_input_params),
+ DMA_TO_DEVICE);
+ dma_unmap_single(dev, req->phy_out,
+--
+2.39.2
+
--- /dev/null
+From 063378c119809e0a4265e5f485a1f8c34b8a6a42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Nov 2022 17:30:58 +0800
+Subject: crypto: qat - Use helper to set reqsize
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 80e62ad58db084920d8cf23323b713391e09f374 ]
+
+The value of reqsize must only be changed through the helper.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: eb7713f5ca97 ("crypto: qat - unmap buffer before free for DH")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/qat_asym_algs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c
+index 94a26702aeae1..935a7e012946e 100644
+--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c
++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c
+@@ -494,6 +494,8 @@ static int qat_dh_init_tfm(struct crypto_kpp *tfm)
+ if (!inst)
+ return -EINVAL;
+
++ kpp_set_reqsize(tfm, sizeof(struct qat_asym_request) + 64);
++
+ ctx->p_size = 0;
+ ctx->g2 = false;
+ ctx->inst = inst;
+@@ -1230,6 +1232,8 @@ static int qat_rsa_init_tfm(struct crypto_akcipher *tfm)
+ if (!inst)
+ return -EINVAL;
+
++ akcipher_set_reqsize(tfm, sizeof(struct qat_asym_request) + 64);
++
+ ctx->key_sz = 0;
+ ctx->inst = inst;
+ return 0;
+@@ -1252,7 +1256,6 @@ static struct akcipher_alg rsa = {
+ .max_size = qat_rsa_max_size,
+ .init = qat_rsa_init_tfm,
+ .exit = qat_rsa_exit_tfm,
+- .reqsize = sizeof(struct qat_asym_request) + 64,
+ .base = {
+ .cra_name = "rsa",
+ .cra_driver_name = "qat-rsa",
+@@ -1269,7 +1272,6 @@ static struct kpp_alg dh = {
+ .max_size = qat_dh_max_size,
+ .init = qat_dh_init_tfm,
+ .exit = qat_dh_exit_tfm,
+- .reqsize = sizeof(struct qat_asym_request) + 64,
+ .base = {
+ .cra_name = "dh",
+ .cra_driver_name = "qat-dh",
+--
+2.39.2
+
--- /dev/null
+From 61185accba86b3d0ca934207f6131723f9d31c20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 23:13:54 -0700
+Subject: dax: Fix dax_mapping_release() use after free
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+[ Upstream commit 6d24b170a9db0456f577b1ab01226a2254c016a8 ]
+
+A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region
+provider (like modprobe -r dax_hmem) yields:
+
+ kobject: 'mapping0' (ffff93eb460e8800): kobject_release, parent 0000000000000000 (delayed 2000)
+ [..]
+ DEBUG_LOCKS_WARN_ON(1)
+ WARNING: CPU: 23 PID: 282 at kernel/locking/lockdep.c:232 __lock_acquire+0x9fc/0x2260
+ [..]
+ RIP: 0010:__lock_acquire+0x9fc/0x2260
+ [..]
+ Call Trace:
+ <TASK>
+ [..]
+ lock_acquire+0xd4/0x2c0
+ ? ida_free+0x62/0x130
+ _raw_spin_lock_irqsave+0x47/0x70
+ ? ida_free+0x62/0x130
+ ida_free+0x62/0x130
+ dax_mapping_release+0x1f/0x30
+ device_release+0x36/0x90
+ kobject_delayed_cleanup+0x46/0x150
+
+Due to attempting ida_free() on an ida object that has already been
+freed. Devices typically only hold a reference on their parent while
+registered. If a child needs a parent object to complete its release it
+needs to hold a reference that it drops from its release callback.
+Arrange for a dax_mapping to pin its parent dev_dax instance until
+dax_mapping_release().
+
+Fixes: 0b07ce872a9e ("device-dax: introduce 'mapping' devices")
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Link: https://lore.kernel.org/r/168577283412.1672036.16111545266174261446.stgit@dwillia2-xfh.jf.intel.com
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Fan Ni <fan.ni@samsung.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dax/bus.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
+index c64e7076537cb..d7a838f651813 100644
+--- a/drivers/dax/bus.c
++++ b/drivers/dax/bus.c
+@@ -621,10 +621,12 @@ EXPORT_SYMBOL_GPL(alloc_dax_region);
+ static void dax_mapping_release(struct device *dev)
+ {
+ struct dax_mapping *mapping = to_dax_mapping(dev);
+- struct dev_dax *dev_dax = to_dev_dax(dev->parent);
++ struct device *parent = dev->parent;
++ struct dev_dax *dev_dax = to_dev_dax(parent);
+
+ ida_free(&dev_dax->ida, mapping->id);
+ kfree(mapping);
++ put_device(parent);
+ }
+
+ static void unregister_dax_mapping(void *data)
+@@ -764,6 +766,7 @@ static int devm_register_dax_mapping(struct dev_dax *dev_dax, int range_id)
+ dev = &mapping->dev;
+ device_initialize(dev);
+ dev->parent = &dev_dax->dev;
++ get_device(dev->parent);
+ dev->type = &dax_mapping_type;
+ dev_set_name(dev, "mapping%d", mapping->id);
+ rc = device_add(dev);
+--
+2.39.2
+
--- /dev/null
+From 9672eb534c3fa9eaa7b23cf6627ef935bd6dc78e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 23:14:05 -0700
+Subject: dax: Introduce alloc_dev_dax_id()
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+[ Upstream commit 70aab281e18c68a1284bc387de127c2fc0bed3f8 ]
+
+The reference counting of dax_region objects is needlessly complicated,
+has lead to confusion [1], and has hidden a bug [2]. Towards cleaning up
+that mess introduce alloc_dev_dax_id() to minimize the holding of a
+dax_region reference to only what dev_dax_release() needs, the
+dax_region->ida.
+
+Part of the reason for the mess was the design to dereference a
+dax_region in all cases in free_dev_dax_id() even if the id was
+statically assigned by the upper level dax_region driver. Remove the
+need to call "is_static(dax_region)" by tracking whether the id is
+dynamic directly in the dev_dax instance itself.
+
+With that flag the dax_region pinning and release per dev_dax instance
+can move to alloc_dev_dax_id() and free_dev_dax_id() respectively.
+
+A follow-on cleanup address the unnecessary references in the dax_region
+setup and drivers.
+
+Fixes: 0f3da14a4f05 ("device-dax: introduce 'seed' devices")
+Link: http://lore.kernel.org/r/20221203095858.612027-1-liuyongqiang13@huawei.com [1]
+Link: http://lore.kernel.org/r/3cf0890b-4eb0-e70e-cd9c-2ecc3d496263@hpe.com [2]
+Reported-by: Yongqiang Liu <liuyongqiang13@huawei.com>
+Reported-by: Paul Cassella <cassella@hpe.com>
+Reported-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Link: https://lore.kernel.org/r/168577284563.1672036.13493034988900989554.stgit@dwillia2-xfh.jf.intel.com
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dax/bus.c | 56 ++++++++++++++++++++++++---------------
+ drivers/dax/dax-private.h | 4 ++-
+ 2 files changed, 37 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
+index d7a838f651813..3a9348c7f7289 100644
+--- a/drivers/dax/bus.c
++++ b/drivers/dax/bus.c
+@@ -432,18 +432,34 @@ static void unregister_dev_dax(void *dev)
+ put_device(dev);
+ }
+
++static void dax_region_free(struct kref *kref)
++{
++ struct dax_region *dax_region;
++
++ dax_region = container_of(kref, struct dax_region, kref);
++ kfree(dax_region);
++}
++
++void dax_region_put(struct dax_region *dax_region)
++{
++ kref_put(&dax_region->kref, dax_region_free);
++}
++EXPORT_SYMBOL_GPL(dax_region_put);
++
+ /* a return value >= 0 indicates this invocation invalidated the id */
+ static int __free_dev_dax_id(struct dev_dax *dev_dax)
+ {
+- struct dax_region *dax_region = dev_dax->region;
+ struct device *dev = &dev_dax->dev;
++ struct dax_region *dax_region;
+ int rc = dev_dax->id;
+
+ device_lock_assert(dev);
+
+- if (is_static(dax_region) || dev_dax->id < 0)
++ if (!dev_dax->dyn_id || dev_dax->id < 0)
+ return -1;
++ dax_region = dev_dax->region;
+ ida_free(&dax_region->ida, dev_dax->id);
++ dax_region_put(dax_region);
+ dev_dax->id = -1;
+ return rc;
+ }
+@@ -459,6 +475,20 @@ static int free_dev_dax_id(struct dev_dax *dev_dax)
+ return rc;
+ }
+
++static int alloc_dev_dax_id(struct dev_dax *dev_dax)
++{
++ struct dax_region *dax_region = dev_dax->region;
++ int id;
++
++ id = ida_alloc(&dax_region->ida, GFP_KERNEL);
++ if (id < 0)
++ return id;
++ kref_get(&dax_region->kref);
++ dev_dax->dyn_id = true;
++ dev_dax->id = id;
++ return id;
++}
++
+ static ssize_t delete_store(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t len)
+ {
+@@ -546,20 +576,6 @@ static const struct attribute_group *dax_region_attribute_groups[] = {
+ NULL,
+ };
+
+-static void dax_region_free(struct kref *kref)
+-{
+- struct dax_region *dax_region;
+-
+- dax_region = container_of(kref, struct dax_region, kref);
+- kfree(dax_region);
+-}
+-
+-void dax_region_put(struct dax_region *dax_region)
+-{
+- kref_put(&dax_region->kref, dax_region_free);
+-}
+-EXPORT_SYMBOL_GPL(dax_region_put);
+-
+ static void dax_region_unregister(void *region)
+ {
+ struct dax_region *dax_region = region;
+@@ -1284,12 +1300,10 @@ static const struct attribute_group *dax_attribute_groups[] = {
+ static void dev_dax_release(struct device *dev)
+ {
+ struct dev_dax *dev_dax = to_dev_dax(dev);
+- struct dax_region *dax_region = dev_dax->region;
+ struct dax_device *dax_dev = dev_dax->dax_dev;
+
+ put_dax(dax_dev);
+ free_dev_dax_id(dev_dax);
+- dax_region_put(dax_region);
+ kfree(dev_dax->pgmap);
+ kfree(dev_dax);
+ }
+@@ -1313,6 +1327,7 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
+ if (!dev_dax)
+ return ERR_PTR(-ENOMEM);
+
++ dev_dax->region = dax_region;
+ if (is_static(dax_region)) {
+ if (dev_WARN_ONCE(parent, data->id < 0,
+ "dynamic id specified to static region\n")) {
+@@ -1328,13 +1343,11 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
+ goto err_id;
+ }
+
+- rc = ida_alloc(&dax_region->ida, GFP_KERNEL);
++ rc = alloc_dev_dax_id(dev_dax);
+ if (rc < 0)
+ goto err_id;
+- dev_dax->id = rc;
+ }
+
+- dev_dax->region = dax_region;
+ dev = &dev_dax->dev;
+ device_initialize(dev);
+ dev_set_name(dev, "dax%d.%d", dax_region->id, dev_dax->id);
+@@ -1375,7 +1388,6 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
+ dev_dax->target_node = dax_region->target_node;
+ dev_dax->align = dax_region->align;
+ ida_init(&dev_dax->ida);
+- kref_get(&dax_region->kref);
+
+ inode = dax_inode(dax_dev);
+ dev->devt = inode->i_rdev;
+diff --git a/drivers/dax/dax-private.h b/drivers/dax/dax-private.h
+index 1c974b7caae6e..afcada6fd2eda 100644
+--- a/drivers/dax/dax-private.h
++++ b/drivers/dax/dax-private.h
+@@ -52,7 +52,8 @@ struct dax_mapping {
+ * @region - parent region
+ * @dax_dev - core dax functionality
+ * @target_node: effective numa node if dev_dax memory range is onlined
+- * @id: ida allocated id
++ * @dyn_id: is this a dynamic or statically created instance
++ * @id: ida allocated id when the dax_region is not static
+ * @ida: mapping id allocator
+ * @dev - device core
+ * @pgmap - pgmap for memmap setup / lifetime (driver owned)
+@@ -64,6 +65,7 @@ struct dev_dax {
+ struct dax_device *dax_dev;
+ unsigned int align;
+ int target_node;
++ bool dyn_id;
+ int id;
+ struct ida ida;
+ struct device dev;
+--
+2.39.2
+
--- /dev/null
+From 040f7d54a28a43ef933bfe171623ef121ded9c96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 21:20:25 +0530
+Subject: dax/kmem: Pass valid argument to memory_group_register_static
+
+From: Tarun Sahu <tsahu@linux.ibm.com>
+
+[ Upstream commit 46e66dab8565f742374e9cc4ff7d35f344d774e2 ]
+
+memory_group_register_static takes maximum number of pages as the argument
+while dev_dax_kmem_probe passes total_len (in bytes) as the argument.
+
+IIUC, I don't see any crash/panic impact as such. As,
+memory_group_register_static just set the max_pages limit which is used in
+auto_movable_zone_for_pfn to determine the zone.
+
+which might cause these condition to behave differently,
+
+This will be true always so jump will happen to kernel_zone
+ ...
+ if (!auto_movable_can_online_movable(NUMA_NO_NODE, group, nr_pages))
+ goto kernel_zone;
+
+ ...
+ kernel_zone:
+ return default_kernel_zone_for_pfn(nid, pfn, nr_pages);
+
+Here, In below, zone_intersects compare range will be larger as nr_pages
+will be higher (derived from total_len passed in dev_dax_kmem_probe).
+
+ ...
+ static struct zone *default_kernel_zone_for_pfn(int nid, unsigned long start_pfn,
+ unsigned long nr_pages)
+ {
+ struct pglist_data *pgdat = NODE_DATA(nid);
+ int zid;
+
+ for (zid = 0; zid < ZONE_NORMAL; zid++) {
+ struct zone *zone = &pgdat->node_zones[zid];
+
+ if (zone_intersects(zone, start_pfn, nr_pages))
+ return zone;
+ }
+
+ return &pgdat->node_zones[ZONE_NORMAL];
+ }
+
+Incorrect zone will be returned here, which in later time might cause bigger
+problem.
+
+Fixes: eedf634aac3b ("dax/kmem: use a single static memory group for a single probed unit")
+Signed-off-by: Tarun Sahu <tsahu@linux.ibm.com>
+Link: https://lore.kernel.org/r/20230621155025.370672-1-tsahu@linux.ibm.com
+Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dax/kmem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dax/kmem.c b/drivers/dax/kmem.c
+index 4aa758a2b3d1b..1a33616ceb06e 100644
+--- a/drivers/dax/kmem.c
++++ b/drivers/dax/kmem.c
+@@ -99,7 +99,7 @@ static int dev_dax_kmem_probe(struct dev_dax *dev_dax)
+ if (!data->res_name)
+ goto err_res_name;
+
+- rc = memory_group_register_static(numa_node, total_len);
++ rc = memory_group_register_static(numa_node, PFN_UP(total_len));
+ if (rc < 0)
+ goto err_reg_mgid;
+ data->mgid = rc;
+--
+2.39.2
+
--- /dev/null
+From ebf5fc2c46406589af0478d16556ed43f5489f3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 13:44:54 +0300
+Subject: driver: soc: xilinx: use _safe loop iterator to avoid a use after
+ free
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit c58da0ba3e5c86e51e2c1557afaf6f71e00c4533 ]
+
+The hash_for_each_possible() loop dereferences "eve_data" to get the
+next item on the list. However the loop frees eve_data so it leads to
+a use after free. Use hash_for_each_possible_safe() instead.
+
+Fixes: c7fdb2404f66 ("drivers: soc: xilinx: add xilinx event management driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/761e0e4a-4caf-4a71-8f47-1c6ad908a848@kili.mountain
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/xilinx/xlnx_event_manager.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c
+index c76381899ef49..f9d9b82b562da 100644
+--- a/drivers/soc/xilinx/xlnx_event_manager.c
++++ b/drivers/soc/xilinx/xlnx_event_manager.c
+@@ -192,11 +192,12 @@ static int xlnx_remove_cb_for_suspend(event_cb_func_t cb_fun)
+ struct registered_event_data *eve_data;
+ struct agent_cb *cb_pos;
+ struct agent_cb *cb_next;
++ struct hlist_node *tmp;
+
+ is_need_to_unregister = false;
+
+ /* Check for existing entry in hash table for given cb_type */
+- hash_for_each_possible(reg_driver_map, eve_data, hentry, PM_INIT_SUSPEND_CB) {
++ hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, PM_INIT_SUSPEND_CB) {
+ if (eve_data->cb_type == PM_INIT_SUSPEND_CB) {
+ /* Delete the list of callback */
+ list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) {
+@@ -228,11 +229,12 @@ static int xlnx_remove_cb_for_notify_event(const u32 node_id, const u32 event,
+ u64 key = ((u64)node_id << 32U) | (u64)event;
+ struct agent_cb *cb_pos;
+ struct agent_cb *cb_next;
++ struct hlist_node *tmp;
+
+ is_need_to_unregister = false;
+
+ /* Check for existing entry in hash table for given key id */
+- hash_for_each_possible(reg_driver_map, eve_data, hentry, key) {
++ hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, key) {
+ if (eve_data->key == key) {
+ /* Delete the list of callback */
+ list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) {
+--
+2.39.2
+
--- /dev/null
+From 1b57a7a686a7ab56d170153b58c21e92afe2b629 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jun 2023 12:04:14 +0300
+Subject: drivers: meson: secure-pwrc: always enable DMA domain
+
+From: Alexey Romanov <avromanov@sberdevices.ru>
+
+[ Upstream commit 0bb4644d583789c97e74d3e3047189f0c59c4742 ]
+
+Starting from commit e45f243409db ("firmware: meson_sm:
+populate platform devices from sm device tree data") pwrc
+is probed successfully and disables unused pwr domains.
+By A1 SoC family design, any TEE requires DMA pwr domain
+always enabled.
+
+Fixes: b3dde5013e13 ("soc: amlogic: Add support for Secure power domains controller")
+Signed-off-by: Alexey Romanov <avromanov@sberdevices.ru>
+Acked-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20230610090414.90529-1-avromanov@sberdevices.ru
+[narmstrong: added fixes tag]
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/amlogic/meson-secure-pwrc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/amlogic/meson-secure-pwrc.c b/drivers/soc/amlogic/meson-secure-pwrc.c
+index e935187635267..25b4b71df9b89 100644
+--- a/drivers/soc/amlogic/meson-secure-pwrc.c
++++ b/drivers/soc/amlogic/meson-secure-pwrc.c
+@@ -105,7 +105,7 @@ static struct meson_secure_pwrc_domain_desc a1_pwrc_domains[] = {
+ SEC_PD(ACODEC, 0),
+ SEC_PD(AUDIO, 0),
+ SEC_PD(OTP, 0),
+- SEC_PD(DMA, 0),
++ SEC_PD(DMA, GENPD_FLAG_ALWAYS_ON | GENPD_FLAG_IRQ_SAFE),
+ SEC_PD(SD_EMMC, 0),
+ SEC_PD(RAMA, 0),
+ /* SRAMB is used as ATF runtime memory, and should be always on */
+--
+2.39.2
+
--- /dev/null
+From 5ec63bf0d030098ff0be68f5a89bee45dcd3646c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jun 2023 19:43:26 +0800
+Subject: drivers/perf: hisi: Don't migrate perf to the CPU going to teardown
+
+From: Junhao He <hejunhao3@huawei.com>
+
+[ Upstream commit 7a6a9f1c5a0a875a421db798d4b2ee022dc1ee1a ]
+
+The driver needs to migrate the perf context if the current using CPU going
+to teardown. By the time calling the cpuhp::teardown() callback the
+cpu_online_mask() hasn't updated yet and still includes the CPU going to
+teardown. In current driver's implementation we may migrate the context
+to the teardown CPU and leads to the below calltrace:
+
+...
+[ 368.104662][ T932] task:cpuhp/0 state:D stack: 0 pid: 15 ppid: 2 flags:0x00000008
+[ 368.113699][ T932] Call trace:
+[ 368.116834][ T932] __switch_to+0x7c/0xbc
+[ 368.120924][ T932] __schedule+0x338/0x6f0
+[ 368.125098][ T932] schedule+0x50/0xe0
+[ 368.128926][ T932] schedule_preempt_disabled+0x18/0x24
+[ 368.134229][ T932] __mutex_lock.constprop.0+0x1d4/0x5dc
+[ 368.139617][ T932] __mutex_lock_slowpath+0x1c/0x30
+[ 368.144573][ T932] mutex_lock+0x50/0x60
+[ 368.148579][ T932] perf_pmu_migrate_context+0x84/0x2b0
+[ 368.153884][ T932] hisi_pcie_pmu_offline_cpu+0x90/0xe0 [hisi_pcie_pmu]
+[ 368.160579][ T932] cpuhp_invoke_callback+0x2a0/0x650
+[ 368.165707][ T932] cpuhp_thread_fun+0xe4/0x190
+[ 368.170316][ T932] smpboot_thread_fn+0x15c/0x1a0
+[ 368.175099][ T932] kthread+0x108/0x13c
+[ 368.179012][ T932] ret_from_fork+0x10/0x18
+...
+
+Use function cpumask_any_but() to find one correct active cpu to fixes
+this issue.
+
+Fixes: 8404b0fbc7fb ("drivers/perf: hisi: Add driver for HiSilicon PCIe PMU")
+Signed-off-by: Junhao He <hejunhao3@huawei.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Reviewed-by: Yicong Yang <yangyicong@hisilicon.com>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Link: https://lore.kernel.org/r/20230608114326.27649-1-hejunhao3@huawei.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/hisilicon/hisi_pcie_pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c
+index 071e63d9a9ac6..b61f1f9aba214 100644
+--- a/drivers/perf/hisilicon/hisi_pcie_pmu.c
++++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c
+@@ -672,7 +672,7 @@ static int hisi_pcie_pmu_offline_cpu(unsigned int cpu, struct hlist_node *node)
+
+ pcie_pmu->on_cpu = -1;
+ /* Choose a new CPU from all online cpus. */
+- target = cpumask_first(cpu_online_mask);
++ target = cpumask_any_but(cpu_online_mask, cpu);
+ if (target >= nr_cpu_ids) {
+ pci_err(pcie_pmu->pdev, "There is no CPU to set\n");
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 29b580e92454a2df5563472d92b3fd944fe35bf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 07:40:44 -0300
+Subject: drm: Add fixed-point helper to get rounded integer values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+[ Upstream commit 8b25320887d7feac98875546ea0f521628b745bb ]
+
+Create a new fixed-point helper to allow us to return the rounded value
+of our fixed point value.
+
+[v2]:
+ * Create the function drm_fixp2int_round() (Melissa Wen).
+[v3]:
+ * Use drm_fixp2int() instead of shifting manually (Arthur Grillo).
+
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Reviewed-by: Arthur Grillo <arthurgrillo@riseup.net>
+Signed-off-by: Maíra Canal <mairacanal@riseup.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230512104044.65034-1-mcanal@igalia.com
+Stable-dep-of: ab87f558dcfb ("drm/vkms: Fix RGB565 pixel conversion")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_fixed.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h
+index 553210c02ee0f..03cb890690e83 100644
+--- a/include/drm/drm_fixed.h
++++ b/include/drm/drm_fixed.h
+@@ -70,6 +70,7 @@ static inline u32 dfixed_div(fixed20_12 A, fixed20_12 B)
+ }
+
+ #define DRM_FIXED_POINT 32
++#define DRM_FIXED_POINT_HALF 16
+ #define DRM_FIXED_ONE (1ULL << DRM_FIXED_POINT)
+ #define DRM_FIXED_DECIMAL_MASK (DRM_FIXED_ONE - 1)
+ #define DRM_FIXED_DIGITS_MASK (~DRM_FIXED_DECIMAL_MASK)
+@@ -86,6 +87,11 @@ static inline int drm_fixp2int(s64 a)
+ return ((s64)a) >> DRM_FIXED_POINT;
+ }
+
++static inline int drm_fixp2int_round(s64 a)
++{
++ return drm_fixp2int(a + (1 << (DRM_FIXED_POINT_HALF - 1)));
++}
++
+ static inline int drm_fixp2int_ceil(s64 a)
+ {
+ if (a > 0)
+--
+2.39.2
+
--- /dev/null
+From ba962212f2877a1f0ef8121bfa90a1b4e645aa02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jun 2020 11:49:16 -0400
+Subject: drm/amd/display: Add logging for display MALL refresh setting
+
+From: Wesley Chalmers <Wesley.Chalmers@amd.com>
+
+[ Upstream commit cd8f067a46d34dee3188da184912ae3d64d98444 ]
+
+[WHY]
+Add log entry for when display refresh from MALL
+settings are sent to SMU.
+
+Fixes: 1664641ea946 ("drm/amd/display: Add logger for SMU msg")
+Signed-off-by: Wesley Chalmers <Wesley.Chalmers@amd.com>
+Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c
+index 1fbf1c105dc12..bdbf183066981 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c
+@@ -312,6 +312,9 @@ void dcn30_smu_set_display_refresh_from_mall(struct clk_mgr_internal *clk_mgr, b
+ /* bits 8:7 for cache timer scale, bits 6:1 for cache timer delay, bit 0 = 1 for enable, = 0 for disable */
+ uint32_t param = (cache_timer_scale << 7) | (cache_timer_delay << 1) | (enable ? 1 : 0);
+
++ smu_print("SMU Set display refresh from mall: enable = %d, cache_timer_delay = %d, cache_timer_scale = %d\n",
++ enable, cache_timer_delay, cache_timer_scale);
++
+ dcn30_smu_send_msg_with_param(clk_mgr,
+ DALSMC_MSG_SetDisplayRefreshFromMall, param, NULL);
+ }
+--
+2.39.2
+
--- /dev/null
+From 18cee716d9bb47d88ea8c123f5b820027e409ad1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 13:21:48 -0400
+Subject: drm/amd/display: Explicitly specify update type per plane info change
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 710cc1e7cd461446a9325c9bd1e9a54daa462952 ]
+
+[Why]
+The bit for flip addr is being set causing the determination for
+FAST vs MEDIUM to always return MEDIUM when plane info is provided
+as a surface update. This causes extreme stuttering for the typical
+atomic update path on Linux.
+
+[How]
+Don't use update_flags->raw for determining FAST vs MEDIUM. It's too
+fragile to changes like this.
+
+Explicitly specify the update type per update flag instead. It's not
+as clever as checking the bits itself but at least it's correct.
+
+Fixes: aa5fdb1ab5b6 ("drm/amd/display: Explicitly specify update type per plane info change")
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 087a4838488b2..b405f2e86927d 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -2360,9 +2360,6 @@ static enum surface_update_type det_surface_update(const struct dc *dc,
+ enum surface_update_type overall_type = UPDATE_TYPE_FAST;
+ union surface_update_flags *update_flags = &u->surface->update_flags;
+
+- if (u->flip_addr)
+- update_flags->bits.addr_update = 1;
+-
+ if (!is_surface_in_context(context, u->surface) || u->surface->force_full_update) {
+ update_flags->raw = 0xFFFFFFFF;
+ return UPDATE_TYPE_FULL;
+--
+2.39.2
+
--- /dev/null
+From b4813a7ec8601eb60a8adc86ab38d0c23aa89d37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 23:35:08 +0200
+Subject: drm/amd/display: Fix a test CalculatePrefetchSchedule()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 960e27a5741cd3001996ff6ddfb3eb0ed3a4909d ]
+
+It is likely Height was expected here, instead of Width.
+
+Test the correct variable.
+
+Fixes: 17529ea2acfa ("drm/amd/display: Optimizations for DML math")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
+index b7c2844d0cbee..f294f2f8c75bc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
+@@ -810,7 +810,7 @@ static bool CalculatePrefetchSchedule(
+ *swath_width_chroma_ub = dml_ceil(SwathWidthY / 2 - 1, myPipe->BlockWidth256BytesC) + myPipe->BlockWidth256BytesC;
+ } else {
+ *swath_width_luma_ub = dml_ceil(SwathWidthY - 1, myPipe->BlockHeight256BytesY) + myPipe->BlockHeight256BytesY;
+- if (myPipe->BlockWidth256BytesC > 0)
++ if (myPipe->BlockHeight256BytesC > 0)
+ *swath_width_chroma_ub = dml_ceil(SwathWidthY / 2 - 1, myPipe->BlockHeight256BytesC) + myPipe->BlockHeight256BytesC;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From f85e35354ffec99836842f0b77adf7c41fdc69db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 23:41:11 +0200
+Subject: drm/amd/display: Fix a test dml32_rq_dlg_get_rq_reg()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit bafc31166aa7df5fa26ae0ad8196d1717e6cdea9 ]
+
+It is likely p1_min_meta_chunk_bytes was expected here, instead of
+min_meta_chunk_bytes.
+
+Test the correct variable.
+
+Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+index 395ae8761980f..9ba6cb67655f4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+@@ -116,7 +116,7 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
+ else
+ rq_regs->rq_regs_l.min_meta_chunk_size = dml_log2(min_meta_chunk_bytes) - 6 + 1;
+
+- if (min_meta_chunk_bytes == 0)
++ if (p1_min_meta_chunk_bytes == 0)
+ rq_regs->rq_regs_c.min_meta_chunk_size = 0;
+ else
+ rq_regs->rq_regs_c.min_meta_chunk_size = dml_log2(p1_min_meta_chunk_bytes) - 6 + 1;
+--
+2.39.2
+
--- /dev/null
+From fa028dae5ca7451aebc774efb62cd9836e6fa0ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 14:39:46 -0400
+Subject: drm/amd/display: Fix artifacting on eDP panels when engaging freesync
+ video mode
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit b18f05a0666aecd5cb19c26a8305bcfa4e9d6502 ]
+
+[Why]
+When freesync video mode is enabled, switching resolution from native
+mode to one of the freesync video compatible modes can trigger continous
+artifacts on some eDP panels when running under KDE. The articating can be seen in the
+attached bug report.
+
+[How]
+Fix this by restricting updates that require full commit by using the same checks
+for stream and scaling changes in the the enable pass of dm_update_crtc_state()
+along with the check for compatible timings for freesync vide mode.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2162
+Fixes: da5e14909776 ("drm/amd/display: Fix hang when skipping modeset")
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 91c308cf27eb2..b854eec2787e2 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -8873,6 +8873,8 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
+
+ /* Now check if we should set freesync video mode */
+ if (amdgpu_freesync_vid_mode && dm_new_crtc_state->stream &&
++ dc_is_stream_unchanged(new_stream, dm_old_crtc_state->stream) &&
++ dc_is_stream_scaling_unchanged(new_stream, dm_old_crtc_state->stream) &&
+ is_timing_unchanged_for_freesync(new_crtc_state,
+ old_crtc_state)) {
+ new_crtc_state->mode_changed = false;
+--
+2.39.2
+
--- /dev/null
+From b4c2b196327c7af90c3cdaa1e975ccead4a7b5a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 14:06:43 +0530
+Subject: drm/amdgpu: Fix memcpy() in sienna_cichlid_append_powerplay_table
+ function.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit d50dc746ff72b9c48812dac3344fa87fbde940a3 ]
+
+Fixes the following gcc with W=1:
+
+In file included from ./include/linux/string.h:253,
+ from ./include/linux/bitmap.h:11,
+ from ./include/linux/cpumask.h:12,
+ from ./arch/x86/include/asm/cpumask.h:5,
+ from ./arch/x86/include/asm/msr.h:11,
+ from ./arch/x86/include/asm/processor.h:22,
+ from ./arch/x86/include/asm/cpufeature.h:5,
+ from ./arch/x86/include/asm/thread_info.h:53,
+ from ./include/linux/thread_info.h:60,
+ from ./arch/x86/include/asm/preempt.h:7,
+ from ./include/linux/preempt.h:78,
+ from ./include/linux/spinlock.h:56,
+ from ./include/linux/mmzone.h:8,
+ from ./include/linux/gfp.h:7,
+ from ./include/linux/firmware.h:7,
+ from drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:26:
+In function ‘fortify_memcpy_chk’,
+ inlined from ‘sienna_cichlid_append_powerplay_table’ at drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:444:2,
+ inlined from ‘sienna_cichlid_setup_pptable’ at drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:506:8,
+ inlined from ‘sienna_cichlid_setup_pptable’ at drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:494:12:
+./include/linux/fortify-string.h:413:4: warning: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
+ 413 | __read_overflow2_field(q_size_field, size);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+the compiler complains about the size calculation in the memcpy() -
+"sizeof(*smc_dpm_table) - sizeof(smc_dpm_table->table_header)" is much
+larger than what fits into table_member.
+
+Hence, reuse 'smu_memcpy_trailing' for nv1x
+
+Fixes: 7077b19a38240 ("drm/amd/pm: use macro to get pptable members")
+Suggested-by: Evan Quan <Evan.Quan@amd.com>
+Cc: Evan Quan <Evan.Quan@amd.com>
+Cc: Chengming Gui <Jack.Gui@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+index 85d53597eb07a..f7ed3e655e397 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+@@ -431,7 +431,13 @@ static int sienna_cichlid_append_powerplay_table(struct smu_context *smu)
+ {
+ struct atom_smc_dpm_info_v4_9 *smc_dpm_table;
+ int index, ret;
+- I2cControllerConfig_t *table_member;
++ PPTable_beige_goby_t *ppt_beige_goby;
++ PPTable_t *ppt;
++
++ if (smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 13))
++ ppt_beige_goby = smu->smu_table.driver_pptable;
++ else
++ ppt = smu->smu_table.driver_pptable;
+
+ index = get_index_into_master_table(atom_master_list_of_data_tables_v2_1,
+ smc_dpm_info);
+@@ -440,9 +446,13 @@ static int sienna_cichlid_append_powerplay_table(struct smu_context *smu)
+ (uint8_t **)&smc_dpm_table);
+ if (ret)
+ return ret;
+- GET_PPTABLE_MEMBER(I2cControllers, &table_member);
+- memcpy(table_member, smc_dpm_table->I2cControllers,
+- sizeof(*smc_dpm_table) - sizeof(smc_dpm_table->table_header));
++
++ if (smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 13))
++ smu_memcpy_trailing(ppt_beige_goby, I2cControllers, BoardReserved,
++ smc_dpm_table, I2cControllers);
++ else
++ smu_memcpy_trailing(ppt, I2cControllers, BoardReserved,
++ smc_dpm_table, I2cControllers);
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 9ef3f3ac9e0ed206b1c197a4900a29763dadc6c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jun 2023 06:19:15 -0400
+Subject: drm/amdgpu: Fix usage of UMC fill record in RAS
+
+From: Luben Tuikov <luben.tuikov@amd.com>
+
+[ Upstream commit 71344a718a9fda8c551cdc4381d354f9a9907f6f ]
+
+The fixed commit listed in the Fixes tag below, introduced a bug in
+amdgpu_ras.c::amdgpu_reserve_page_direct(), in that when introducing the new
+amdgpu_umc_fill_error_record() and internally in that new function the physical
+address (argument "uint64_t retired_page"--wrong name) is right-shifted by
+AMDGPU_GPU_PAGE_SHIFT. Thus, in amdgpu_reserve_page_direct() when we pass
+"address" to that new function, we should NOT right-shift it, since this
+results, erroneously, in the page address to be 0 for first
+2^(2*AMDGPU_GPU_PAGE_SHIFT) memory addresses.
+
+This commit fixes this bug.
+
+Cc: Tao Zhou <tao.zhou1@amd.com>
+Cc: Hawking Zhang <Hawking.Zhang@amd.com>
+Cc: Alex Deucher <Alexander.Deucher@amd.com>
+Fixes: 400013b268cb ("drm/amdgpu: add umc_fill_error_record to make code more simple")
+Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
+Link: https://lore.kernel.org/r/20230610113536.10621-1-luben.tuikov@amd.com
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index a4b47e1bd111d..09fc464f5f128 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -170,8 +170,7 @@ static int amdgpu_reserve_page_direct(struct amdgpu_device *adev, uint64_t addre
+
+ memset(&err_rec, 0x0, sizeof(struct eeprom_table_record));
+ err_data.err_addr = &err_rec;
+- amdgpu_umc_fill_error_record(&err_data, address,
+- (address >> AMDGPU_GPU_PAGE_SHIFT), 0, 0);
++ amdgpu_umc_fill_error_record(&err_data, address, address, 0, 0);
+
+ if (amdgpu_bad_page_threshold != 0) {
+ amdgpu_ras_add_bad_pages(adev, err_data.err_addr,
+--
+2.39.2
+
--- /dev/null
+From e610a6913c38019c45876e90b2a376b89e582851 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 May 2023 04:23:14 -0700
+Subject: drm/amdkfd: Fix potential deallocation of previously deallocated
+ memory.
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit cabbdea1f1861098991768d7bbf5a49ed1608213 ]
+
+Pointer mqd_mem_obj can be deallocated in kfd_gtt_sa_allocate().
+The function then returns non-zero value, which causes the second deallocation.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: d1f8f0d17d40 ("drm/amdkfd: Move non-sdma mqd allocation out of init_mqd")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+index 0778e587a2d68..eaf084acb706f 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+@@ -115,18 +115,19 @@ static struct kfd_mem_obj *allocate_mqd(struct kfd_dev *kfd,
+ &(mqd_mem_obj->gtt_mem),
+ &(mqd_mem_obj->gpu_addr),
+ (void *)&(mqd_mem_obj->cpu_ptr), true);
++
++ if (retval) {
++ kfree(mqd_mem_obj);
++ return NULL;
++ }
+ } else {
+ retval = kfd_gtt_sa_allocate(kfd, sizeof(struct v9_mqd),
+ &mqd_mem_obj);
+- }
+-
+- if (retval) {
+- kfree(mqd_mem_obj);
+- return NULL;
++ if (retval)
++ return NULL;
+ }
+
+ return mqd_mem_obj;
+-
+ }
+
+ static void init_mqd(struct mqd_manager *mm, void **mqd,
+--
+2.39.2
+
--- /dev/null
+From 46af8df7b1c49fa913aad7a342fd52f08103df91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 23:35:51 +0100
+Subject: drm/bridge: anx7625: Convert to i2c's .probe_new()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 71450f8c824f5571d4af9e6e021b733085c8e690 ]
+
+The probe function doesn't make use of the i2c_device_id * parameter so it
+can be trivially converted.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Link: https://lore.kernel.org/r/20221118224540.619276-18-uwe@kleine-koenig.org
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Stable-dep-of: 1464e48d69ab ("drm/bridge: anx7625: Prevent endless probe loop")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index b0ff1ecb80a50..86a52c5f4fbc4 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -2562,8 +2562,7 @@ static void anx7625_runtime_disable(void *data)
+ pm_runtime_disable(data);
+ }
+
+-static int anx7625_i2c_probe(struct i2c_client *client,
+- const struct i2c_device_id *id)
++static int anx7625_i2c_probe(struct i2c_client *client)
+ {
+ struct anx7625_data *platform;
+ struct anx7625_platform_data *pdata;
+@@ -2756,7 +2755,7 @@ static struct i2c_driver anx7625_driver = {
+ .of_match_table = anx_match_table,
+ .pm = &anx7625_pm_ops,
+ },
+- .probe = anx7625_i2c_probe,
++ .probe_new = anx7625_i2c_probe,
+ .remove = anx7625_i2c_remove,
+
+ .id_table = anx7625_id,
+--
+2.39.2
+
--- /dev/null
+From b2c9fd982bf95c0ec277c0d7acaf738f1b12aa26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 15:39:02 -0400
+Subject: drm/bridge: anx7625: Prevent endless probe loop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit 1464e48d69ab7a50a377c9d39f5e5eb3cee2722e ]
+
+During probe, the driver registers i2c dummy devices and populates the
+aux bus, which registers a device for the panel. After doing that, the
+driver can still defer probe if needed. This ordering of operations is
+troublesome however, because the deferred probe work will retry probing
+all pending devices every time a new device is registered. Therefore, if
+modules need to be loaded in order to satisfy the dependencies for this
+driver to complete probe, the kernel will stall, since it'll keep trying
+to probe the anx7625 driver, but never succeed, given that modules would
+only be loaded after the deferred probe work completes.
+
+Two changes are required to avoid this issue:
+* Move of_find_mipi_dsi_host_by_node(), which can defer probe, to before
+ anx7625_register_i2c_dummy_clients() and
+ devm_of_dp_aux_populate_ep_devices(), which register devices.
+* Make use of the done_probing callback when populating the aux bus,
+ so that the bridge registration is only done after the panel is
+ probed. This is required because the panel might need to defer probe,
+ but the aux bus population needs the i2c dummy devices working, so
+ this call couldn't just be moved to an earlier point in probe.
+ One caveat is that if the panel is described outside the aux bus, the
+ probe loop issue can still happen, but we don't have a way to avoid
+ it in that case since there's no callback available.
+
+With this patch applied, it's possible to boot on
+mt8192-asurada-spherion with
+
+CONFIG_DRM_ANALOGIX_ANX7625=y
+CONFIG_MTK_MMSYS=m
+CONFIG_BACKLIGHT_PWM=y
+
+and also with
+
+CONFIG_DRM_ANALOGIX_ANX7625=y
+CONFIG_MTK_MMSYS=y
+CONFIG_BACKLIGHT_PWM=m
+
+Fixes: adca62ec370c ("drm/bridge: anx7625: Support reading edid through aux channel")
+Fixes: 269332997a16 ("drm/bridge: anx7625: Return -EPROBE_DEFER if the dsi host was not found")
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230518193902.891121-1-nfraprado@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 128 +++++++++++++++-------
+ 1 file changed, 88 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index 86a52c5f4fbc4..213263ad6a064 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -1689,6 +1689,14 @@ static int anx7625_parse_dt(struct device *dev,
+ if (of_property_read_bool(np, "analogix,audio-enable"))
+ pdata->audio_en = 1;
+
++ return 0;
++}
++
++static int anx7625_parse_dt_panel(struct device *dev,
++ struct anx7625_platform_data *pdata)
++{
++ struct device_node *np = dev->of_node;
++
+ pdata->panel_bridge = devm_drm_of_get_bridge(dev, np, 1, 0);
+ if (IS_ERR(pdata->panel_bridge)) {
+ if (PTR_ERR(pdata->panel_bridge) == -ENODEV) {
+@@ -2034,7 +2042,7 @@ static int anx7625_register_audio(struct device *dev, struct anx7625_data *ctx)
+ return 0;
+ }
+
+-static int anx7625_attach_dsi(struct anx7625_data *ctx)
++static int anx7625_setup_dsi_device(struct anx7625_data *ctx)
+ {
+ struct mipi_dsi_device *dsi;
+ struct device *dev = &ctx->client->dev;
+@@ -2044,9 +2052,6 @@ static int anx7625_attach_dsi(struct anx7625_data *ctx)
+ .channel = 0,
+ .node = NULL,
+ };
+- int ret;
+-
+- DRM_DEV_DEBUG_DRIVER(dev, "attach dsi\n");
+
+ host = of_find_mipi_dsi_host_by_node(ctx->pdata.mipi_host_node);
+ if (!host) {
+@@ -2067,14 +2072,24 @@ static int anx7625_attach_dsi(struct anx7625_data *ctx)
+ MIPI_DSI_MODE_VIDEO_HSE |
+ MIPI_DSI_HS_PKT_END_ALIGNED;
+
+- ret = devm_mipi_dsi_attach(dev, dsi);
++ ctx->dsi = dsi;
++
++ return 0;
++}
++
++static int anx7625_attach_dsi(struct anx7625_data *ctx)
++{
++ struct device *dev = &ctx->client->dev;
++ int ret;
++
++ DRM_DEV_DEBUG_DRIVER(dev, "attach dsi\n");
++
++ ret = devm_mipi_dsi_attach(dev, ctx->dsi);
+ if (ret) {
+ DRM_DEV_ERROR(dev, "fail to attach dsi to host.\n");
+ return ret;
+ }
+
+- ctx->dsi = dsi;
+-
+ DRM_DEV_DEBUG_DRIVER(dev, "attach dsi succeeded.\n");
+
+ return 0;
+@@ -2562,6 +2577,40 @@ static void anx7625_runtime_disable(void *data)
+ pm_runtime_disable(data);
+ }
+
++static int anx7625_link_bridge(struct drm_dp_aux *aux)
++{
++ struct anx7625_data *platform = container_of(aux, struct anx7625_data, aux);
++ struct device *dev = aux->dev;
++ int ret;
++
++ ret = anx7625_parse_dt_panel(dev, &platform->pdata);
++ if (ret) {
++ DRM_DEV_ERROR(dev, "fail to parse DT for panel : %d\n", ret);
++ return ret;
++ }
++
++ platform->bridge.funcs = &anx7625_bridge_funcs;
++ platform->bridge.of_node = dev->of_node;
++ if (!anx7625_of_panel_on_aux_bus(dev))
++ platform->bridge.ops |= DRM_BRIDGE_OP_EDID;
++ if (!platform->pdata.panel_bridge)
++ platform->bridge.ops |= DRM_BRIDGE_OP_HPD |
++ DRM_BRIDGE_OP_DETECT;
++ platform->bridge.type = platform->pdata.panel_bridge ?
++ DRM_MODE_CONNECTOR_eDP :
++ DRM_MODE_CONNECTOR_DisplayPort;
++
++ drm_bridge_add(&platform->bridge);
++
++ if (!platform->pdata.is_dpi) {
++ ret = anx7625_attach_dsi(platform);
++ if (ret)
++ drm_bridge_remove(&platform->bridge);
++ }
++
++ return ret;
++}
++
+ static int anx7625_i2c_probe(struct i2c_client *client)
+ {
+ struct anx7625_data *platform;
+@@ -2636,6 +2685,24 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+ platform->aux.wait_hpd_asserted = anx7625_wait_hpd_asserted;
+ drm_dp_aux_init(&platform->aux);
+
++ ret = anx7625_parse_dt(dev, pdata);
++ if (ret) {
++ if (ret != -EPROBE_DEFER)
++ DRM_DEV_ERROR(dev, "fail to parse DT : %d\n", ret);
++ goto free_wq;
++ }
++
++ if (!platform->pdata.is_dpi) {
++ ret = anx7625_setup_dsi_device(platform);
++ if (ret < 0)
++ goto free_wq;
++ }
++
++ /*
++ * Registering the i2c devices will retrigger deferred probe, so it
++ * needs to be done after calls that might return EPROBE_DEFER,
++ * otherwise we can get an infinite loop.
++ */
+ if (anx7625_register_i2c_dummy_clients(platform, client) != 0) {
+ ret = -ENOMEM;
+ DRM_DEV_ERROR(dev, "fail to reserve I2C bus.\n");
+@@ -2650,13 +2717,21 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+ if (ret)
+ goto free_wq;
+
+- devm_of_dp_aux_populate_ep_devices(&platform->aux);
+-
+- ret = anx7625_parse_dt(dev, pdata);
++ /*
++ * Populating the aux bus will retrigger deferred probe, so it needs to
++ * be done after calls that might return EPROBE_DEFER, otherwise we can
++ * get an infinite loop.
++ */
++ ret = devm_of_dp_aux_populate_bus(&platform->aux, anx7625_link_bridge);
+ if (ret) {
+- if (ret != -EPROBE_DEFER)
+- DRM_DEV_ERROR(dev, "fail to parse DT : %d\n", ret);
+- goto free_wq;
++ if (ret != -ENODEV) {
++ DRM_DEV_ERROR(dev, "failed to populate aux bus : %d\n", ret);
++ goto free_wq;
++ }
++
++ ret = anx7625_link_bridge(&platform->aux);
++ if (ret)
++ goto free_wq;
+ }
+
+ if (!platform->pdata.low_power_mode) {
+@@ -2669,27 +2744,6 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+ if (platform->pdata.intp_irq)
+ queue_work(platform->workqueue, &platform->work);
+
+- platform->bridge.funcs = &anx7625_bridge_funcs;
+- platform->bridge.of_node = client->dev.of_node;
+- if (!anx7625_of_panel_on_aux_bus(&client->dev))
+- platform->bridge.ops |= DRM_BRIDGE_OP_EDID;
+- if (!platform->pdata.panel_bridge)
+- platform->bridge.ops |= DRM_BRIDGE_OP_HPD |
+- DRM_BRIDGE_OP_DETECT;
+- platform->bridge.type = platform->pdata.panel_bridge ?
+- DRM_MODE_CONNECTOR_eDP :
+- DRM_MODE_CONNECTOR_DisplayPort;
+-
+- drm_bridge_add(&platform->bridge);
+-
+- if (!platform->pdata.is_dpi) {
+- ret = anx7625_attach_dsi(platform);
+- if (ret) {
+- DRM_DEV_ERROR(dev, "Fail to attach to dsi : %d\n", ret);
+- goto unregister_bridge;
+- }
+- }
+-
+ if (platform->pdata.audio_en)
+ anx7625_register_audio(dev, platform);
+
+@@ -2697,12 +2751,6 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+
+ return 0;
+
+-unregister_bridge:
+- drm_bridge_remove(&platform->bridge);
+-
+- if (!platform->pdata.low_power_mode)
+- pm_runtime_put_sync_suspend(&client->dev);
+-
+ free_wq:
+ if (platform->workqueue)
+ destroy_workqueue(platform->workqueue);
+--
+2.39.2
+
--- /dev/null
+From 3bcd91df87394559cf72a6c21eb473055aab1228 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Dec 2022 17:33:26 +0000
+Subject: drm/bridge: Introduce pre_enable_prev_first to alter bridge init
+ order
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 4fb912e5e19075874379cfcf074d90bd51ebf8ea ]
+
+DSI sink devices typically want the DSI host powered up and configured
+before they are powered up. pre_enable is the place this would normally
+happen, but they are called in reverse order from panel/connector towards
+the encoder, which is the "wrong" order.
+
+Add a new flag pre_enable_prev_first that any bridge can set
+to swap the order of pre_enable (and post_disable) for that and the
+immediately previous bridge.
+Should the immediately previous bridge also set the
+pre_enable_prev_first flag, the previous bridge to that will be called
+before either of those which requested pre_enable_prev_first.
+
+eg:
+- Panel
+- Bridge 1
+- Bridge 2 pre_enable_prev_first
+- Bridge 3
+- Bridge 4 pre_enable_prev_first
+- Bridge 5 pre_enable_prev_first
+- Bridge 6
+- Encoder
+Would result in pre_enable's being called as Panel, Bridge 1, Bridge 3,
+Bridge 2, Bridge 6, Bridge 5, Bridge 4, Encoder.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Tested-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Link: https://lore.kernel.org/r/20221205173328.1395350-5-dave.stevenson@raspberrypi.com
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Stable-dep-of: dd9e329af723 ("drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_bridge.c | 145 +++++++++++++++++++++++++++++------
+ include/drm/drm_bridge.h | 8 ++
+ 2 files changed, 129 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c
+index 1545c50fd1c8f..7044e339a82cd 100644
+--- a/drivers/gpu/drm/drm_bridge.c
++++ b/drivers/gpu/drm/drm_bridge.c
+@@ -691,6 +691,25 @@ void drm_atomic_bridge_chain_disable(struct drm_bridge *bridge,
+ }
+ EXPORT_SYMBOL(drm_atomic_bridge_chain_disable);
+
++static void drm_atomic_bridge_call_post_disable(struct drm_bridge *bridge,
++ struct drm_atomic_state *old_state)
++{
++ if (old_state && bridge->funcs->atomic_post_disable) {
++ struct drm_bridge_state *old_bridge_state;
++
++ old_bridge_state =
++ drm_atomic_get_old_bridge_state(old_state,
++ bridge);
++ if (WARN_ON(!old_bridge_state))
++ return;
++
++ bridge->funcs->atomic_post_disable(bridge,
++ old_bridge_state);
++ } else if (bridge->funcs->post_disable) {
++ bridge->funcs->post_disable(bridge);
++ }
++}
++
+ /**
+ * drm_atomic_bridge_chain_post_disable - cleans up after disabling all bridges
+ * in the encoder chain
+@@ -702,36 +721,86 @@ EXPORT_SYMBOL(drm_atomic_bridge_chain_disable);
+ * starting from the first bridge to the last. These are called after completing
+ * &drm_encoder_helper_funcs.atomic_disable
+ *
++ * If a bridge sets @pre_enable_prev_first, then the @post_disable for that
++ * bridge will be called before the previous one to reverse the @pre_enable
++ * calling direction.
++ *
+ * Note: the bridge passed should be the one closest to the encoder
+ */
+ void drm_atomic_bridge_chain_post_disable(struct drm_bridge *bridge,
+ struct drm_atomic_state *old_state)
+ {
+ struct drm_encoder *encoder;
++ struct drm_bridge *next, *limit;
+
+ if (!bridge)
+ return;
+
+ encoder = bridge->encoder;
++
+ list_for_each_entry_from(bridge, &encoder->bridge_chain, chain_node) {
+- if (bridge->funcs->atomic_post_disable) {
+- struct drm_bridge_state *old_bridge_state;
++ limit = NULL;
++
++ if (!list_is_last(&bridge->chain_node, &encoder->bridge_chain)) {
++ next = list_next_entry(bridge, chain_node);
++
++ if (next->pre_enable_prev_first) {
++ /* next bridge had requested that prev
++ * was enabled first, so disabled last
++ */
++ limit = next;
++
++ /* Find the next bridge that has NOT requested
++ * prev to be enabled first / disabled last
++ */
++ list_for_each_entry_from(next, &encoder->bridge_chain,
++ chain_node) {
++ if (next->pre_enable_prev_first) {
++ next = list_prev_entry(next, chain_node);
++ limit = next;
++ break;
++ }
++ }
++
++ /* Call these bridges in reverse order */
++ list_for_each_entry_from_reverse(next, &encoder->bridge_chain,
++ chain_node) {
++ if (next == bridge)
++ break;
++
++ drm_atomic_bridge_call_post_disable(next,
++ old_state);
++ }
++ }
++ }
+
+- old_bridge_state =
+- drm_atomic_get_old_bridge_state(old_state,
+- bridge);
+- if (WARN_ON(!old_bridge_state))
+- return;
++ drm_atomic_bridge_call_post_disable(bridge, old_state);
+
+- bridge->funcs->atomic_post_disable(bridge,
+- old_bridge_state);
+- } else if (bridge->funcs->post_disable) {
+- bridge->funcs->post_disable(bridge);
+- }
++ if (limit)
++ /* Jump all bridges that we have already post_disabled */
++ bridge = limit;
+ }
+ }
+ EXPORT_SYMBOL(drm_atomic_bridge_chain_post_disable);
+
++static void drm_atomic_bridge_call_pre_enable(struct drm_bridge *bridge,
++ struct drm_atomic_state *old_state)
++{
++ if (old_state && bridge->funcs->atomic_pre_enable) {
++ struct drm_bridge_state *old_bridge_state;
++
++ old_bridge_state =
++ drm_atomic_get_old_bridge_state(old_state,
++ bridge);
++ if (WARN_ON(!old_bridge_state))
++ return;
++
++ bridge->funcs->atomic_pre_enable(bridge, old_bridge_state);
++ } else if (bridge->funcs->pre_enable) {
++ bridge->funcs->pre_enable(bridge);
++ }
++}
++
+ /**
+ * drm_atomic_bridge_chain_pre_enable - prepares for enabling all bridges in
+ * the encoder chain
+@@ -743,32 +812,60 @@ EXPORT_SYMBOL(drm_atomic_bridge_chain_post_disable);
+ * starting from the last bridge to the first. These are called before calling
+ * &drm_encoder_helper_funcs.atomic_enable
+ *
++ * If a bridge sets @pre_enable_prev_first, then the pre_enable for the
++ * prev bridge will be called before pre_enable of this bridge.
++ *
+ * Note: the bridge passed should be the one closest to the encoder
+ */
+ void drm_atomic_bridge_chain_pre_enable(struct drm_bridge *bridge,
+ struct drm_atomic_state *old_state)
+ {
+ struct drm_encoder *encoder;
+- struct drm_bridge *iter;
++ struct drm_bridge *iter, *next, *limit;
+
+ if (!bridge)
+ return;
+
+ encoder = bridge->encoder;
++
+ list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) {
+- if (iter->funcs->atomic_pre_enable) {
+- struct drm_bridge_state *old_bridge_state;
++ if (iter->pre_enable_prev_first) {
++ next = iter;
++ limit = bridge;
++ list_for_each_entry_from_reverse(next,
++ &encoder->bridge_chain,
++ chain_node) {
++ if (next == bridge)
++ break;
++
++ if (!next->pre_enable_prev_first) {
++ /* Found first bridge that does NOT
++ * request prev to be enabled first
++ */
++ limit = list_prev_entry(next, chain_node);
++ break;
++ }
++ }
++
++ list_for_each_entry_from(next, &encoder->bridge_chain, chain_node) {
++ /* Call requested prev bridge pre_enable
++ * in order.
++ */
++ if (next == iter)
++ /* At the first bridge to request prev
++ * bridges called first.
++ */
++ break;
++
++ drm_atomic_bridge_call_pre_enable(next, old_state);
++ }
++ }
+
+- old_bridge_state =
+- drm_atomic_get_old_bridge_state(old_state,
+- iter);
+- if (WARN_ON(!old_bridge_state))
+- return;
++ drm_atomic_bridge_call_pre_enable(iter, old_state);
+
+- iter->funcs->atomic_pre_enable(iter, old_bridge_state);
+- } else if (iter->funcs->pre_enable) {
+- iter->funcs->pre_enable(iter);
+- }
++ if (iter->pre_enable_prev_first)
++ /* Jump all bridges that we have already pre_enabled */
++ iter = limit;
+
+ if (iter == bridge)
+ break;
+diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h
+index 288c6feda5de2..6b656ea23b964 100644
+--- a/include/drm/drm_bridge.h
++++ b/include/drm/drm_bridge.h
+@@ -768,6 +768,14 @@ struct drm_bridge {
+ * modes.
+ */
+ bool interlace_allowed;
++ /**
++ * @pre_enable_prev_first: The bridge requires that the prev
++ * bridge @pre_enable function is called before its @pre_enable,
++ * and conversely for post_disable. This is most frequently a
++ * requirement for DSI devices which need the host to be initialised
++ * before the peripheral.
++ */
++ bool pre_enable_prev_first;
+ /**
+ * @ddc: Associated I2C adapter for DDC access, if any.
+ */
+--
+2.39.2
+
--- /dev/null
+From 859eefce490f2294d24316d887a9fec28e071fba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 17:30:46 +0200
+Subject: drm/bridge: it6505: Move a variable assignment behind a null pointer
+ check in receive_timing_debugfs_show()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Elfring <elfring@users.sourceforge.net>
+
+[ Upstream commit 0be05a75de2916421e88e0d64b001984f54df0bd ]
+
+The address of a data structure member was determined before
+a corresponding null pointer check in the implementation of
+the function “receive_timing_debugfs_show”.
+
+Thus avoid the risk for undefined behaviour by moving the assignment
+for the variable “vid” behind the null pointer check.
+
+This issue was detected by using the Coccinelle software.
+
+Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
+Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/fa69384f-1485-142b-c4ee-3df54ac68a89@web.de
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ite-it6505.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
+index 99123eec45511..292c4f6da04af 100644
+--- a/drivers/gpu/drm/bridge/ite-it6505.c
++++ b/drivers/gpu/drm/bridge/ite-it6505.c
+@@ -3085,7 +3085,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf,
+ size_t len, loff_t *ppos)
+ {
+ struct it6505 *it6505 = file->private_data;
+- struct drm_display_mode *vid = &it6505->video_info;
++ struct drm_display_mode *vid;
+ u8 read_buf[READ_BUFFER_SIZE];
+ u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE;
+ ssize_t ret, count;
+@@ -3094,6 +3094,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf,
+ return -ENODEV;
+
+ it6505_calc_video_info(it6505);
++ vid = &it6505->video_info;
+ str += scnprintf(str, end - str, "---video timing---\n");
+ str += scnprintf(str, end - str, "PCLK:%d.%03dMHz\n",
+ vid->clock / 1000, vid->clock % 1000);
+--
+2.39.2
+
--- /dev/null
+From 04d017623d15b2b11a46f7656f072982ad5e00b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 14:21:06 +0200
+Subject: drm/bridge: tc358767: Switch to devm MIPI-DSI helpers
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit f47d6140b7a4c858d82d263e7577ff6fb5279a9c ]
+
+DSI device registering and attaching needs to be undone upon
+deregistration. This fixes module unload/load.
+
+Fixes: bbfd3190b656 ("drm/bridge: tc358767: Add DSI-to-DPI mode support")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230517122107.1766673-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index b9b681086fc49..7ef78283e3d3e 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -1890,7 +1890,7 @@ static int tc_mipi_dsi_host_attach(struct tc_data *tc)
+ if (dsi_lanes < 0)
+ return dsi_lanes;
+
+- dsi = mipi_dsi_device_register_full(host, &info);
++ dsi = devm_mipi_dsi_device_register_full(dev, host, &info);
+ if (IS_ERR(dsi))
+ return dev_err_probe(dev, PTR_ERR(dsi),
+ "failed to create dsi device\n");
+@@ -1901,7 +1901,7 @@ static int tc_mipi_dsi_host_attach(struct tc_data *tc)
+ dsi->format = MIPI_DSI_FMT_RGB888;
+ dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE;
+
+- ret = mipi_dsi_attach(dsi);
++ ret = devm_mipi_dsi_attach(dev, dsi);
+ if (ret < 0) {
+ dev_err(dev, "failed to attach dsi to host: %d\n", ret);
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From b80f853beeffb045161b5a08059a9c08ef838f56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 11:59:41 +0200
+Subject: drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit cec5ccef85bd0128cf895612de54a9d21d2015d0 ]
+
+Add atomic_get_input_bus_fmts() implementation, tc358768 has a parallel
+RGB input interface with the actual bus format depending on the amount
+of parallel input data lines.
+
+Without this change when the tc358768 is used with less than 24bit the
+color mapping is completely wrong.
+
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230330095941.428122-7-francesco@dolcini.it
+Stable-dep-of: ee18698e212b ("drm/bridge: tc358768: fix TCLK_TRAILCNT computation")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 44 +++++++++++++++++++++++++++++++
+ 1 file changed, 44 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 765bdebbd06f9..8f7efb14ebdc7 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -9,6 +9,7 @@
+ #include <linux/gpio/consumer.h>
+ #include <linux/i2c.h>
+ #include <linux/kernel.h>
++#include <linux/media-bus-format.h>
+ #include <linux/module.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+@@ -919,6 +920,44 @@ static void tc358768_bridge_enable(struct drm_bridge *bridge)
+ }
+ }
+
++#define MAX_INPUT_SEL_FORMATS 1
++
++static u32 *
++tc358768_atomic_get_input_bus_fmts(struct drm_bridge *bridge,
++ struct drm_bridge_state *bridge_state,
++ struct drm_crtc_state *crtc_state,
++ struct drm_connector_state *conn_state,
++ u32 output_fmt,
++ unsigned int *num_input_fmts)
++{
++ struct tc358768_priv *priv = bridge_to_tc358768(bridge);
++ u32 *input_fmts;
++
++ *num_input_fmts = 0;
++
++ input_fmts = kcalloc(MAX_INPUT_SEL_FORMATS, sizeof(*input_fmts),
++ GFP_KERNEL);
++ if (!input_fmts)
++ return NULL;
++
++ switch (priv->pd_lines) {
++ case 16:
++ input_fmts[0] = MEDIA_BUS_FMT_RGB565_1X16;
++ break;
++ case 18:
++ input_fmts[0] = MEDIA_BUS_FMT_RGB666_1X18;
++ break;
++ default:
++ case 24:
++ input_fmts[0] = MEDIA_BUS_FMT_RGB888_1X24;
++ break;
++ };
++
++ *num_input_fmts = MAX_INPUT_SEL_FORMATS;
++
++ return input_fmts;
++}
++
+ static const struct drm_bridge_funcs tc358768_bridge_funcs = {
+ .attach = tc358768_bridge_attach,
+ .mode_valid = tc358768_bridge_mode_valid,
+@@ -926,6 +965,11 @@ static const struct drm_bridge_funcs tc358768_bridge_funcs = {
+ .enable = tc358768_bridge_enable,
+ .disable = tc358768_bridge_disable,
+ .post_disable = tc358768_bridge_post_disable,
++
++ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
++ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
++ .atomic_reset = drm_atomic_helper_bridge_reset,
++ .atomic_get_input_bus_fmts = tc358768_atomic_get_input_bus_fmts,
+ };
+
+ static const struct drm_bridge_timings default_tc358768_timings = {
+--
+2.39.2
+
--- /dev/null
+From 5681e90c2ab7e6f88cbc265a7c5b1d24c3298275 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 16:29:26 +0200
+Subject: drm/bridge: tc358768: always enable HS video mode
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit 75a8aeac2573ab258c53676eba9b3796ea691988 ]
+
+Always enable HS video mode setting the TXMD bit, without this change no
+video output is present with DSI sinks that are setting
+MIPI_DSI_MODE_LPM flag (tested with LT8912B DSI-HDMI bridge).
+
+Previously the driver was enabling HS mode only when the DSI sink was
+not explicitly setting the MIPI_DSI_MODE_LPM, however this is not
+correct.
+
+The MIPI_DSI_MODE_LPM is supposed to indicate that the sink is willing
+to receive data in low power mode, however clearing the
+TC358768_DSI_CONTROL_TXMD bit will make the TC358768 send video in
+LP mode that is not the intended behavior.
+
+Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 4c4b77ce8aba3..23a7a1206e900 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -867,8 +867,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ val = TC358768_DSI_CONFW_MODE_SET | TC358768_DSI_CONFW_ADDR_DSI_CONTROL;
+ val |= (dsi_dev->lanes - 1) << 1;
+
+- if (!(dsi_dev->mode_flags & MIPI_DSI_MODE_LPM))
+- val |= TC358768_DSI_CONTROL_TXMD;
++ val |= TC358768_DSI_CONTROL_TXMD;
+
+ if (!(mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS))
+ val |= TC358768_DSI_CONTROL_HSCKMD;
+--
+2.39.2
+
--- /dev/null
+From 418682db9fe8e2d1424d39dfabf5eb107ae9b196 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 16:29:27 +0200
+Subject: drm/bridge: tc358768: fix PLL parameters computation
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit 6a4020b4c63911977aaf8047f904a300d15de739 ]
+
+According to Toshiba documentation the PLL input clock after the divider
+should be not less than 4MHz, fix the PLL parameters computation
+accordingly.
+
+Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 23a7a1206e900..f961259dc85bd 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -335,13 +335,17 @@ static int tc358768_calc_pll(struct tc358768_priv *priv,
+ u32 fbd;
+
+ for (fbd = 0; fbd < 512; ++fbd) {
+- u32 pll, diff;
++ u32 pll, diff, pll_in;
+
+ pll = (u32)div_u64((u64)refclk * (fbd + 1), divisor);
+
+ if (pll >= max_pll || pll < min_pll)
+ continue;
+
++ pll_in = (u32)div_u64((u64)refclk, prd + 1);
++ if (pll_in < 4000000)
++ continue;
++
+ diff = max(pll, target_pll) - min(pll, target_pll);
+
+ if (diff < best_diff) {
+--
+2.39.2
+
--- /dev/null
+From b2b6ef1e81db4a8e724f5a6204df4414e0b0bff6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 16:29:28 +0200
+Subject: drm/bridge: tc358768: fix PLL target frequency
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit ffd2e4bbea626d565b9817312b0fcfb382fecb88 ]
+
+Correctly compute the PLL target frequency, the current formula works
+correctly only when the input bus width is 24bit, actually to properly
+compute the PLL target frequency what is relevant is the bits-per-pixel
+on the DSI link.
+
+No regression expected since the DSI format is currently hard-coded as
+MIPI_DSI_FMT_RGB888.
+
+Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index f961259dc85bd..9bc726b79dd57 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -147,6 +147,7 @@ struct tc358768_priv {
+
+ u32 pd_lines; /* number of Parallel Port Input Data Lines */
+ u32 dsi_lanes; /* number of DSI Lanes */
++ u32 dsi_bpp; /* number of Bits Per Pixel over DSI */
+
+ /* Parameters for PLL programming */
+ u32 fbd; /* PLL feedback divider */
+@@ -285,12 +286,12 @@ static void tc358768_hw_disable(struct tc358768_priv *priv)
+
+ static u32 tc358768_pll_to_pclk(struct tc358768_priv *priv, u32 pll_clk)
+ {
+- return (u32)div_u64((u64)pll_clk * priv->dsi_lanes, priv->pd_lines);
++ return (u32)div_u64((u64)pll_clk * priv->dsi_lanes, priv->dsi_bpp);
+ }
+
+ static u32 tc358768_pclk_to_pll(struct tc358768_priv *priv, u32 pclk)
+ {
+- return (u32)div_u64((u64)pclk * priv->pd_lines, priv->dsi_lanes);
++ return (u32)div_u64((u64)pclk * priv->dsi_bpp, priv->dsi_lanes);
+ }
+
+ static int tc358768_calc_pll(struct tc358768_priv *priv,
+@@ -427,6 +428,7 @@ static int tc358768_dsi_host_attach(struct mipi_dsi_host *host,
+ priv->output.panel = panel;
+
+ priv->dsi_lanes = dev->lanes;
++ priv->dsi_bpp = mipi_dsi_pixel_format_to_bpp(dev->format);
+
+ /* get input ep (port0/endpoint0) */
+ ret = -EINVAL;
+@@ -438,7 +440,7 @@ static int tc358768_dsi_host_attach(struct mipi_dsi_host *host,
+ }
+
+ if (ret)
+- priv->pd_lines = mipi_dsi_pixel_format_to_bpp(dev->format);
++ priv->pd_lines = priv->dsi_bpp;
+
+ drm_bridge_add(&priv->bridge);
+
+--
+2.39.2
+
--- /dev/null
+From b131639e980166d4350283faf9f0d0002a86cc8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 16:29:30 +0200
+Subject: drm/bridge: tc358768: fix TCLK_TRAILCNT computation
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit ee18698e212b1659dd0850d7e2ae0f22e16ed3d3 ]
+
+Correct computation of TCLK_TRAILCNT register.
+
+The driver does not implement non-continuous clock mode, so the actual
+value doesn't make a practical difference yet. However this change also
+ensures that the value does not write to reserved registers bits in case
+of under/overflow.
+
+This register must be set to a value that ensures that
+
+TCLK-TRAIL > 60ns
+ and
+TEOT <= (105 ns + 12 x UI)
+
+with the actual value of TCLK-TRAIL being
+
+(TCLK_TRAILCNT + (1 to 2)) xHSByteClkCycle +
+ (2 + (1 to 2)) * HSBYTECLKCycle - (PHY output delay)
+
+with PHY output delay being about
+
+(2 to 3) x MIPIBitClk cycle in the BitClk conversion.
+
+Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 8f7efb14ebdc7..822de6e356a2c 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -10,6 +10,7 @@
+ #include <linux/i2c.h>
+ #include <linux/kernel.h>
+ #include <linux/media-bus-format.h>
++#include <linux/minmax.h>
+ #include <linux/module.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+@@ -640,6 +641,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ struct mipi_dsi_device *dsi_dev = priv->output.dev;
+ unsigned long mode_flags = dsi_dev->mode_flags;
+ u32 val, val2, lptxcnt, hact, data_type;
++ s32 raw_val;
+ const struct drm_display_mode *mode;
+ u32 dsibclk_nsk, dsiclk_nsk, ui_nsk, phy_delay_nsk;
+ u32 dsiclk, dsibclk, video_start;
+@@ -751,9 +753,9 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ dev_dbg(priv->dev, "TCLK_HEADERCNT: 0x%x\n", val);
+ tc358768_write(priv, TC358768_TCLK_HEADERCNT, val);
+
+- /* TCLK_TRAIL > 60ns + 3*UI */
+- val = 60 + tc358768_to_ns(3 * ui_nsk);
+- val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 5;
++ /* TCLK_TRAIL > 60ns AND TEOT <= 105 ns + 12*UI */
++ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(2 * ui_nsk), dsibclk_nsk) - 5;
++ val = clamp(raw_val, 0, 127);
+ dev_dbg(priv->dev, "TCLK_TRAILCNT: 0x%x\n", val);
+ tc358768_write(priv, TC358768_TCLK_TRAILCNT, val);
+
+--
+2.39.2
+
--- /dev/null
+From 4e14d5d8b36947c55aa7a4a6902527205374bb20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 16:29:29 +0200
+Subject: drm/bridge: tc358768: fix TCLK_ZEROCNT computation
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit f9cf811374f42fca31ac34aaf59ee2ae72b89879 ]
+
+Correct computation of TCLK_ZEROCNT register.
+
+This register must be set to a value that ensure that
+(TCLK-PREPARECNT + TCLK-ZERO) > 300ns
+
+with the actual value of (TCLK-PREPARECNT + TCLK-ZERO) being
+
+(1 to 2) + (TCLK_ZEROCNT + 1)) x HSByteClkCycle + (PHY output delay)
+
+with PHY output delay being about
+
+(2 to 3) x MIPIBitClk cycle in the BitClk conversion.
+
+Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 9bc726b79dd57..765bdebbd06f9 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -743,10 +743,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+
+ /* 38ns < TCLK_PREPARE < 95ns */
+ val = tc358768_ns_to_cnt(65, dsibclk_nsk) - 1;
+- /* TCLK_PREPARE > 300ns */
+- val2 = tc358768_ns_to_cnt(300 + tc358768_to_ns(3 * ui_nsk),
+- dsibclk_nsk);
+- val |= (val2 - tc358768_to_ns(phy_delay_nsk - dsibclk_nsk)) << 8;
++ /* TCLK_PREPARE + TCLK_ZERO > 300ns */
++ val2 = tc358768_ns_to_cnt(300 - tc358768_to_ns(2 * ui_nsk),
++ dsibclk_nsk) - 2;
++ val |= val2 << 8;
+ dev_dbg(priv->dev, "TCLK_HEADERCNT: 0x%x\n", val);
+ tc358768_write(priv, TC358768_TCLK_HEADERCNT, val);
+
+--
+2.39.2
+
--- /dev/null
+From 0544ccbfdeee7ad579accb54c55c3b76dfc54bec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 16:29:33 +0200
+Subject: drm/bridge: tc358768: fix THS_TRAILCNT computation
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit bac7842cd179572e8e0fc2d7b5254e40c6e9e057 ]
+
+Correct computation of THS_TRAILCNT register.
+
+This register must be set to a value that ensure that
+THS_TRAIL > 60 ns + 4 x UI
+ and
+THS_TRAIL > 8 x UI
+ and
+THS_TRAIL < TEOT
+ with
+TEOT = 105 ns + (12 x UI)
+
+with the actual value of THS_TRAIL being
+
+(1 + THS_TRAILCNT) x ByteClk cycle + ((1 to 2) + 2) xHSBYTECLK cycle +
+ - (PHY output delay)
+
+with PHY output delay being about
+
+(8 + (5 to 6)) x MIPIBitClk cycle in the BitClk conversion.
+
+Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-9-francesco@dolcini.it
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index ab408f3407ba4..2d0ac9987b58e 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -781,9 +781,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ dev_dbg(priv->dev, "TCLK_POSTCNT: 0x%x\n", val);
+ tc358768_write(priv, TC358768_TCLK_POSTCNT, val);
+
+- /* 60ns + 4*UI < THS_PREPARE < 105ns + 12*UI */
+- val = tc358768_ns_to_cnt(60 + tc358768_to_ns(15 * ui_nsk),
+- dsibclk_nsk) - 5;
++ /* max(60ns + 4*UI, 8*UI) < THS_TRAILCNT < 105ns + 12*UI */
++ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(18 * ui_nsk),
++ dsibclk_nsk) - 4;
++ val = clamp(raw_val, 0, 15);
+ dev_dbg(priv->dev, "THS_TRAILCNT: 0x%x\n", val);
+ tc358768_write(priv, TC358768_THS_TRAILCNT, val);
+
+--
+2.39.2
+
--- /dev/null
+From f671c7e20aefe5b6c152314ffb4bd51d041fc6e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 16:29:31 +0200
+Subject: drm/bridge: tc358768: fix THS_ZEROCNT computation
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit 77a089328da791118af9692543a5eedc79eb5fd4 ]
+
+Correct computation of THS_ZEROCNT register.
+
+This register must be set to a value that ensure that
+THS_PREPARE + THS_ZERO > 145ns + 10*UI
+
+with the actual value of (THS_PREPARE + THS_ZERO) being
+
+((1 to 2) + 1 + (TCLK_ZEROCNT + 1) + (3 to 4)) x ByteClk cycle +
+ + HSByteClk x (2 + (1 to 2)) + (PHY delay)
+
+with PHY delay being about
+
+(8 + (5 to 6)) x MIPIBitClk cycle in the BitClk conversion.
+
+Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-7-francesco@dolcini.it
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 822de6e356a2c..014585b9582b9 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -762,9 +762,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+ /* 40ns + 4*UI < THS_PREPARE < 85ns + 6*UI */
+ val = 50 + tc358768_to_ns(4 * ui_nsk);
+ val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 1;
+- /* THS_ZERO > 145ns + 10*UI */
+- val2 = tc358768_ns_to_cnt(145 - tc358768_to_ns(ui_nsk), dsibclk_nsk);
+- val |= (val2 - tc358768_to_ns(phy_delay_nsk)) << 8;
++ /* THS_PREPARE + THS_ZERO > 145ns + 10*UI */
++ raw_val = tc358768_ns_to_cnt(145 - tc358768_to_ns(3 * ui_nsk), dsibclk_nsk) - 10;
++ val2 = clamp(raw_val, 0, 127);
++ val |= val2 << 8;
+ dev_dbg(priv->dev, "THS_HEADERCNT: 0x%x\n", val);
+ tc358768_write(priv, TC358768_THS_HEADERCNT, val);
+
+--
+2.39.2
+
--- /dev/null
+From ba26621c6887da79fb9725f4c09b4dc3ef8a6870 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 16:29:32 +0200
+Subject: drm/bridge: tc358768: fix TXTAGOCNT computation
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit 3666aad8185af8d0ce164fd3c4974235417d6d0b ]
+
+Correct computation of TXTAGOCNT register.
+
+This register must be set to a value that ensure that the
+TTA-GO period = (4 x TLPX)
+
+with the actual value of TTA-GO being
+
+4 x (TXTAGOCNT + 1) x (HSByteClk cycle)
+
+Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-8-francesco@dolcini.it
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358768.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
+index 014585b9582b9..ab408f3407ba4 100644
+--- a/drivers/gpu/drm/bridge/tc358768.c
++++ b/drivers/gpu/drm/bridge/tc358768.c
+@@ -797,7 +797,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
+
+ /* TXTAGOCNT[26:16] RXTASURECNT[10:0] */
+ val = tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk * 4);
+- val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 1;
++ val = tc358768_ns_to_cnt(val, dsibclk_nsk) / 4 - 1;
+ val2 = tc358768_ns_to_cnt(tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk),
+ dsibclk_nsk) - 2;
+ val = val << 16 | val2;
+--
+2.39.2
+
--- /dev/null
+From bf5a38865d0656e3a531ed13c16f96c504a5b769 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 18:33:07 +0200
+Subject: drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit dd9e329af7236e34c566d3705ea32a63069b9b13 ]
+
+The datasheet describes the following initialization flow including
+minimum delay times between each step:
+
+1. DSI data lanes need to be in LP-11 and the clock lane in HS mode
+2. toggle EN signal
+3. initialize registers
+4. enable PLL
+5. soft reset
+6. enable DSI stream
+7. check error status register
+
+To meet this requirement we need to make sure the host bridge's
+pre_enable() is called first by using the pre_enable_prev_first
+flag.
+
+Furthermore we need to split enable() into pre_enable() which covers
+steps 2-5 from above and enable() which covers step 7 and is called
+after the host bridge's enable().
+
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Fixes: ceb515ba29ba ("drm/bridge: ti-sn65dsi83: Add TI SN65DSI83 and SN65DSI84 driver")
+Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> #TQMa8MxML/MBa8Mx
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230503163313.2640898-3-frieder@fris.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi83.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+index 0635b824e3682..55efd3eb66723 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+@@ -321,8 +321,8 @@ static u8 sn65dsi83_get_dsi_div(struct sn65dsi83 *ctx)
+ return dsi_div - 1;
+ }
+
+-static void sn65dsi83_atomic_enable(struct drm_bridge *bridge,
+- struct drm_bridge_state *old_bridge_state)
++static void sn65dsi83_atomic_pre_enable(struct drm_bridge *bridge,
++ struct drm_bridge_state *old_bridge_state)
+ {
+ struct sn65dsi83 *ctx = bridge_to_sn65dsi83(bridge);
+ struct drm_atomic_state *state = old_bridge_state->base.state;
+@@ -485,11 +485,22 @@ static void sn65dsi83_atomic_enable(struct drm_bridge *bridge,
+ /* Trigger reset after CSR register update. */
+ regmap_write(ctx->regmap, REG_RC_RESET, REG_RC_RESET_SOFT_RESET);
+
++ /* Wait for 10ms after soft reset as specified in datasheet */
++ usleep_range(10000, 12000);
++}
++
++static void sn65dsi83_atomic_enable(struct drm_bridge *bridge,
++ struct drm_bridge_state *old_bridge_state)
++{
++ struct sn65dsi83 *ctx = bridge_to_sn65dsi83(bridge);
++ unsigned int pval;
++
+ /* Clear all errors that got asserted during initialization. */
+ regmap_read(ctx->regmap, REG_IRQ_STAT, &pval);
+ regmap_write(ctx->regmap, REG_IRQ_STAT, pval);
+
+- usleep_range(10000, 12000);
++ /* Wait for 1ms and check for errors in status register */
++ usleep_range(1000, 1100);
+ regmap_read(ctx->regmap, REG_IRQ_STAT, &pval);
+ if (pval)
+ dev_err(ctx->dev, "Unexpected link status 0x%02x\n", pval);
+@@ -556,6 +567,7 @@ static const struct drm_bridge_funcs sn65dsi83_funcs = {
+ .attach = sn65dsi83_attach,
+ .detach = sn65dsi83_detach,
+ .atomic_enable = sn65dsi83_atomic_enable,
++ .atomic_pre_enable = sn65dsi83_atomic_pre_enable,
+ .atomic_disable = sn65dsi83_atomic_disable,
+ .mode_valid = sn65dsi83_mode_valid,
+
+@@ -696,6 +708,7 @@ static int sn65dsi83_probe(struct i2c_client *client,
+
+ ctx->bridge.funcs = &sn65dsi83_funcs;
+ ctx->bridge.of_node = dev->of_node;
++ ctx->bridge.pre_enable_prev_first = true;
+ drm_bridge_add(&ctx->bridge);
+
+ ret = sn65dsi83_host_attach(ctx);
+--
+2.39.2
+
--- /dev/null
+From 431c9c6759048c5e34b3f7ae671c956791886057 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 08:53:16 +0200
+Subject: drm/bridge: ti-sn65dsi83: Fix enable error path
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 8a91b29f1f50ce7742cdbe5cf11d17f128511f3f ]
+
+If PLL locking failed, the regulator needs to be disabled again.
+
+Fixes: 5664e3c907e2 ("drm/bridge: ti-sn65dsi83: Add vcc supply regulator support")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230504065316.2640739-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi83.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+index 047c14ddbbf11..0635b824e3682 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+@@ -478,6 +478,7 @@ static void sn65dsi83_atomic_enable(struct drm_bridge *bridge,
+ dev_err(ctx->dev, "failed to lock PLL, ret=%i\n", ret);
+ /* On failure, disable PLL again and exit. */
+ regmap_write(ctx->regmap, REG_RC_PLL_EN, 0x00);
++ regulator_disable(ctx->vcc);
+ return;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From af405c4ed856355211038cc3b1504bdd682a7454 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Apr 2023 04:13:29 +0300
+Subject: drm/msm/a5xx: really check for A510 in a5xx_gpu_init
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 736a9327365644b460e4498b1ce172ca411efcbc ]
+
+The commit 010c8bbad2cb ("drm: msm: adreno: Disable preemption on Adreno
+510") added special handling for a510 (this SKU doesn't seem to support
+preemption, so the driver should clamp nr_rings to 1). However the
+gpu->revn is not yet set (it is set later, in adreno_gpu_init()) and
+thus the condition is always false. Check config->rev instead.
+
+Fixes: 010c8bbad2cb ("drm: msm: adreno: Disable preemption on Adreno 510")
+Reported-by: Adam Skladowski <a39.skl@gmail.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Adam Skladowski <a39.skl@gmail.com>
+Patchwork: https://patchwork.freedesktop.org/patch/531511/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index 24feae285ccd6..0829eaf2cd4e8 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -1740,6 +1740,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev)
+ {
+ struct msm_drm_private *priv = dev->dev_private;
+ struct platform_device *pdev = priv->gpu_pdev;
++ struct adreno_platform_config *config = pdev->dev.platform_data;
+ struct a5xx_gpu *a5xx_gpu = NULL;
+ struct adreno_gpu *adreno_gpu;
+ struct msm_gpu *gpu;
+@@ -1766,7 +1767,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev)
+
+ nr_rings = 4;
+
+- if (adreno_is_a510(adreno_gpu))
++ if (adreno_cmp_rev(ADRENO_REV(5, 1, 0, ANY_ID), config->rev))
+ nr_rings = 1;
+
+ ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, nr_rings);
+--
+2.39.2
+
--- /dev/null
+From ead65d25fcf2727796511e838883d817d9654c13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Mar 2023 22:03:08 +0530
+Subject: drm/msm/disp/dpu: get timing engine status from intf status register
+
+From: Vinod Polimera <quic_vpolimer@quicinc.com>
+
+[ Upstream commit e3969eadc8ee78a5bdca65b8ed0a421a359e4090 ]
+
+Recommended way of reading the interface timing gen status is via
+status register. Timing gen status register will give a reliable status
+of the interface especially during ON/OFF transitions. This support was
+added from DPU version 5.0.0.
+
+Signed-off-by: Vinod Polimera <quic_vpolimer@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/524724/
+Link: https://lore.kernel.org/r/1677774797-31063-6-git-send-email-quic_vpolimer@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Stable-dep-of: a7129231edf3 ("drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 3 ++-
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 12 +++++++-----
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 8 +++++++-
+ 3 files changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+index 32a3c42ec45b1..715c7a254632b 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+@@ -79,7 +79,8 @@
+
+ #define INTF_SDM845_MASK (0)
+
+-#define INTF_SC7180_MASK BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE)
++#define INTF_SC7180_MASK \
++ (BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE) | BIT(DPU_INTF_STATUS_SUPPORTED))
+
+ #define INTF_SC7280_MASK INTF_SC7180_MASK | BIT(DPU_DATA_HCTL_EN)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+index 38aa38ab15685..77c46ce5a22f9 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+@@ -203,17 +203,19 @@ enum {
+
+ /**
+ * INTF sub-blocks
+- * @DPU_INTF_INPUT_CTRL Supports the setting of pp block from which
+- * pixel data arrives to this INTF
+- * @DPU_INTF_TE INTF block has TE configuration support
+- * @DPU_DATA_HCTL_EN Allows data to be transferred at different rate
+- than video timing
++ * @DPU_INTF_INPUT_CTRL Supports the setting of pp block from which
++ * pixel data arrives to this INTF
++ * @DPU_INTF_TE INTF block has TE configuration support
++ * @DPU_DATA_HCTL_EN Allows data to be transferred at different rate
++ * than video timing
++ * @DPU_INTF_STATUS_SUPPORTED INTF block has INTF_STATUS register
+ * @DPU_INTF_MAX
+ */
+ enum {
+ DPU_INTF_INPUT_CTRL = 0x1,
+ DPU_INTF_TE,
+ DPU_DATA_HCTL_EN,
++ DPU_INTF_STATUS_SUPPORTED,
+ DPU_INTF_MAX
+ };
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+index b2a94b9a3e987..b9dddf576c029 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+@@ -57,6 +57,7 @@
+ #define INTF_PROG_FETCH_START 0x170
+ #define INTF_PROG_ROT_START 0x174
+ #define INTF_MUX 0x25C
++#define INTF_STATUS 0x26C
+
+ #define INTF_CFG_ACTIVE_H_EN BIT(29)
+ #define INTF_CFG_ACTIVE_V_EN BIT(30)
+@@ -292,8 +293,13 @@ static void dpu_hw_intf_get_status(
+ struct intf_status *s)
+ {
+ struct dpu_hw_blk_reg_map *c = &intf->hw;
++ unsigned long cap = intf->cap->features;
++
++ if (cap & BIT(DPU_INTF_STATUS_SUPPORTED))
++ s->is_en = DPU_REG_READ(c, INTF_STATUS) & BIT(0);
++ else
++ s->is_en = DPU_REG_READ(c, INTF_TIMING_ENGINE_EN);
+
+- s->is_en = DPU_REG_READ(c, INTF_TIMING_ENGINE_EN);
+ s->is_prog_fetch_en = !!(DPU_REG_READ(c, INTF_CONFIG) & BIT(31));
+ if (s->is_en) {
+ s->frame_count = DPU_REG_READ(c, INTF_FRAME_COUNT);
+--
+2.39.2
+
--- /dev/null
+From 5df25001fa6d18147428dcc3b23f6c2d1f44273b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jun 2023 15:02:59 -0700
+Subject: drm/msm/dp: Free resources after unregistering them
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit fa0048a4b1fa7a50c8b0e514f5b428abdf69a6f8 ]
+
+The DP component's unbind operation walks through the submodules to
+unregister and clean things up. But if the unbind happens because the DP
+controller itself is being removed, all the memory for those submodules
+has just been freed.
+
+Change the order of these operations to avoid the many use-after-free
+that otherwise happens in this code path.
+
+Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support")
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/542166/
+Link: https://lore.kernel.org/r/20230612220259.1884381-1-quic_bjorande@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
+index 57b82e5d0ab12..d16c12351adb6 100644
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -1342,9 +1342,9 @@ static int dp_display_remove(struct platform_device *pdev)
+ {
+ struct dp_display_private *dp = dev_get_dp_display_private(&pdev->dev);
+
++ component_del(&pdev->dev, &dp_display_comp_ops);
+ dp_display_deinit_sub_modules(dp);
+
+- component_del(&pdev->dev, &dp_display_comp_ops);
+ platform_set_drvdata(pdev, NULL);
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 83502f86a85ce439b0d2d6b2b399da40f222ab89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jun 2023 03:09:41 +0300
+Subject: drm/msm/dpu: correct MERGE_3D length
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 9a6c13b847d61b0c3796820ca6e976789df59cd8 ]
+
+Each MERGE_3D block has just two registers. Correct the block length
+accordingly.
+
+Fixes: 4369c93cf36b ("drm/msm/dpu: initial support for merge3D hardware block")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/542177/
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Link: https://lore.kernel.org/r/20230613001004.3426676-3-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+index 80e59d3f9dd3e..b2f330e99b0cd 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+@@ -1203,7 +1203,7 @@ static struct dpu_pingpong_cfg qcm2290_pp[] = {
+ #define MERGE_3D_BLK(_name, _id, _base) \
+ {\
+ .name = _name, .id = _id, \
+- .base = _base, .len = 0x100, \
++ .base = _base, .len = 0x8, \
+ .features = MERGE_3D_SM8150_MASK, \
+ .sblk = NULL \
+ }
+--
+2.39.2
+
--- /dev/null
+From 0c4b0924a6ac451789e6b799fe24a39e17679730 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jun 2023 21:25:33 +0300
+Subject: drm/msm/dpu: do not enable color-management if DSPPs are not
+ available
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 3bcfc7b90465efd337d39b91b43972162f0d1908 ]
+
+We can not support color management without DSPP blocks being provided
+in the HW catalog. Do not enable color management for CRTCs if num_dspps
+is 0.
+
+Fixes: 4259ff7ae509 ("drm/msm/dpu: add support for pcc color block in dpu driver")
+Reported-by: Yongqin Liu <yongqin.liu@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Sumit Semwal <sumit.semwal@linaro.org>
+Tested-by: Yongqin Liu <yongqin.liu@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/542141/
+Link: https://lore.kernel.org/r/20230612182534.3345805-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index c9d1c412628e9..6c0ffe8e4adbd 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -1579,6 +1579,8 @@ static const struct drm_crtc_helper_funcs dpu_crtc_helper_funcs = {
+ struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane,
+ struct drm_plane *cursor)
+ {
++ struct msm_drm_private *priv = dev->dev_private;
++ struct dpu_kms *dpu_kms = to_dpu_kms(priv->kms);
+ struct drm_crtc *crtc = NULL;
+ struct dpu_crtc *dpu_crtc = NULL;
+ int i;
+@@ -1610,7 +1612,8 @@ struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane,
+
+ drm_crtc_helper_add(crtc, &dpu_crtc_helper_funcs);
+
+- drm_crtc_enable_color_mgmt(crtc, 0, true, 0);
++ if (dpu_kms->catalog->dspp_count)
++ drm_crtc_enable_color_mgmt(crtc, 0, true, 0);
+
+ /* save user friendly CRTC name for later */
+ snprintf(dpu_crtc->name, DPU_CRTC_NAME_SIZE, "crtc%u", crtc->base.id);
+--
+2.39.2
+
--- /dev/null
+From c1d21963a72e92a598816dc179736082d58d281d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 May 2023 10:45:20 -0700
+Subject: drm/msm/dpu: Fix slice_last_group_size calculation
+
+From: Jessica Zhang <quic_jesszhan@quicinc.com>
+
+[ Upstream commit c223059e6f8340f7eac2319470984cbfc39c433b ]
+
+Correct the math for slice_last_group_size so that it matches the
+calculations downstream.
+
+Fixes: c110cfd1753e ("drm/msm/disp/dpu1: Add support for DSC")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/539269/
+Link: https://lore.kernel.org/r/20230329-rfc-msm-dsc-helper-v14-7-bafc7be95691@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c
+index 3662df698dae5..c8f14555834a8 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c
+@@ -52,9 +52,10 @@ static void dpu_hw_dsc_config(struct dpu_hw_dsc *hw_dsc,
+ if (is_cmd_mode)
+ initial_lines += 1;
+
+- slice_last_group_size = 3 - (dsc->slice_width % 3);
++ slice_last_group_size = (dsc->slice_width + 2) % 3;
++
+ data = (initial_lines << 20);
+- data |= ((slice_last_group_size - 1) << 18);
++ data |= (slice_last_group_size << 18);
+ /* bpp is 6.4 format, 4 LSBs bits are for fractional part */
+ data |= (dsc->bits_per_pixel << 8);
+ data |= (dsc->block_pred_enable << 7);
+--
+2.39.2
+
--- /dev/null
+From 0565f24c9c04fdea4d867d1cd1e8185438f84e44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 May 2023 20:49:59 +0200
+Subject: drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit a7129231edf329a00e92dbd2d741f6da728a4a06 ]
+
+DPU5 and newer targets enable this unconditionally. Move it from the
+SC7280 mask to the SC7180 one.
+
+Fixes: 7e6ee55320f0 ("drm/msm/disp/dpu1: enable DATA_HCTL_EN for sc7280 target")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/538159/
+Link: https://lore.kernel.org/r/20230508-topic-hctl_en-v2-1-e7bea9f1f5dd@linaro.org
+[DB: removed BIT(DPU_INTF_DATA_COMPRESS), which is not yet merged]
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+index 715c7a254632b..80e59d3f9dd3e 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+@@ -80,9 +80,12 @@
+ #define INTF_SDM845_MASK (0)
+
+ #define INTF_SC7180_MASK \
+- (BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE) | BIT(DPU_INTF_STATUS_SUPPORTED))
++ (BIT(DPU_INTF_INPUT_CTRL) | \
++ BIT(DPU_INTF_TE) | \
++ BIT(DPU_INTF_STATUS_SUPPORTED) | \
++ BIT(DPU_DATA_HCTL_EN))
+
+-#define INTF_SC7280_MASK INTF_SC7180_MASK | BIT(DPU_DATA_HCTL_EN)
++#define INTF_SC7280_MASK (INTF_SC7180_MASK)
+
+ #define IRQ_SDM845_MASK (BIT(MDP_SSPP_TOP0_INTR) | \
+ BIT(MDP_SSPP_TOP0_INTR2) | \
+--
+2.39.2
+
--- /dev/null
+From a1e78d83ff1ba1a8cf89e288240283f319308f02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 10:40:49 -0700
+Subject: drm/msm/dpu: set DSC flush bit correctly at MDP CTL flush register
+
+From: Kuogee Hsieh <quic_khsieh@quicinc.com>
+
+[ Upstream commit 12cef323c903bd8b13d1f6ff24a9695c2cdc360b ]
+
+The CTL_FLUSH register should be programmed with the 22th bit
+(DSC_IDX) to flush the DSC hardware blocks, not the literal value of
+22 (which corresponds to flushing VIG1, VIG2 and RGB1 instead).
+
+Changes in V12:
+-- split this patch out of "separate DSC flush update out of interface"
+
+Changes in V13:
+-- rewording the commit text
+
+Changes in V14:
+-- drop 'DSC" from "The DSC CTL_FLUSH register" at commit text
+
+Fixes: 77f6da90487c ("drm/msm/disp/dpu1: Add DSC support in hw_ctl")
+Signed-off-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Patchwork: https://patchwork.freedesktop.org/patch/539496/
+Link: https://lore.kernel.org/r/1685036458-22683-2-git-send-email-quic_khsieh@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+index a35ecb6676c88..696c32d30d10c 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+@@ -550,7 +550,7 @@ static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx,
+ DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE,
+ BIT(cfg->merge_3d - MERGE_3D_0));
+ if (cfg->dsc) {
+- DPU_REG_WRITE(&ctx->hw, CTL_FLUSH, DSC_IDX);
++ DPU_REG_WRITE(&ctx->hw, CTL_FLUSH, BIT(DSC_IDX));
+ DPU_REG_WRITE(c, CTL_DSC_ACTIVE, cfg->dsc);
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 0fe6567477f62c749403d7bc6c8e7dda15f574f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 May 2023 04:12:57 +0300
+Subject: drm/msm/dsi: don't allow enabling 14nm VCO with unprogrammed rate
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 1e0a97f84d73ea1182740f62069690c7f3271abb ]
+
+If the dispcc uses CLK_OPS_PARENT_ENABLE (e.g. on QCM2290), CCF can try
+enabling VCO before the rate has been programmed. This can cause clock
+lockups and/or other boot issues. Program the VCO to the minimal PLL
+rate if the read rate is 0 Hz.
+
+Cc: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reported-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Reported-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Fixes: f079f6d999cb ("drm/msm/dsi: Add PHY/PLL for 8x96")
+Patchwork: https://patchwork.freedesktop.org/patch/534813/
+Link: https://lore.kernel.org/r/20230501011257.3460103-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
+index 0f8f4ca464291..f0780c40b379a 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
+@@ -539,6 +539,9 @@ static int dsi_pll_14nm_vco_prepare(struct clk_hw *hw)
+ if (unlikely(pll_14nm->phy->pll_on))
+ return 0;
+
++ if (dsi_pll_14nm_vco_recalc_rate(hw, VCO_REF_CLK_RATE) == 0)
++ dsi_pll_14nm_vco_set_rate(hw, pll_14nm->phy->cfg->min_pll_rate, VCO_REF_CLK_RATE);
++
+ dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_VREF_CFG1, 0x10);
+ dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_PLL_CNTRL, 1);
+
+--
+2.39.2
+
--- /dev/null
+From 8789d89aede8e7c68c449beba649be79f9769fe9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Dec 2022 00:19:38 +0100
+Subject: drm/msm/dsi: Flip greater-than check for slice_count and
+ slice_per_intf
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit 82e72fd22a8f9eff4e75c08be68319008ea90a29 ]
+
+According to downstream /and the comment copied from it/ this comparison
+should be the other way around. In other words, when the panel driver
+requests to use more slices per packet than what could be sent over this
+interface, it is bumped down to only use a single slice per packet (and
+strangely not the number of slices that could fit on the interface).
+
+Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/515686/
+Link: https://lore.kernel.org/r/20221221231943.1961117-4-marijn.suijten@somainline.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Stable-dep-of: 155fa3a91d64 ("drm/msm/dsi: Remove incorrect references to slice_count")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 5ab5e872c3cf1..ef988e4c21045 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -853,11 +853,12 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod
+ */
+ slice_per_intf = DIV_ROUND_UP(hdisplay, dsc->slice_width);
+
+- /* If slice_per_pkt is greater than slice_per_intf
++ /*
++ * If slice_count is greater than slice_per_intf
+ * then default to 1. This can happen during partial
+ * update.
+ */
+- if (slice_per_intf > dsc->slice_count)
++ if (dsc->slice_count > slice_per_intf)
+ dsc->slice_count = 1;
+
+ total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf;
+--
+2.39.2
+
--- /dev/null
+From 7bb09875453c3f6cb8ba027d6e22fa45fd4be102 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 15:57:17 -0700
+Subject: drm/msm/dsi: Remove incorrect references to slice_count
+
+From: Jessica Zhang <quic_jesszhan@quicinc.com>
+
+[ Upstream commit 155fa3a91d64221eb0885fd221cc8085dbef908f ]
+
+Currently, slice_count is being used to calculate word count and
+pkt_per_line. Instead, these values should be calculated using slice per
+packet, which is not the same as slice_count.
+
+Slice count represents the number of slices per interface, and its value
+will not always match that of slice per packet. For example, it is possible
+to have cases where there are multiple slices per interface but the panel
+specifies only one slice per packet.
+
+Thus, use the default value of one slice per packet and remove slice_count
+from the aforementioned calculations.
+
+Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration")
+Fixes: bc6b6ff8135c ("drm/msm/dsi: Use DSC slice(s) packet size to compute word count")
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/541965/
+Link: https://lore.kernel.org/r/20230405-add-dsc-support-v6-5-95eab864d1b6@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index ef988e4c21045..b433ccfe4d7da 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -853,18 +853,17 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod
+ */
+ slice_per_intf = DIV_ROUND_UP(hdisplay, dsc->slice_width);
+
+- /*
+- * If slice_count is greater than slice_per_intf
+- * then default to 1. This can happen during partial
+- * update.
+- */
+- if (dsc->slice_count > slice_per_intf)
+- dsc->slice_count = 1;
+-
+ total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf;
+
+ eol_byte_num = total_bytes_per_intf % 3;
+- pkt_per_line = slice_per_intf / dsc->slice_count;
++
++ /*
++ * Typically, pkt_per_line = slice_per_intf * slice_per_pkt.
++ *
++ * Since the current driver only supports slice_per_pkt = 1,
++ * pkt_per_line will be equal to slice per intf for now.
++ */
++ pkt_per_line = slice_per_intf;
+
+ if (is_cmd_mode) /* packet data type */
+ reg = DSI_COMMAND_COMPRESSION_MODE_CTRL_STREAM0_DATATYPE(MIPI_DSI_DCS_LONG_WRITE);
+@@ -988,7 +987,14 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)
+ if (!msm_host->dsc)
+ wc = hdisplay * dsi_get_bpp(msm_host->format) / 8 + 1;
+ else
+- wc = msm_host->dsc->slice_chunk_size * msm_host->dsc->slice_count + 1;
++ /*
++ * When DSC is enabled, WC = slice_chunk_size * slice_per_pkt + 1.
++ * Currently, the driver only supports default value of slice_per_pkt = 1
++ *
++ * TODO: Expand mipi_dsi_device struct to hold slice_per_pkt info
++ * and adjust DSC math to account for slice_per_pkt.
++ */
++ wc = msm_host->dsc->slice_chunk_size + 1;
+
+ dsi_write(msm_host, REG_DSI_CMD_MDP_STREAM0_CTRL,
+ DSI_CMD_MDP_STREAM0_CTRL_WORD_COUNT(wc) |
+--
+2.39.2
+
--- /dev/null
+From 89313b0ea2508e25ab66f171639b86a8ecfeddb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Dec 2022 00:19:37 +0100
+Subject: drm/msm/dsi: Use DSC slice(s) packet size to compute word count
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit bc6b6ff8135c4b96787eda88f3baf653939a75ce ]
+
+According to downstream the value to use for WORD_COUNT is
+bytes_per_pkt, which denotes the number of bytes in a packet based on
+how many slices have been configured by the panel driver times the
+width of a slice times the number of bytes per pixel.
+
+The DSC panels seen thus far use one byte per pixel, only one slice
+per packet, and a slice width of half the panel width leading to the
+desired bytes_per_pkt+1 value to be equal to hdisplay/2+1. This however
+isn't the case anymore for panels that configure two slices per packet,
+where the value should now be hdisplay+1.
+
+Note that the aforementioned panel (on a Sony Xperia XZ3, sdm845) with
+slice_count=1 has also been tested to successfully accept slice_count=2,
+which would have shown corrupted output previously.
+
+Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/515694/
+Link: https://lore.kernel.org/r/20221221231943.1961117-3-marijn.suijten@somainline.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Stable-dep-of: 155fa3a91d64 ("drm/msm/dsi: Remove incorrect references to slice_count")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index f167a45f1fbdd..5ab5e872c3cf1 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -987,7 +987,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)
+ if (!msm_host->dsc)
+ wc = hdisplay * dsi_get_bpp(msm_host->format) / 8 + 1;
+ else
+- wc = mode->hdisplay / 2 + 1;
++ wc = msm_host->dsc->slice_chunk_size * msm_host->dsc->slice_count + 1;
+
+ dsi_write(msm_host, REG_DSI_CMD_MDP_STREAM0_CTRL,
+ DSI_CMD_MDP_STREAM0_CTRL_WORD_COUNT(wc) |
+--
+2.39.2
+
--- /dev/null
+From bda9e0ed299858d24c3a2ca3c52da29710b7360f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 May 2023 20:26:38 +0300
+Subject: drm/panel: sharp-ls043t1le01: adjust mode settings
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit dee23b2c9e3ff46d59c5d45e1436eceb878e7c9a ]
+
+Using current settings causes panel flickering on APQ8074 dragonboard.
+Adjust panel settings to follow the vendor-provided mode. This also
+enables MIPI_DSI_MODE_VIDEO_SYNC_PULSE, which is also specified by the
+vendor dtsi for the mentioned dragonboard.
+
+Fixes: ee0172383190 ("drm/panel: Add Sharp LS043T1LE01 MIPI DSI panel")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230507172639.2320934-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
+index d1ec80a3e3c72..ef148504cf24a 100644
+--- a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
++++ b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
+@@ -192,15 +192,15 @@ static int sharp_nt_panel_enable(struct drm_panel *panel)
+ }
+
+ static const struct drm_display_mode default_mode = {
+- .clock = 41118,
++ .clock = (540 + 48 + 32 + 80) * (960 + 3 + 10 + 15) * 60 / 1000,
+ .hdisplay = 540,
+ .hsync_start = 540 + 48,
+- .hsync_end = 540 + 48 + 80,
+- .htotal = 540 + 48 + 80 + 32,
++ .hsync_end = 540 + 48 + 32,
++ .htotal = 540 + 48 + 32 + 80,
+ .vdisplay = 960,
+ .vsync_start = 960 + 3,
+- .vsync_end = 960 + 3 + 15,
+- .vtotal = 960 + 3 + 15 + 1,
++ .vsync_end = 960 + 3 + 10,
++ .vtotal = 960 + 3 + 10 + 15,
+ };
+
+ static int sharp_nt_panel_get_modes(struct drm_panel *panel,
+@@ -280,6 +280,7 @@ static int sharp_nt_panel_probe(struct mipi_dsi_device *dsi)
+ dsi->lanes = 2;
+ dsi->format = MIPI_DSI_FMT_RGB888;
+ dsi->mode_flags = MIPI_DSI_MODE_VIDEO |
++ MIPI_DSI_MODE_VIDEO_SYNC_PULSE |
+ MIPI_DSI_MODE_VIDEO_HSE |
+ MIPI_DSI_CLOCK_NON_CONTINUOUS |
+ MIPI_DSI_MODE_NO_EOT_PACKET;
+--
+2.39.2
+
--- /dev/null
+From 15921532bc692092c267c4fcec00c651802f8206 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 10:50:39 +0200
+Subject: drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
+
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+
+[ Upstream commit f24b49550814fdee4a98b9552e35e243ccafd4a8 ]
+
+The previous setting was related to the overall dimension and not to the
+active display area.
+In the "PHYSICAL SPECIFICATIONS" section, the datasheet shows the
+following parameters:
+
+ ----------------------------------------------------------
+| Item | Specifications | unit |
+ ----------------------------------------------------------
+| Display area | 98.7 (W) x 57.5 (H) | mm |
+ ----------------------------------------------------------
+| Overall dimension | 105.5(W) x 67.2(H) x 4.96(D) | mm |
+ ----------------------------------------------------------
+
+Fixes: 966fea78adf2 ("drm/panel: simple: Add support for Ampire AM-480272H3TMQW-T01H")
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+[narmstrong: fixed Fixes commit id length]
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230516085039.3797303-1-dario.binacchi@amarulasolutions.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 8a3b685c2fcc0..7ca00b0323362 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -759,8 +759,8 @@ static const struct panel_desc ampire_am_480272h3tmqw_t01h = {
+ .num_modes = 1,
+ .bpc = 8,
+ .size = {
+- .width = 105,
+- .height = 67,
++ .width = 99,
++ .height = 58,
+ },
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X24,
+ };
+--
+2.39.2
+
--- /dev/null
+From 0295515b72d81abaaf390d624a987971add86d05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 May 2023 08:33:27 -0700
+Subject: drm/radeon: fix possible division-by-zero errors
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 1becc57cd1a905e2aa0e1eca60d2a37744525c4a ]
+
+Function rv740_get_decoded_reference_divider() may return 0 due to
+unpredictable reference divider value calculated in
+radeon_atom_get_clock_dividers(). This will lead to
+division-by-zero error once that value is used as a divider
+in calculating 'clk_s'.
+While unlikely, this issue should nonetheless be prevented so add a
+sanity check for such cases by testing 'decoded_ref' value against 0.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+v2: minor coding style fixes (Alex)
+In practice this should actually happen as the vbios should be
+properly populated.
+
+Fixes: 66229b200598 ("drm/radeon/kms: add dpm support for rv7xx (v4)")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/cypress_dpm.c | 8 ++++++--
+ drivers/gpu/drm/radeon/ni_dpm.c | 8 ++++++--
+ drivers/gpu/drm/radeon/rv740_dpm.c | 8 ++++++--
+ 3 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
+index fdddbbaecbb74..72a0768df00f7 100644
+--- a/drivers/gpu/drm/radeon/cypress_dpm.c
++++ b/drivers/gpu/drm/radeon/cypress_dpm.c
+@@ -557,8 +557,12 @@ static int cypress_populate_mclk_value(struct radeon_device *rdev,
+ ASIC_INTERNAL_MEMORY_SS, vco_freq)) {
+ u32 reference_clock = rdev->clock.mpll.reference_freq;
+ u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div);
+- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
+- u32 clk_v = ss.percentage *
++ u32 clk_s, clk_v;
++
++ if (!decoded_ref)
++ return -EINVAL;
++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
++ clk_v = ss.percentage *
+ (0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625);
+
+ mpll_ss1 &= ~CLKV_MASK;
+diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
+index 672d2239293e0..3e1c1a392fb7b 100644
+--- a/drivers/gpu/drm/radeon/ni_dpm.c
++++ b/drivers/gpu/drm/radeon/ni_dpm.c
+@@ -2241,8 +2241,12 @@ static int ni_populate_mclk_value(struct radeon_device *rdev,
+ ASIC_INTERNAL_MEMORY_SS, vco_freq)) {
+ u32 reference_clock = rdev->clock.mpll.reference_freq;
+ u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div);
+- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
+- u32 clk_v = ss.percentage *
++ u32 clk_s, clk_v;
++
++ if (!decoded_ref)
++ return -EINVAL;
++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
++ clk_v = ss.percentage *
+ (0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625);
+
+ mpll_ss1 &= ~CLKV_MASK;
+diff --git a/drivers/gpu/drm/radeon/rv740_dpm.c b/drivers/gpu/drm/radeon/rv740_dpm.c
+index d57a3e1df8d63..4464fd21a3029 100644
+--- a/drivers/gpu/drm/radeon/rv740_dpm.c
++++ b/drivers/gpu/drm/radeon/rv740_dpm.c
+@@ -249,8 +249,12 @@ int rv740_populate_mclk_value(struct radeon_device *rdev,
+ ASIC_INTERNAL_MEMORY_SS, vco_freq)) {
+ u32 reference_clock = rdev->clock.mpll.reference_freq;
+ u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div);
+- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
+- u32 clk_v = 0x40000 * ss.percentage *
++ u32 clk_s, clk_v;
++
++ if (!decoded_ref)
++ return -EINVAL;
++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
++ clk_v = 0x40000 * ss.percentage *
+ (dividers.whole_fb_div + (dividers.frac_fb_div / 8)) / (clk_s * 10000);
+
+ mpll_ss1 &= ~CLKV_MASK;
+--
+2.39.2
+
--- /dev/null
+From 08773b1d2c89ad7022fa51b5635bbbf7da5590d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Apr 2023 19:23:46 +0800
+Subject: drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
+
+From: XuDong Liu <m202071377@hust.edu.cn>
+
+[ Upstream commit 123ee07ba5b7123e0ce0e0f9d64938026c16a2ce ]
+
+Smatch reports:
+drivers/gpu/drm/sun4i/sun4i_tcon.c:805 sun4i_tcon_init_clocks() warn:
+'tcon->clk' from clk_prepare_enable() not released on lines: 792,801.
+
+In the function sun4i_tcon_init_clocks(), tcon->clk and tcon->sclk0 are
+not disabled in the error handling, which affects the release of
+these variable. Although sun4i_tcon_bind(), which calls
+sun4i_tcon_init_clocks(), use sun4i_tcon_free_clocks to disable the
+variables mentioned, but the error handling branch of
+sun4i_tcon_init_clocks() ignores the required disable process.
+
+To fix this issue, use the devm_clk_get_enabled to automatically
+balance enable and disabled calls. As original implementation use
+sun4i_tcon_free_clocks() to disable clk explicitly, we delete the
+related calls and error handling that are no longer needed.
+
+Fixes: 9026e0d122ac ("drm: Add Allwinner A10 Display Engine support")
+Fixes: b14e945bda8a ("drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init")
+Fixes: 8e9240472522 ("drm/sun4i: support TCONs without channel 1")
+Fixes: 34d698f6e349 ("drm/sun4i: Add has_channel_0 TCON quirk")
+Signed-off-by: XuDong Liu <m202071377@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230430112347.4689-1-m202071377@hust.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_tcon.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+index 523a6d7879210..936796851ffd3 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -778,21 +778,19 @@ static irqreturn_t sun4i_tcon_handler(int irq, void *private)
+ static int sun4i_tcon_init_clocks(struct device *dev,
+ struct sun4i_tcon *tcon)
+ {
+- tcon->clk = devm_clk_get(dev, "ahb");
++ tcon->clk = devm_clk_get_enabled(dev, "ahb");
+ if (IS_ERR(tcon->clk)) {
+ dev_err(dev, "Couldn't get the TCON bus clock\n");
+ return PTR_ERR(tcon->clk);
+ }
+- clk_prepare_enable(tcon->clk);
+
+ if (tcon->quirks->has_channel_0) {
+- tcon->sclk0 = devm_clk_get(dev, "tcon-ch0");
++ tcon->sclk0 = devm_clk_get_enabled(dev, "tcon-ch0");
+ if (IS_ERR(tcon->sclk0)) {
+ dev_err(dev, "Couldn't get the TCON channel 0 clock\n");
+ return PTR_ERR(tcon->sclk0);
+ }
+ }
+- clk_prepare_enable(tcon->sclk0);
+
+ if (tcon->quirks->has_channel_1) {
+ tcon->sclk1 = devm_clk_get(dev, "tcon-ch1");
+@@ -805,12 +803,6 @@ static int sun4i_tcon_init_clocks(struct device *dev,
+ return 0;
+ }
+
+-static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon)
+-{
+- clk_disable_unprepare(tcon->sclk0);
+- clk_disable_unprepare(tcon->clk);
+-}
+-
+ static int sun4i_tcon_init_irq(struct device *dev,
+ struct sun4i_tcon *tcon)
+ {
+@@ -1223,14 +1215,14 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master,
+ ret = sun4i_tcon_init_regmap(dev, tcon);
+ if (ret) {
+ dev_err(dev, "Couldn't init our TCON regmap\n");
+- goto err_free_clocks;
++ goto err_assert_reset;
+ }
+
+ if (tcon->quirks->has_channel_0) {
+ ret = sun4i_dclk_create(dev, tcon);
+ if (ret) {
+ dev_err(dev, "Couldn't create our TCON dot clock\n");
+- goto err_free_clocks;
++ goto err_assert_reset;
+ }
+ }
+
+@@ -1293,8 +1285,6 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master,
+ err_free_dotclock:
+ if (tcon->quirks->has_channel_0)
+ sun4i_dclk_free(tcon);
+-err_free_clocks:
+- sun4i_tcon_free_clocks(tcon);
+ err_assert_reset:
+ reset_control_assert(tcon->lcd_rst);
+ return ret;
+@@ -1308,7 +1298,6 @@ static void sun4i_tcon_unbind(struct device *dev, struct device *master,
+ list_del(&tcon->list);
+ if (tcon->quirks->has_channel_0)
+ sun4i_dclk_free(tcon);
+- sun4i_tcon_free_clocks(tcon);
+ }
+
+ static const struct component_ops sun4i_tcon_ops = {
+--
+2.39.2
+
--- /dev/null
+From a51eadced127bf53b8b204b4952a6ffd2eef54ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 07:40:45 -0300
+Subject: drm/vkms: Fix RGB565 pixel conversion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+[ Upstream commit ab87f558dcfb2562c3497e89600dec798a446665 ]
+
+Currently, the pixel conversion isn't rounding the fixed-point values
+before assigning it to the RGB coefficients, which is causing the IGT
+pixel-format tests to fail. So, use the drm_fixp2int_round() fixed-point
+helper to round the values when assigning it to the RGB coefficients.
+
+Tested with igt@kms_plane@pixel-format and igt@kms_plane@pixel-format-source-clamping.
+
+[v2]:
+ * Use drm_fixp2int_round() to fix the pixel conversion instead of
+ casting the values to s32 (Melissa Wen).
+
+Fixes: 89b03aeaef16 ("drm/vkms: fix 32bit compilation error by replacing macros")
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Reviewed-by: Arthur Grillo <arthurgrillo@riseup.net>
+Signed-off-by: Maíra Canal <mairacanal@riseup.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230512104044.65034-2-mcanal@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vkms/vkms_formats.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/vkms/vkms_formats.c b/drivers/gpu/drm/vkms/vkms_formats.c
+index 8d948c73741ef..b11342026485f 100644
+--- a/drivers/gpu/drm/vkms/vkms_formats.c
++++ b/drivers/gpu/drm/vkms/vkms_formats.c
+@@ -97,9 +97,9 @@ static void RGB565_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
+ s64 fp_b = drm_int2fixp(rgb_565 & 0x1f);
+
+ out_pixel->a = (u16)0xffff;
+- out_pixel->r = drm_fixp2int(drm_fixp_mul(fp_r, fp_rb_ratio));
+- out_pixel->g = drm_fixp2int(drm_fixp_mul(fp_g, fp_g_ratio));
+- out_pixel->b = drm_fixp2int(drm_fixp_mul(fp_b, fp_rb_ratio));
++ out_pixel->r = drm_fixp2int_round(drm_fixp_mul(fp_r, fp_rb_ratio));
++ out_pixel->g = drm_fixp2int_round(drm_fixp_mul(fp_g, fp_g_ratio));
++ out_pixel->b = drm_fixp2int_round(drm_fixp_mul(fp_b, fp_rb_ratio));
+ }
+
+ void vkms_compose_row(struct line_buffer *stage_buffer, struct vkms_plane_state *plane, int y)
+@@ -216,9 +216,9 @@ static void argb_u16_to_RGB565(struct vkms_frame_info *frame_info,
+ s64 fp_g = drm_int2fixp(in_pixels[x].g);
+ s64 fp_b = drm_int2fixp(in_pixels[x].b);
+
+- u16 r = drm_fixp2int(drm_fixp_div(fp_r, fp_rb_ratio));
+- u16 g = drm_fixp2int(drm_fixp_div(fp_g, fp_g_ratio));
+- u16 b = drm_fixp2int(drm_fixp_div(fp_b, fp_rb_ratio));
++ u16 r = drm_fixp2int_round(drm_fixp_div(fp_r, fp_rb_ratio));
++ u16 g = drm_fixp2int_round(drm_fixp_div(fp_g, fp_g_ratio));
++ u16 b = drm_fixp2int_round(drm_fixp_div(fp_b, fp_rb_ratio));
+
+ *dst_pixels = cpu_to_le16(r << 11 | g << 5 | b);
+ }
+--
+2.39.2
+
--- /dev/null
+From 599b2063169c4ba9655d4edb7c05c79233b78304 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 10:05:21 -0300
+Subject: drm/vkms: isolate pixel conversion functionality
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+[ Upstream commit 322d716a3e8a74fb75cd0f657647be4df253fd2f ]
+
+Currently, the pixel conversion functions repeat the same loop to
+iterate the rows. Instead of repeating the same code for each pixel
+format, create a function to wrap the loop and isolate the pixel
+conversion functionality.
+
+Suggested-by: Arthur Grillo <arthurgrillo@riseup.net>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Reviewed-by: Arthur Grillo <arthurgrillo@riseup.net>
+Signed-off-by: Maíra Canal <mairacanal@riseup.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230418130525.128733-2-mcanal@igalia.com
+Stable-dep-of: ab87f558dcfb ("drm/vkms: Fix RGB565 pixel conversion")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vkms/vkms_composer.c | 4 +-
+ drivers/gpu/drm/vkms/vkms_drv.h | 4 +-
+ drivers/gpu/drm/vkms/vkms_formats.c | 125 +++++++++++----------------
+ drivers/gpu/drm/vkms/vkms_formats.h | 2 +-
+ drivers/gpu/drm/vkms/vkms_plane.c | 2 +-
+ 5 files changed, 56 insertions(+), 81 deletions(-)
+
+diff --git a/drivers/gpu/drm/vkms/vkms_composer.c b/drivers/gpu/drm/vkms/vkms_composer.c
+index 8e53fa80742b2..80164e79af006 100644
+--- a/drivers/gpu/drm/vkms/vkms_composer.c
++++ b/drivers/gpu/drm/vkms/vkms_composer.c
+@@ -99,7 +99,7 @@ static void blend(struct vkms_writeback_job *wb,
+ if (!check_y_limit(plane[i]->frame_info, y))
+ continue;
+
+- plane[i]->plane_read(stage_buffer, plane[i]->frame_info, y);
++ vkms_compose_row(stage_buffer, plane[i], y);
+ pre_mul_alpha_blend(plane[i]->frame_info, stage_buffer,
+ output_buffer);
+ }
+@@ -118,7 +118,7 @@ static int check_format_funcs(struct vkms_crtc_state *crtc_state,
+ u32 n_active_planes = crtc_state->num_active_planes;
+
+ for (size_t i = 0; i < n_active_planes; i++)
+- if (!planes[i]->plane_read)
++ if (!planes[i]->pixel_read)
+ return -1;
+
+ if (active_wb && !active_wb->wb_write)
+diff --git a/drivers/gpu/drm/vkms/vkms_drv.h b/drivers/gpu/drm/vkms/vkms_drv.h
+index 0a67b8073f7e5..de4efc0a3bd01 100644
+--- a/drivers/gpu/drm/vkms/vkms_drv.h
++++ b/drivers/gpu/drm/vkms/vkms_drv.h
+@@ -56,8 +56,7 @@ struct vkms_writeback_job {
+ struct vkms_plane_state {
+ struct drm_shadow_plane_state base;
+ struct vkms_frame_info *frame_info;
+- void (*plane_read)(struct line_buffer *buffer,
+- const struct vkms_frame_info *frame_info, int y);
++ void (*pixel_read)(u8 *src_buffer, struct pixel_argb_u16 *out_pixel);
+ };
+
+ struct vkms_plane {
+@@ -155,6 +154,7 @@ int vkms_verify_crc_source(struct drm_crtc *crtc, const char *source_name,
+ /* Composer Support */
+ void vkms_composer_worker(struct work_struct *work);
+ void vkms_set_composer(struct vkms_output *out, bool enabled);
++void vkms_compose_row(struct line_buffer *stage_buffer, struct vkms_plane_state *plane, int y);
+
+ /* Writeback */
+ int vkms_enable_writeback_connector(struct vkms_device *vkmsdev);
+diff --git a/drivers/gpu/drm/vkms/vkms_formats.c b/drivers/gpu/drm/vkms/vkms_formats.c
+index d4950688b3f17..8d948c73741ef 100644
+--- a/drivers/gpu/drm/vkms/vkms_formats.c
++++ b/drivers/gpu/drm/vkms/vkms_formats.c
+@@ -42,100 +42,75 @@ static void *get_packed_src_addr(const struct vkms_frame_info *frame_info, int y
+ return packed_pixels_addr(frame_info, x_src, y_src);
+ }
+
+-static void ARGB8888_to_argb_u16(struct line_buffer *stage_buffer,
+- const struct vkms_frame_info *frame_info, int y)
++static void ARGB8888_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
+ {
+- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
+- u8 *src_pixels = get_packed_src_addr(frame_info, y);
+- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst),
+- stage_buffer->n_pixels);
+-
+- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) {
+- /*
+- * The 257 is the "conversion ratio". This number is obtained by the
+- * (2^16 - 1) / (2^8 - 1) division. Which, in this case, tries to get
+- * the best color value in a pixel format with more possibilities.
+- * A similar idea applies to others RGB color conversions.
+- */
+- out_pixels[x].a = (u16)src_pixels[3] * 257;
+- out_pixels[x].r = (u16)src_pixels[2] * 257;
+- out_pixels[x].g = (u16)src_pixels[1] * 257;
+- out_pixels[x].b = (u16)src_pixels[0] * 257;
+- }
++ /*
++ * The 257 is the "conversion ratio". This number is obtained by the
++ * (2^16 - 1) / (2^8 - 1) division. Which, in this case, tries to get
++ * the best color value in a pixel format with more possibilities.
++ * A similar idea applies to others RGB color conversions.
++ */
++ out_pixel->a = (u16)src_pixels[3] * 257;
++ out_pixel->r = (u16)src_pixels[2] * 257;
++ out_pixel->g = (u16)src_pixels[1] * 257;
++ out_pixel->b = (u16)src_pixels[0] * 257;
+ }
+
+-static void XRGB8888_to_argb_u16(struct line_buffer *stage_buffer,
+- const struct vkms_frame_info *frame_info, int y)
++static void XRGB8888_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
+ {
+- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
+- u8 *src_pixels = get_packed_src_addr(frame_info, y);
+- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst),
+- stage_buffer->n_pixels);
+-
+- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) {
+- out_pixels[x].a = (u16)0xffff;
+- out_pixels[x].r = (u16)src_pixels[2] * 257;
+- out_pixels[x].g = (u16)src_pixels[1] * 257;
+- out_pixels[x].b = (u16)src_pixels[0] * 257;
+- }
++ out_pixel->a = (u16)0xffff;
++ out_pixel->r = (u16)src_pixels[2] * 257;
++ out_pixel->g = (u16)src_pixels[1] * 257;
++ out_pixel->b = (u16)src_pixels[0] * 257;
+ }
+
+-static void ARGB16161616_to_argb_u16(struct line_buffer *stage_buffer,
+- const struct vkms_frame_info *frame_info,
+- int y)
++static void ARGB16161616_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
+ {
+- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
+- u16 *src_pixels = get_packed_src_addr(frame_info, y);
+- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst),
+- stage_buffer->n_pixels);
++ u16 *pixels = (u16 *)src_pixels;
+
+- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) {
+- out_pixels[x].a = le16_to_cpu(src_pixels[3]);
+- out_pixels[x].r = le16_to_cpu(src_pixels[2]);
+- out_pixels[x].g = le16_to_cpu(src_pixels[1]);
+- out_pixels[x].b = le16_to_cpu(src_pixels[0]);
+- }
++ out_pixel->a = le16_to_cpu(pixels[3]);
++ out_pixel->r = le16_to_cpu(pixels[2]);
++ out_pixel->g = le16_to_cpu(pixels[1]);
++ out_pixel->b = le16_to_cpu(pixels[0]);
+ }
+
+-static void XRGB16161616_to_argb_u16(struct line_buffer *stage_buffer,
+- const struct vkms_frame_info *frame_info,
+- int y)
++static void XRGB16161616_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
+ {
+- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
+- u16 *src_pixels = get_packed_src_addr(frame_info, y);
+- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst),
+- stage_buffer->n_pixels);
++ u16 *pixels = (u16 *)src_pixels;
+
+- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) {
+- out_pixels[x].a = (u16)0xffff;
+- out_pixels[x].r = le16_to_cpu(src_pixels[2]);
+- out_pixels[x].g = le16_to_cpu(src_pixels[1]);
+- out_pixels[x].b = le16_to_cpu(src_pixels[0]);
+- }
++ out_pixel->a = (u16)0xffff;
++ out_pixel->r = le16_to_cpu(pixels[2]);
++ out_pixel->g = le16_to_cpu(pixels[1]);
++ out_pixel->b = le16_to_cpu(pixels[0]);
+ }
+
+-static void RGB565_to_argb_u16(struct line_buffer *stage_buffer,
+- const struct vkms_frame_info *frame_info, int y)
++static void RGB565_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
+ {
+- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
+- u16 *src_pixels = get_packed_src_addr(frame_info, y);
+- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst),
+- stage_buffer->n_pixels);
++ u16 *pixels = (u16 *)src_pixels;
+
+ s64 fp_rb_ratio = drm_fixp_div(drm_int2fixp(65535), drm_int2fixp(31));
+ s64 fp_g_ratio = drm_fixp_div(drm_int2fixp(65535), drm_int2fixp(63));
+
+- for (size_t x = 0; x < x_limit; x++, src_pixels++) {
+- u16 rgb_565 = le16_to_cpu(*src_pixels);
+- s64 fp_r = drm_int2fixp((rgb_565 >> 11) & 0x1f);
+- s64 fp_g = drm_int2fixp((rgb_565 >> 5) & 0x3f);
+- s64 fp_b = drm_int2fixp(rgb_565 & 0x1f);
++ u16 rgb_565 = le16_to_cpu(*pixels);
++ s64 fp_r = drm_int2fixp((rgb_565 >> 11) & 0x1f);
++ s64 fp_g = drm_int2fixp((rgb_565 >> 5) & 0x3f);
++ s64 fp_b = drm_int2fixp(rgb_565 & 0x1f);
+
+- out_pixels[x].a = (u16)0xffff;
+- out_pixels[x].r = drm_fixp2int(drm_fixp_mul(fp_r, fp_rb_ratio));
+- out_pixels[x].g = drm_fixp2int(drm_fixp_mul(fp_g, fp_g_ratio));
+- out_pixels[x].b = drm_fixp2int(drm_fixp_mul(fp_b, fp_rb_ratio));
+- }
++ out_pixel->a = (u16)0xffff;
++ out_pixel->r = drm_fixp2int(drm_fixp_mul(fp_r, fp_rb_ratio));
++ out_pixel->g = drm_fixp2int(drm_fixp_mul(fp_g, fp_g_ratio));
++ out_pixel->b = drm_fixp2int(drm_fixp_mul(fp_b, fp_rb_ratio));
++}
++
++void vkms_compose_row(struct line_buffer *stage_buffer, struct vkms_plane_state *plane, int y)
++{
++ struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
++ struct vkms_frame_info *frame_info = plane->frame_info;
++ u8 *src_pixels = get_packed_src_addr(frame_info, y);
++ int limit = min_t(size_t, drm_rect_width(&frame_info->dst), stage_buffer->n_pixels);
++
++ for (size_t x = 0; x < limit; x++, src_pixels += frame_info->cpp)
++ plane->pixel_read(src_pixels, &out_pixels[x]);
+ }
+
+ /*
+@@ -249,7 +224,7 @@ static void argb_u16_to_RGB565(struct vkms_frame_info *frame_info,
+ }
+ }
+
+-void *get_frame_to_line_function(u32 format)
++void *get_pixel_conversion_function(u32 format)
+ {
+ switch (format) {
+ case DRM_FORMAT_ARGB8888:
+diff --git a/drivers/gpu/drm/vkms/vkms_formats.h b/drivers/gpu/drm/vkms/vkms_formats.h
+index 43b7c19790181..c5b113495d0c0 100644
+--- a/drivers/gpu/drm/vkms/vkms_formats.h
++++ b/drivers/gpu/drm/vkms/vkms_formats.h
+@@ -5,7 +5,7 @@
+
+ #include "vkms_drv.h"
+
+-void *get_frame_to_line_function(u32 format);
++void *get_pixel_conversion_function(u32 format);
+
+ void *get_line_to_frame_function(u32 format);
+
+diff --git a/drivers/gpu/drm/vkms/vkms_plane.c b/drivers/gpu/drm/vkms/vkms_plane.c
+index c3a845220e10c..80e964589cecb 100644
+--- a/drivers/gpu/drm/vkms/vkms_plane.c
++++ b/drivers/gpu/drm/vkms/vkms_plane.c
+@@ -123,7 +123,7 @@ static void vkms_plane_atomic_update(struct drm_plane *plane,
+ frame_info->offset = fb->offsets[0];
+ frame_info->pitch = fb->pitches[0];
+ frame_info->cpp = fb->format->cpp[0];
+- vkms_plane_state->plane_read = get_frame_to_line_function(fmt);
++ vkms_plane_state->pixel_read = get_pixel_conversion_function(fmt);
+ }
+
+ static int vkms_plane_atomic_check(struct drm_plane *plane,
+--
+2.39.2
+
--- /dev/null
+From 7a48110d2b549f68b5f4a595080d4f1a5d4d2950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 08:09:16 +0800
+Subject: drm/vram-helper: fix function names in vram helper doc
+
+From: Luc Ma <luc@sietium.com>
+
+[ Upstream commit b8e392245105b50706f18418054821e71e637288 ]
+
+Refer to drmm_vram_helper_init() instead of the non-existent
+drmm_vram_helper_alloc_mm().
+
+Fixes: a5f23a72355d ("drm/vram-helper: Managed vram helpers")
+Signed-off-by: Luc Ma <luc@sietium.com>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/64583db2.630a0220.eb75d.8f51@mx.google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_gem_vram_helper.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c
+index 125160b534bef..928e08e0b5b86 100644
+--- a/drivers/gpu/drm/drm_gem_vram_helper.c
++++ b/drivers/gpu/drm/drm_gem_vram_helper.c
+@@ -44,7 +44,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs;
+ * the frame's scanout buffer or the cursor image. If there's no more space
+ * left in VRAM, inactive GEM objects can be moved to system memory.
+ *
+- * To initialize the VRAM helper library call drmm_vram_helper_alloc_mm().
++ * To initialize the VRAM helper library call drmm_vram_helper_init().
+ * The function allocates and initializes an instance of &struct drm_vram_mm
+ * in &struct drm_device.vram_mm . Use &DRM_GEM_VRAM_DRIVER to initialize
+ * &struct drm_driver and &DRM_VRAM_MM_FILE_OPERATIONS to initialize
+@@ -72,7 +72,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs;
+ * // setup device, vram base and size
+ * // ...
+ *
+- * ret = drmm_vram_helper_alloc_mm(dev, vram_base, vram_size);
++ * ret = drmm_vram_helper_init(dev, vram_base, vram_size);
+ * if (ret)
+ * return ret;
+ * return 0;
+@@ -85,7 +85,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs;
+ * to userspace.
+ *
+ * You don't have to clean up the instance of VRAM MM.
+- * drmm_vram_helper_alloc_mm() is a managed interface that installs a
++ * drmm_vram_helper_init() is a managed interface that installs a
+ * clean-up handler to run during the DRM device's release.
+ *
+ * For drawing or scanout operations, rsp. buffer objects have to be pinned
+--
+2.39.2
+
--- /dev/null
+From b6b6d6f3b18151f646cdd9fa60f852e623bc8256 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 09:33:09 +0200
+Subject: efi/libstub: Disable PCI DMA before grabbing the EFI memory map
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 2e28a798c3092ea42b968fa16ac835969d124898 ]
+
+Currently, the EFI stub will disable PCI DMA as the very last thing it
+does before calling ExitBootServices(), to avoid interfering with the
+firmware's normal operation as much as possible.
+
+However, the stub will invoke DisconnectController() on all endpoints
+downstream of the PCI bridges it disables, and this may affect the
+layout of the EFI memory map, making it substantially more likely that
+ExitBootServices() will fail the first time around, and that the EFI
+memory map needs to be reloaded.
+
+This, in turn, increases the likelihood that the slack space we
+allocated is insufficient (and we can no longer allocate memory via boot
+services after having called ExitBootServices() once), causing the
+second call to GetMemoryMap (and therefore the boot) to fail. This makes
+the PCI DMA disable feature a bit more fragile than it already is, so
+let's make it more robust, by allocating the space for the EFI memory
+map after disabling PCI DMA.
+
+Fixes: 4444f8541dad16fe ("efi: Allow disabling PCI busmastering on bridges during boot")
+Reported-by: Glenn Washburn <development@efficientek.com>
+Acked-by: Matthew Garrett <mjg59@srcf.ucam.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/libstub/efi-stub-helper.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
+index 0c493521b25b8..3d9b2469a0dfd 100644
+--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
++++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
+@@ -521,6 +521,9 @@ efi_status_t efi_exit_boot_services(void *handle, void *priv,
+ struct efi_boot_memmap *map;
+ efi_status_t status;
+
++ if (efi_disable_pci_dma)
++ efi_pci_disable_bridge_busmaster();
++
+ status = efi_get_memory_map(&map, true);
+ if (status != EFI_SUCCESS)
+ return status;
+@@ -531,9 +534,6 @@ efi_status_t efi_exit_boot_services(void *handle, void *priv,
+ return status;
+ }
+
+- if (efi_disable_pci_dma)
+- efi_pci_disable_bridge_busmaster();
+-
+ status = efi_bs_call(exit_boot_services, handle, map->map_key);
+
+ if (status == EFI_INVALID_PARAMETER) {
+--
+2.39.2
+
--- /dev/null
+From 821793918d6550af630b3a9225b26accea0f6497 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Feb 2023 17:30:36 +0800
+Subject: erofs: avoid tagged pointers to mark sync decompression
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit cdba55067f2f9fdc7870ffcb6aef912d3468cff8 ]
+
+We could just use a boolean in z_erofs_decompressqueue for sync
+decompression to simplify the code.
+
+Reviewed-by: Yue Hu <huyue2@coolpad.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20230204093040.97967-2-hsiangkao@linux.alibaba.com
+Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zdata.c | 42 ++++++++++++++++--------------------------
+ fs/erofs/zdata.h | 2 +-
+ 2 files changed, 17 insertions(+), 27 deletions(-)
+
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index ccf7c55d477fe..8e80871a8c1d7 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -1157,12 +1157,12 @@ static void z_erofs_decompressqueue_work(struct work_struct *work)
+ }
+
+ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io,
+- bool sync, int bios)
++ int bios)
+ {
+ struct erofs_sb_info *const sbi = EROFS_SB(io->sb);
+
+ /* wake up the caller thread for sync decompression */
+- if (sync) {
++ if (io->sync) {
+ if (!atomic_add_return(bios, &io->pending_bios))
+ complete(&io->u.done);
+ return;
+@@ -1294,9 +1294,8 @@ static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl,
+ return page;
+ }
+
+-static struct z_erofs_decompressqueue *
+-jobqueue_init(struct super_block *sb,
+- struct z_erofs_decompressqueue *fgq, bool *fg)
++static struct z_erofs_decompressqueue *jobqueue_init(struct super_block *sb,
++ struct z_erofs_decompressqueue *fgq, bool *fg)
+ {
+ struct z_erofs_decompressqueue *q;
+
+@@ -1313,6 +1312,7 @@ jobqueue_init(struct super_block *sb,
+ init_completion(&fgq->u.done);
+ atomic_set(&fgq->pending_bios, 0);
+ q->eio = false;
++ q->sync = true;
+ }
+ q->sb = sb;
+ q->head = Z_EROFS_PCLUSTER_TAIL_CLOSED;
+@@ -1326,20 +1326,6 @@ enum {
+ NR_JOBQUEUES,
+ };
+
+-static void *jobqueueset_init(struct super_block *sb,
+- struct z_erofs_decompressqueue *q[],
+- struct z_erofs_decompressqueue *fgq, bool *fg)
+-{
+- /*
+- * if managed cache is enabled, bypass jobqueue is needed,
+- * no need to read from device for all pclusters in this queue.
+- */
+- q[JQ_BYPASS] = jobqueue_init(sb, fgq + JQ_BYPASS, NULL);
+- q[JQ_SUBMIT] = jobqueue_init(sb, fgq + JQ_SUBMIT, fg);
+-
+- return tagptr_cast_ptr(tagptr_fold(tagptr1_t, q[JQ_SUBMIT], *fg));
+-}
+-
+ static void move_to_bypass_jobqueue(struct z_erofs_pcluster *pcl,
+ z_erofs_next_pcluster_t qtail[],
+ z_erofs_next_pcluster_t owned_head)
+@@ -1361,8 +1347,7 @@ static void move_to_bypass_jobqueue(struct z_erofs_pcluster *pcl,
+
+ static void z_erofs_decompressqueue_endio(struct bio *bio)
+ {
+- tagptr1_t t = tagptr_init(tagptr1_t, bio->bi_private);
+- struct z_erofs_decompressqueue *q = tagptr_unfold_ptr(t);
++ struct z_erofs_decompressqueue *q = bio->bi_private;
+ blk_status_t err = bio->bi_status;
+ struct bio_vec *bvec;
+ struct bvec_iter_all iter_all;
+@@ -1381,7 +1366,7 @@ static void z_erofs_decompressqueue_endio(struct bio *bio)
+ }
+ if (err)
+ q->eio = true;
+- z_erofs_decompress_kickoff(q, tagptr_unfold_tags(t), -1);
++ z_erofs_decompress_kickoff(q, -1);
+ bio_put(bio);
+ }
+
+@@ -1394,7 +1379,6 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
+ struct address_space *mc = MNGD_MAPPING(EROFS_SB(sb));
+ z_erofs_next_pcluster_t qtail[NR_JOBQUEUES];
+ struct z_erofs_decompressqueue *q[NR_JOBQUEUES];
+- void *bi_private;
+ z_erofs_next_pcluster_t owned_head = f->owned_head;
+ /* bio is NULL initially, so no need to initialize last_{index,bdev} */
+ pgoff_t last_index;
+@@ -1404,7 +1388,13 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
+ unsigned long pflags;
+ int memstall = 0;
+
+- bi_private = jobqueueset_init(sb, q, fgq, force_fg);
++ /*
++ * if managed cache is enabled, bypass jobqueue is needed,
++ * no need to read from device for all pclusters in this queue.
++ */
++ q[JQ_BYPASS] = jobqueue_init(sb, fgq + JQ_BYPASS, NULL);
++ q[JQ_SUBMIT] = jobqueue_init(sb, fgq + JQ_SUBMIT, force_fg);
++
+ qtail[JQ_BYPASS] = &q[JQ_BYPASS]->head;
+ qtail[JQ_SUBMIT] = &q[JQ_SUBMIT]->head;
+
+@@ -1473,7 +1463,7 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
+ last_bdev = mdev.m_bdev;
+ bio->bi_iter.bi_sector = (sector_t)cur <<
+ LOG_SECTORS_PER_BLOCK;
+- bio->bi_private = bi_private;
++ bio->bi_private = q[JQ_SUBMIT];
+ if (f->readahead)
+ bio->bi_opf |= REQ_RAHEAD;
+ ++nr_bios;
+@@ -1506,7 +1496,7 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
+ kvfree(q[JQ_SUBMIT]);
+ return;
+ }
+- z_erofs_decompress_kickoff(q[JQ_SUBMIT], *force_fg, nr_bios);
++ z_erofs_decompress_kickoff(q[JQ_SUBMIT], nr_bios);
+ }
+
+ static void z_erofs_runqueue(struct z_erofs_decompress_frontend *f,
+diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h
+index d98c952129852..b139de5473a97 100644
+--- a/fs/erofs/zdata.h
++++ b/fs/erofs/zdata.h
+@@ -110,7 +110,7 @@ struct z_erofs_decompressqueue {
+ struct work_struct work;
+ } u;
+
+- bool eio;
++ bool eio, sync;
+ };
+
+ static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl)
+--
+2.39.2
+
--- /dev/null
+From d0c27c28c096f5e74d0ad9104715d80278e0d413 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 14:03:52 +0800
+Subject: erofs: clean up cached I/O strategies
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 1282dea37b09087b8aec59f0774572c16b52276a ]
+
+After commit 4c7e42552b3a ("erofs: remove useless cache strategy of
+DELAYEDALLOC"), only one cached I/O allocation strategy is supported:
+
+ When cached I/O is preferred, page allocation is applied without
+ direct reclaim. If allocation fails, fall back to inplace I/O.
+
+Let's get rid of z_erofs_cache_alloctype. No logical changes.
+
+Reviewed-by: Yue Hu <huyue2@coolpad.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Yue Hu <huyue2@coolpad.com>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20221206060352.152830-1-xiang@kernel.org
+Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zdata.c | 77 +++++++++++++++++++-----------------------------
+ 1 file changed, 31 insertions(+), 46 deletions(-)
+
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index cf4871834ebb2..ccf7c55d477fe 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -175,16 +175,6 @@ static void z_erofs_free_pcluster(struct z_erofs_pcluster *pcl)
+ DBG_BUGON(1);
+ }
+
+-/* how to allocate cached pages for a pcluster */
+-enum z_erofs_cache_alloctype {
+- DONTALLOC, /* don't allocate any cached pages */
+- /*
+- * try to use cached I/O if page allocation succeeds or fallback
+- * to in-place I/O instead to avoid any direct reclaim.
+- */
+- TRYALLOC,
+-};
+-
+ /*
+ * tagged pointer with 1-bit tag for all compressed pages
+ * tag 0 - the page is just found with an extra page reference
+@@ -292,12 +282,29 @@ struct z_erofs_decompress_frontend {
+ .inode = __i, .owned_head = Z_EROFS_PCLUSTER_TAIL, \
+ .mode = Z_EROFS_PCLUSTER_FOLLOWED, .backmost = true }
+
++static bool z_erofs_should_alloc_cache(struct z_erofs_decompress_frontend *fe)
++{
++ unsigned int cachestrategy = EROFS_I_SB(fe->inode)->opt.cache_strategy;
++
++ if (cachestrategy <= EROFS_ZIP_CACHE_DISABLED)
++ return false;
++
++ if (fe->backmost)
++ return true;
++
++ if (cachestrategy >= EROFS_ZIP_CACHE_READAROUND &&
++ fe->map.m_la < fe->headoffset)
++ return true;
++
++ return false;
++}
++
+ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe,
+- enum z_erofs_cache_alloctype type,
+ struct page **pagepool)
+ {
+ struct address_space *mc = MNGD_MAPPING(EROFS_I_SB(fe->inode));
+ struct z_erofs_pcluster *pcl = fe->pcl;
++ bool shouldalloc = z_erofs_should_alloc_cache(fe);
+ bool standalone = true;
+ /*
+ * optimistic allocation without direct reclaim since inplace I/O
+@@ -326,18 +333,19 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe,
+ } else {
+ /* I/O is needed, no possible to decompress directly */
+ standalone = false;
+- switch (type) {
+- case TRYALLOC:
+- newpage = erofs_allocpage(pagepool, gfp);
+- if (!newpage)
+- continue;
+- set_page_private(newpage,
+- Z_EROFS_PREALLOCATED_PAGE);
+- t = tag_compressed_page_justfound(newpage);
+- break;
+- default: /* DONTALLOC */
++ if (!shouldalloc)
+ continue;
+- }
++
++ /*
++ * try to use cached I/O if page allocation
++ * succeeds or fallback to in-place I/O instead
++ * to avoid any direct reclaim.
++ */
++ newpage = erofs_allocpage(pagepool, gfp);
++ if (!newpage)
++ continue;
++ set_page_private(newpage, Z_EROFS_PREALLOCATED_PAGE);
++ t = tag_compressed_page_justfound(newpage);
+ }
+
+ if (!cmpxchg_relaxed(&pcl->compressed_bvecs[i].page, NULL,
+@@ -638,20 +646,6 @@ static bool z_erofs_collector_end(struct z_erofs_decompress_frontend *fe)
+ return true;
+ }
+
+-static bool should_alloc_managed_pages(struct z_erofs_decompress_frontend *fe,
+- unsigned int cachestrategy,
+- erofs_off_t la)
+-{
+- if (cachestrategy <= EROFS_ZIP_CACHE_DISABLED)
+- return false;
+-
+- if (fe->backmost)
+- return true;
+-
+- return cachestrategy >= EROFS_ZIP_CACHE_READAROUND &&
+- la < fe->headoffset;
+-}
+-
+ static int z_erofs_read_fragment(struct inode *inode, erofs_off_t pos,
+ struct page *page, unsigned int pageofs,
+ unsigned int len)
+@@ -688,12 +682,9 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
+ struct page *page, struct page **pagepool)
+ {
+ struct inode *const inode = fe->inode;
+- struct erofs_sb_info *const sbi = EROFS_I_SB(inode);
+ struct erofs_map_blocks *const map = &fe->map;
+ const loff_t offset = page_offset(page);
+ bool tight = true, exclusive;
+-
+- enum z_erofs_cache_alloctype cache_strategy;
+ unsigned int cur, end, spiltted;
+ int err = 0;
+
+@@ -747,13 +738,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
+ fe->mode = Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE;
+ } else {
+ /* bind cache first when cached decompression is preferred */
+- if (should_alloc_managed_pages(fe, sbi->opt.cache_strategy,
+- map->m_la))
+- cache_strategy = TRYALLOC;
+- else
+- cache_strategy = DONTALLOC;
+-
+- z_erofs_bind_cache(fe, cache_strategy, pagepool);
++ z_erofs_bind_cache(fe, pagepool);
+ }
+ hitted:
+ /*
+--
+2.39.2
+
--- /dev/null
+From 988d480ce3a8a66cdc55cdc16575b645908da47f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 19:23:41 +0800
+Subject: erofs: fix compact 4B support for 16k block size
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 001b8ccd0650727e54ec16ef72bf1b8eeab7168e ]
+
+In compact 4B, two adjacent lclusters are packed together as a unit to
+form on-disk indexes for effective random access, as below:
+
+(amortized = 4, vcnt = 2)
+ _____________________________________________
+ |___@_____ encoded bits __________|_ blkaddr _|
+ 0 . amortized * vcnt = 8
+ . .
+ . . amortized * vcnt - 4 = 4
+ . .
+ .____________________________.
+ |_type (2 bits)_|_clusterofs_|
+
+Therefore, encoded bits for each pack are 32 bits (4 bytes). IOWs,
+since each lcluster can get 16 bits for its type and clusterofs, the
+maximum supported lclustersize for compact 4B format is 16k (14 bits).
+
+Fix this to enable compact 4B format for 16k lclusters (blocks), which
+is tested on an arm64 server with 16k page size.
+
+Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support")
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20230601112341.56960-1-hsiangkao@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zmap.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
+index 3961bb55dea11..0337b70b2dac4 100644
+--- a/fs/erofs/zmap.c
++++ b/fs/erofs/zmap.c
+@@ -271,7 +271,7 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m,
+ u8 *in, type;
+ bool big_pcluster;
+
+- if (1 << amortizedshift == 4)
++ if (1 << amortizedshift == 4 && lclusterbits <= 14)
+ vcnt = 2;
+ else if (1 << amortizedshift == 2 && lclusterbits == 12)
+ vcnt = 16;
+@@ -373,7 +373,6 @@ static int compacted_load_cluster_from_disk(struct z_erofs_maprecorder *m,
+ {
+ struct inode *const inode = m->inode;
+ struct erofs_inode *const vi = EROFS_I(inode);
+- const unsigned int lclusterbits = vi->z_logical_clusterbits;
+ const erofs_off_t ebase = sizeof(struct z_erofs_map_header) +
+ ALIGN(erofs_iloc(inode) + vi->inode_isize + vi->xattr_isize, 8);
+ const unsigned int totalidx = DIV_ROUND_UP(inode->i_size, EROFS_BLKSIZ);
+@@ -381,9 +380,6 @@ static int compacted_load_cluster_from_disk(struct z_erofs_maprecorder *m,
+ unsigned int amortizedshift;
+ erofs_off_t pos;
+
+- if (lclusterbits != 12)
+- return -EOPNOTSUPP;
+-
+ if (lcn >= totalidx)
+ return -EINVAL;
+
+--
+2.39.2
+
--- /dev/null
+From 65be02cbe7b8d708be369a3fab927ce58a69387f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 May 2023 04:14:56 +0800
+Subject: erofs: kill hooked chains to avoid loops on deduplicated compressed
+ images
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 967c28b23f6c89bb8eef6a046ea88afe0d7c1029 ]
+
+After heavily stressing EROFS with several images which include a
+hand-crafted image of repeated patterns for more than 46 days, I found
+two chains could be linked with each other almost simultaneously and
+form a loop so that the entire loop won't be submitted. As a
+consequence, the corresponding file pages will remain locked forever.
+
+It can be _only_ observed on data-deduplicated compressed images.
+For example, consider two chains with five pclusters in total:
+ Chain 1: 2->3->4->5 -- The tail pcluster is 5;
+ Chain 2: 5->1->2 -- The tail pcluster is 2.
+
+Chain 2 could link to Chain 1 with pcluster 5; and Chain 1 could link
+to Chain 2 at the same time with pcluster 2.
+
+Since hooked chains are all linked locklessly now, I have no idea how
+to simply avoid the race. Instead, let's avoid hooked chains completely
+until I could work out a proper way to fix this and end users finally
+tell us that it's needed to add it back.
+
+Actually, this optimization can be found with multi-threaded workloads
+(especially even more often on deduplicated compressed images), yet I'm
+not sure about the overall system impacts of not having this compared
+with implementation complexity.
+
+Fixes: 267f2492c8f7 ("erofs: introduce multi-reference pclusters (fully-referenced)")
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Yue Hu <huyue2@coolpad.com>
+Link: https://lore.kernel.org/r/20230526201459.128169-4-hsiangkao@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zdata.c | 72 ++++++++----------------------------------------
+ 1 file changed, 11 insertions(+), 61 deletions(-)
+
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index aaddb6781465e..92b2e4ddb7ce9 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -94,11 +94,8 @@ struct z_erofs_pcluster {
+
+ /* let's avoid the valid 32-bit kernel addresses */
+
+-/* the chained workgroup has't submitted io (still open) */
++/* the end of a chain of pclusters */
+ #define Z_EROFS_PCLUSTER_TAIL ((void *)0x5F0ECAFE)
+-/* the chained workgroup has already submitted io */
+-#define Z_EROFS_PCLUSTER_TAIL_CLOSED ((void *)0x5F0EDEAD)
+-
+ #define Z_EROFS_PCLUSTER_NIL (NULL)
+
+ struct z_erofs_decompressqueue {
+@@ -375,20 +372,6 @@ int __init z_erofs_init_zip_subsystem(void)
+
+ enum z_erofs_pclustermode {
+ Z_EROFS_PCLUSTER_INFLIGHT,
+- /*
+- * The current pclusters was the tail of an exist chain, in addition
+- * that the previous processed chained pclusters are all decided to
+- * be hooked up to it.
+- * A new chain will be created for the remaining pclusters which are
+- * not processed yet, so different from Z_EROFS_PCLUSTER_FOLLOWED,
+- * the next pcluster cannot reuse the whole page safely for inplace I/O
+- * in the following scenario:
+- * ________________________________________________________________
+- * | tail (partial) page | head (partial) page |
+- * | (belongs to the next pcl) | (belongs to the current pcl) |
+- * |_______PCLUSTER_FOLLOWED______|________PCLUSTER_HOOKED__________|
+- */
+- Z_EROFS_PCLUSTER_HOOKED,
+ /*
+ * a weak form of Z_EROFS_PCLUSTER_FOLLOWED, the difference is that it
+ * could be dispatched into bypass queue later due to uptodated managed
+@@ -406,8 +389,8 @@ enum z_erofs_pclustermode {
+ * ________________________________________________________________
+ * | tail (partial) page | head (partial) page |
+ * | (of the current cl) | (of the previous collection) |
+- * | PCLUSTER_FOLLOWED or | |
+- * |_____PCLUSTER_HOOKED__|___________PCLUSTER_FOLLOWED____________|
++ * | | |
++ * |__PCLUSTER_FOLLOWED___|___________PCLUSTER_FOLLOWED____________|
+ *
+ * [ (*) the above page can be used as inplace I/O. ]
+ */
+@@ -420,7 +403,7 @@ struct z_erofs_decompress_frontend {
+ struct z_erofs_bvec_iter biter;
+
+ struct page *candidate_bvpage;
+- struct z_erofs_pcluster *pcl, *tailpcl;
++ struct z_erofs_pcluster *pcl;
+ z_erofs_next_pcluster_t owned_head;
+ enum z_erofs_pclustermode mode;
+
+@@ -626,19 +609,7 @@ static void z_erofs_try_to_claim_pcluster(struct z_erofs_decompress_frontend *f)
+ return;
+ }
+
+- /*
+- * type 2, link to the end of an existing open chain, be careful
+- * that its submission is controlled by the original attached chain.
+- */
+- if (*owned_head != &pcl->next && pcl != f->tailpcl &&
+- cmpxchg(&pcl->next, Z_EROFS_PCLUSTER_TAIL,
+- *owned_head) == Z_EROFS_PCLUSTER_TAIL) {
+- *owned_head = Z_EROFS_PCLUSTER_TAIL;
+- f->mode = Z_EROFS_PCLUSTER_HOOKED;
+- f->tailpcl = NULL;
+- return;
+- }
+- /* type 3, it belongs to a chain, but it isn't the end of the chain */
++ /* type 2, it belongs to an ongoing chain */
+ f->mode = Z_EROFS_PCLUSTER_INFLIGHT;
+ }
+
+@@ -699,9 +670,6 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)
+ goto err_out;
+ }
+ }
+- /* used to check tail merging loop due to corrupted images */
+- if (fe->owned_head == Z_EROFS_PCLUSTER_TAIL)
+- fe->tailpcl = pcl;
+ fe->owned_head = &pcl->next;
+ fe->pcl = pcl;
+ return 0;
+@@ -722,7 +690,6 @@ static int z_erofs_collector_begin(struct z_erofs_decompress_frontend *fe)
+
+ /* must be Z_EROFS_PCLUSTER_TAIL or pointed to previous pcluster */
+ DBG_BUGON(fe->owned_head == Z_EROFS_PCLUSTER_NIL);
+- DBG_BUGON(fe->owned_head == Z_EROFS_PCLUSTER_TAIL_CLOSED);
+
+ if (!(map->m_flags & EROFS_MAP_META)) {
+ grp = erofs_find_workgroup(fe->inode->i_sb,
+@@ -741,10 +708,6 @@ static int z_erofs_collector_begin(struct z_erofs_decompress_frontend *fe)
+
+ if (ret == -EEXIST) {
+ mutex_lock(&fe->pcl->lock);
+- /* used to check tail merging loop due to corrupted images */
+- if (fe->owned_head == Z_EROFS_PCLUSTER_TAIL)
+- fe->tailpcl = fe->pcl;
+-
+ z_erofs_try_to_claim_pcluster(fe);
+ } else if (ret) {
+ return ret;
+@@ -901,8 +864,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
+ * those chains are handled asynchronously thus the page cannot be used
+ * for inplace I/O or bvpage (should be processed in a strict order.)
+ */
+- tight &= (fe->mode >= Z_EROFS_PCLUSTER_HOOKED &&
+- fe->mode != Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE);
++ tight &= (fe->mode > Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE);
+
+ cur = end - min_t(unsigned int, offset + end - map->m_la, end);
+ if (!(map->m_flags & EROFS_MAP_MAPPED)) {
+@@ -1283,10 +1245,7 @@ static void z_erofs_decompress_queue(const struct z_erofs_decompressqueue *io,
+ };
+ z_erofs_next_pcluster_t owned = io->head;
+
+- while (owned != Z_EROFS_PCLUSTER_TAIL_CLOSED) {
+- /* impossible that 'owned' equals Z_EROFS_WORK_TPTR_TAIL */
+- DBG_BUGON(owned == Z_EROFS_PCLUSTER_TAIL);
+- /* impossible that 'owned' equals Z_EROFS_PCLUSTER_NIL */
++ while (owned != Z_EROFS_PCLUSTER_TAIL) {
+ DBG_BUGON(owned == Z_EROFS_PCLUSTER_NIL);
+
+ be.pcl = container_of(owned, struct z_erofs_pcluster, next);
+@@ -1303,7 +1262,7 @@ static void z_erofs_decompressqueue_work(struct work_struct *work)
+ container_of(work, struct z_erofs_decompressqueue, u.work);
+ struct page *pagepool = NULL;
+
+- DBG_BUGON(bgq->head == Z_EROFS_PCLUSTER_TAIL_CLOSED);
++ DBG_BUGON(bgq->head == Z_EROFS_PCLUSTER_TAIL);
+ z_erofs_decompress_queue(bgq, &pagepool);
+
+ erofs_release_pages(&pagepool);
+@@ -1465,7 +1424,7 @@ static struct z_erofs_decompressqueue *jobqueue_init(struct super_block *sb,
+ q->sync = true;
+ }
+ q->sb = sb;
+- q->head = Z_EROFS_PCLUSTER_TAIL_CLOSED;
++ q->head = Z_EROFS_PCLUSTER_TAIL;
+ return q;
+ }
+
+@@ -1483,11 +1442,7 @@ static void move_to_bypass_jobqueue(struct z_erofs_pcluster *pcl,
+ z_erofs_next_pcluster_t *const submit_qtail = qtail[JQ_SUBMIT];
+ z_erofs_next_pcluster_t *const bypass_qtail = qtail[JQ_BYPASS];
+
+- DBG_BUGON(owned_head == Z_EROFS_PCLUSTER_TAIL_CLOSED);
+- if (owned_head == Z_EROFS_PCLUSTER_TAIL)
+- owned_head = Z_EROFS_PCLUSTER_TAIL_CLOSED;
+-
+- WRITE_ONCE(pcl->next, Z_EROFS_PCLUSTER_TAIL_CLOSED);
++ WRITE_ONCE(pcl->next, Z_EROFS_PCLUSTER_TAIL);
+
+ WRITE_ONCE(*submit_qtail, owned_head);
+ WRITE_ONCE(*bypass_qtail, &pcl->next);
+@@ -1558,15 +1513,10 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
+ unsigned int i = 0;
+ bool bypass = true;
+
+- /* no possible 'owned_head' equals the following */
+- DBG_BUGON(owned_head == Z_EROFS_PCLUSTER_TAIL_CLOSED);
+ DBG_BUGON(owned_head == Z_EROFS_PCLUSTER_NIL);
+-
+ pcl = container_of(owned_head, struct z_erofs_pcluster, next);
++ owned_head = READ_ONCE(pcl->next);
+
+- /* close the main owned chain at first */
+- owned_head = cmpxchg(&pcl->next, Z_EROFS_PCLUSTER_TAIL,
+- Z_EROFS_PCLUSTER_TAIL_CLOSED);
+ if (z_erofs_is_inline_pcluster(pcl)) {
+ move_to_bypass_jobqueue(pcl, qtail, owned_head);
+ continue;
+--
+2.39.2
+
--- /dev/null
+From f6c6ea0f4a19af78f6496d7e30cf800a0cb80019 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Feb 2023 17:30:38 +0800
+Subject: erofs: move zdata.h into zdata.c
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit a9a94d9373349e1a53f149d2015eb6f03a8517cf ]
+
+Definitions in zdata.h are only used in zdata.c and for internal
+use only. No logic changes.
+
+Reviewed-by: Yue Hu <huyue2@coolpad.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20230204093040.97967-4-hsiangkao@linux.alibaba.com
+Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zdata.c | 166 +++++++++++++++++++++++++++++++++++++++++++-
+ fs/erofs/zdata.h | 177 -----------------------------------------------
+ 2 files changed, 165 insertions(+), 178 deletions(-)
+ delete mode 100644 fs/erofs/zdata.h
+
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index 3b5f73224c22a..aaddb6781465e 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -4,13 +4,177 @@
+ * https://www.huawei.com/
+ * Copyright (C) 2022 Alibaba Cloud
+ */
+-#include "zdata.h"
+ #include "compress.h"
+ #include <linux/prefetch.h>
+ #include <linux/psi.h>
+
+ #include <trace/events/erofs.h>
+
++#define Z_EROFS_PCLUSTER_MAX_PAGES (Z_EROFS_PCLUSTER_MAX_SIZE / PAGE_SIZE)
++#define Z_EROFS_INLINE_BVECS 2
++
++/*
++ * let's leave a type here in case of introducing
++ * another tagged pointer later.
++ */
++typedef void *z_erofs_next_pcluster_t;
++
++struct z_erofs_bvec {
++ struct page *page;
++ int offset;
++ unsigned int end;
++};
++
++#define __Z_EROFS_BVSET(name, total) \
++struct name { \
++ /* point to the next page which contains the following bvecs */ \
++ struct page *nextpage; \
++ struct z_erofs_bvec bvec[total]; \
++}
++__Z_EROFS_BVSET(z_erofs_bvset,);
++__Z_EROFS_BVSET(z_erofs_bvset_inline, Z_EROFS_INLINE_BVECS);
++
++/*
++ * Structure fields follow one of the following exclusion rules.
++ *
++ * I: Modifiable by initialization/destruction paths and read-only
++ * for everyone else;
++ *
++ * L: Field should be protected by the pcluster lock;
++ *
++ * A: Field should be accessed / updated in atomic for parallelized code.
++ */
++struct z_erofs_pcluster {
++ struct erofs_workgroup obj;
++ struct mutex lock;
++
++ /* A: point to next chained pcluster or TAILs */
++ z_erofs_next_pcluster_t next;
++
++ /* L: the maximum decompression size of this round */
++ unsigned int length;
++
++ /* L: total number of bvecs */
++ unsigned int vcnt;
++
++ /* I: page offset of start position of decompression */
++ unsigned short pageofs_out;
++
++ /* I: page offset of inline compressed data */
++ unsigned short pageofs_in;
++
++ union {
++ /* L: inline a certain number of bvec for bootstrap */
++ struct z_erofs_bvset_inline bvset;
++
++ /* I: can be used to free the pcluster by RCU. */
++ struct rcu_head rcu;
++ };
++
++ union {
++ /* I: physical cluster size in pages */
++ unsigned short pclusterpages;
++
++ /* I: tailpacking inline compressed size */
++ unsigned short tailpacking_size;
++ };
++
++ /* I: compression algorithm format */
++ unsigned char algorithmformat;
++
++ /* L: whether partial decompression or not */
++ bool partial;
++
++ /* L: indicate several pageofs_outs or not */
++ bool multibases;
++
++ /* A: compressed bvecs (can be cached or inplaced pages) */
++ struct z_erofs_bvec compressed_bvecs[];
++};
++
++/* let's avoid the valid 32-bit kernel addresses */
++
++/* the chained workgroup has't submitted io (still open) */
++#define Z_EROFS_PCLUSTER_TAIL ((void *)0x5F0ECAFE)
++/* the chained workgroup has already submitted io */
++#define Z_EROFS_PCLUSTER_TAIL_CLOSED ((void *)0x5F0EDEAD)
++
++#define Z_EROFS_PCLUSTER_NIL (NULL)
++
++struct z_erofs_decompressqueue {
++ struct super_block *sb;
++ atomic_t pending_bios;
++ z_erofs_next_pcluster_t head;
++
++ union {
++ struct completion done;
++ struct work_struct work;
++ } u;
++ bool eio, sync;
++};
++
++static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl)
++{
++ return !pcl->obj.index;
++}
++
++static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *pcl)
++{
++ if (z_erofs_is_inline_pcluster(pcl))
++ return 1;
++ return pcl->pclusterpages;
++}
++
++/*
++ * bit 30: I/O error occurred on this page
++ * bit 0 - 29: remaining parts to complete this page
++ */
++#define Z_EROFS_PAGE_EIO (1 << 30)
++
++static inline void z_erofs_onlinepage_init(struct page *page)
++{
++ union {
++ atomic_t o;
++ unsigned long v;
++ } u = { .o = ATOMIC_INIT(1) };
++
++ set_page_private(page, u.v);
++ smp_wmb();
++ SetPagePrivate(page);
++}
++
++static inline void z_erofs_onlinepage_split(struct page *page)
++{
++ atomic_inc((atomic_t *)&page->private);
++}
++
++static inline void z_erofs_page_mark_eio(struct page *page)
++{
++ int orig;
++
++ do {
++ orig = atomic_read((atomic_t *)&page->private);
++ } while (atomic_cmpxchg((atomic_t *)&page->private, orig,
++ orig | Z_EROFS_PAGE_EIO) != orig);
++}
++
++static inline void z_erofs_onlinepage_endio(struct page *page)
++{
++ unsigned int v;
++
++ DBG_BUGON(!PagePrivate(page));
++ v = atomic_dec_return((atomic_t *)&page->private);
++ if (!(v & ~Z_EROFS_PAGE_EIO)) {
++ set_page_private(page, 0);
++ ClearPagePrivate(page);
++ if (!(v & Z_EROFS_PAGE_EIO))
++ SetPageUptodate(page);
++ unlock_page(page);
++ }
++}
++
++#define Z_EROFS_ONSTACK_PAGES 32
++
+ /*
+ * since pclustersize is variable for big pcluster feature, introduce slab
+ * pools implementation for different pcluster sizes.
+diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h
+deleted file mode 100644
+index f196a729c7e85..0000000000000
+--- a/fs/erofs/zdata.h
++++ /dev/null
+@@ -1,177 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0-only */
+-/*
+- * Copyright (C) 2018 HUAWEI, Inc.
+- * https://www.huawei.com/
+- */
+-#ifndef __EROFS_FS_ZDATA_H
+-#define __EROFS_FS_ZDATA_H
+-
+-#include "internal.h"
+-
+-#define Z_EROFS_PCLUSTER_MAX_PAGES (Z_EROFS_PCLUSTER_MAX_SIZE / PAGE_SIZE)
+-#define Z_EROFS_INLINE_BVECS 2
+-
+-/*
+- * let's leave a type here in case of introducing
+- * another tagged pointer later.
+- */
+-typedef void *z_erofs_next_pcluster_t;
+-
+-struct z_erofs_bvec {
+- struct page *page;
+- int offset;
+- unsigned int end;
+-};
+-
+-#define __Z_EROFS_BVSET(name, total) \
+-struct name { \
+- /* point to the next page which contains the following bvecs */ \
+- struct page *nextpage; \
+- struct z_erofs_bvec bvec[total]; \
+-}
+-__Z_EROFS_BVSET(z_erofs_bvset,);
+-__Z_EROFS_BVSET(z_erofs_bvset_inline, Z_EROFS_INLINE_BVECS);
+-
+-/*
+- * Structure fields follow one of the following exclusion rules.
+- *
+- * I: Modifiable by initialization/destruction paths and read-only
+- * for everyone else;
+- *
+- * L: Field should be protected by the pcluster lock;
+- *
+- * A: Field should be accessed / updated in atomic for parallelized code.
+- */
+-struct z_erofs_pcluster {
+- struct erofs_workgroup obj;
+- struct mutex lock;
+-
+- /* A: point to next chained pcluster or TAILs */
+- z_erofs_next_pcluster_t next;
+-
+- /* L: the maximum decompression size of this round */
+- unsigned int length;
+-
+- /* L: total number of bvecs */
+- unsigned int vcnt;
+-
+- /* I: page offset of start position of decompression */
+- unsigned short pageofs_out;
+-
+- /* I: page offset of inline compressed data */
+- unsigned short pageofs_in;
+-
+- union {
+- /* L: inline a certain number of bvec for bootstrap */
+- struct z_erofs_bvset_inline bvset;
+-
+- /* I: can be used to free the pcluster by RCU. */
+- struct rcu_head rcu;
+- };
+-
+- union {
+- /* I: physical cluster size in pages */
+- unsigned short pclusterpages;
+-
+- /* I: tailpacking inline compressed size */
+- unsigned short tailpacking_size;
+- };
+-
+- /* I: compression algorithm format */
+- unsigned char algorithmformat;
+-
+- /* L: whether partial decompression or not */
+- bool partial;
+-
+- /* L: indicate several pageofs_outs or not */
+- bool multibases;
+-
+- /* A: compressed bvecs (can be cached or inplaced pages) */
+- struct z_erofs_bvec compressed_bvecs[];
+-};
+-
+-/* let's avoid the valid 32-bit kernel addresses */
+-
+-/* the chained workgroup has't submitted io (still open) */
+-#define Z_EROFS_PCLUSTER_TAIL ((void *)0x5F0ECAFE)
+-/* the chained workgroup has already submitted io */
+-#define Z_EROFS_PCLUSTER_TAIL_CLOSED ((void *)0x5F0EDEAD)
+-
+-#define Z_EROFS_PCLUSTER_NIL (NULL)
+-
+-struct z_erofs_decompressqueue {
+- struct super_block *sb;
+- atomic_t pending_bios;
+- z_erofs_next_pcluster_t head;
+-
+- union {
+- struct completion done;
+- struct work_struct work;
+- } u;
+-
+- bool eio, sync;
+-};
+-
+-static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl)
+-{
+- return !pcl->obj.index;
+-}
+-
+-static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *pcl)
+-{
+- if (z_erofs_is_inline_pcluster(pcl))
+- return 1;
+- return pcl->pclusterpages;
+-}
+-
+-/*
+- * bit 30: I/O error occurred on this page
+- * bit 0 - 29: remaining parts to complete this page
+- */
+-#define Z_EROFS_PAGE_EIO (1 << 30)
+-
+-static inline void z_erofs_onlinepage_init(struct page *page)
+-{
+- union {
+- atomic_t o;
+- unsigned long v;
+- } u = { .o = ATOMIC_INIT(1) };
+-
+- set_page_private(page, u.v);
+- smp_wmb();
+- SetPagePrivate(page);
+-}
+-
+-static inline void z_erofs_onlinepage_split(struct page *page)
+-{
+- atomic_inc((atomic_t *)&page->private);
+-}
+-
+-static inline void z_erofs_page_mark_eio(struct page *page)
+-{
+- int orig;
+-
+- do {
+- orig = atomic_read((atomic_t *)&page->private);
+- } while (atomic_cmpxchg((atomic_t *)&page->private, orig,
+- orig | Z_EROFS_PAGE_EIO) != orig);
+-}
+-
+-static inline void z_erofs_onlinepage_endio(struct page *page)
+-{
+- unsigned int v;
+-
+- DBG_BUGON(!PagePrivate(page));
+- v = atomic_dec_return((atomic_t *)&page->private);
+- if (!(v & ~Z_EROFS_PAGE_EIO)) {
+- set_page_private(page, 0);
+- ClearPagePrivate(page);
+- if (!(v & Z_EROFS_PAGE_EIO))
+- SetPageUptodate(page);
+- unlock_page(page);
+- }
+-}
+-
+-#define Z_EROFS_ONSTACK_PAGES 32
+-
+-#endif
+--
+2.39.2
+
--- /dev/null
+From cbcbd9bd74e8bc4cbe620a506939f34dd8604609 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Feb 2023 17:30:37 +0800
+Subject: erofs: remove tagged pointer helpers
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit b1ed220c6262bff63cdcb53692e492be0b05206c ]
+
+Just open-code the remaining one to simplify the code.
+
+Reviewed-by: Yue Hu <huyue2@coolpad.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20230204093040.97967-3-hsiangkao@linux.alibaba.com
+Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/tagptr.h | 107 ----------------------------------------------
+ fs/erofs/zdata.c | 26 +++--------
+ fs/erofs/zdata.h | 1 -
+ 3 files changed, 6 insertions(+), 128 deletions(-)
+ delete mode 100644 fs/erofs/tagptr.h
+
+diff --git a/fs/erofs/tagptr.h b/fs/erofs/tagptr.h
+deleted file mode 100644
+index 64ceb7270b5c1..0000000000000
+--- a/fs/erofs/tagptr.h
++++ /dev/null
+@@ -1,107 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0-only */
+-/*
+- * A tagged pointer implementation
+- */
+-#ifndef __EROFS_FS_TAGPTR_H
+-#define __EROFS_FS_TAGPTR_H
+-
+-#include <linux/types.h>
+-#include <linux/build_bug.h>
+-
+-/*
+- * the name of tagged pointer types are tagptr{1, 2, 3...}_t
+- * avoid directly using the internal structs __tagptr{1, 2, 3...}
+- */
+-#define __MAKE_TAGPTR(n) \
+-typedef struct __tagptr##n { \
+- uintptr_t v; \
+-} tagptr##n##_t;
+-
+-__MAKE_TAGPTR(1)
+-__MAKE_TAGPTR(2)
+-__MAKE_TAGPTR(3)
+-__MAKE_TAGPTR(4)
+-
+-#undef __MAKE_TAGPTR
+-
+-extern void __compiletime_error("bad tagptr tags")
+- __bad_tagptr_tags(void);
+-
+-extern void __compiletime_error("bad tagptr type")
+- __bad_tagptr_type(void);
+-
+-/* fix the broken usage of "#define tagptr2_t tagptr3_t" by users */
+-#define __tagptr_mask_1(ptr, n) \
+- __builtin_types_compatible_p(typeof(ptr), struct __tagptr##n) ? \
+- (1UL << (n)) - 1 :
+-
+-#define __tagptr_mask(ptr) (\
+- __tagptr_mask_1(ptr, 1) ( \
+- __tagptr_mask_1(ptr, 2) ( \
+- __tagptr_mask_1(ptr, 3) ( \
+- __tagptr_mask_1(ptr, 4) ( \
+- __bad_tagptr_type(), 0)))))
+-
+-/* generate a tagged pointer from a raw value */
+-#define tagptr_init(type, val) \
+- ((typeof(type)){ .v = (uintptr_t)(val) })
+-
+-/*
+- * directly cast a tagged pointer to the native pointer type, which
+- * could be used for backward compatibility of existing code.
+- */
+-#define tagptr_cast_ptr(tptr) ((void *)(tptr).v)
+-
+-/* encode tagged pointers */
+-#define tagptr_fold(type, ptr, _tags) ({ \
+- const typeof(_tags) tags = (_tags); \
+- if (__builtin_constant_p(tags) && (tags & ~__tagptr_mask(type))) \
+- __bad_tagptr_tags(); \
+-tagptr_init(type, (uintptr_t)(ptr) | tags); })
+-
+-/* decode tagged pointers */
+-#define tagptr_unfold_ptr(tptr) \
+- ((void *)((tptr).v & ~__tagptr_mask(tptr)))
+-
+-#define tagptr_unfold_tags(tptr) \
+- ((tptr).v & __tagptr_mask(tptr))
+-
+-/* operations for the tagger pointer */
+-#define tagptr_eq(_tptr1, _tptr2) ({ \
+- typeof(_tptr1) tptr1 = (_tptr1); \
+- typeof(_tptr2) tptr2 = (_tptr2); \
+- (void)(&tptr1 == &tptr2); \
+-(tptr1).v == (tptr2).v; })
+-
+-/* lock-free CAS operation */
+-#define tagptr_cmpxchg(_ptptr, _o, _n) ({ \
+- typeof(_ptptr) ptptr = (_ptptr); \
+- typeof(_o) o = (_o); \
+- typeof(_n) n = (_n); \
+- (void)(&o == &n); \
+- (void)(&o == ptptr); \
+-tagptr_init(o, cmpxchg(&ptptr->v, o.v, n.v)); })
+-
+-/* wrap WRITE_ONCE if atomic update is needed */
+-#define tagptr_replace_tags(_ptptr, tags) ({ \
+- typeof(_ptptr) ptptr = (_ptptr); \
+- *ptptr = tagptr_fold(*ptptr, tagptr_unfold_ptr(*ptptr), tags); \
+-*ptptr; })
+-
+-#define tagptr_set_tags(_ptptr, _tags) ({ \
+- typeof(_ptptr) ptptr = (_ptptr); \
+- const typeof(_tags) tags = (_tags); \
+- if (__builtin_constant_p(tags) && (tags & ~__tagptr_mask(*ptptr))) \
+- __bad_tagptr_tags(); \
+- ptptr->v |= tags; \
+-*ptptr; })
+-
+-#define tagptr_clear_tags(_ptptr, _tags) ({ \
+- typeof(_ptptr) ptptr = (_ptptr); \
+- const typeof(_tags) tags = (_tags); \
+- if (__builtin_constant_p(tags) && (tags & ~__tagptr_mask(*ptptr))) \
+- __bad_tagptr_tags(); \
+- ptptr->v &= ~tags; \
+-*ptptr; })
+-
+-#endif /* __EROFS_FS_TAGPTR_H */
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index 8e80871a8c1d7..3b5f73224c22a 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -175,15 +175,6 @@ static void z_erofs_free_pcluster(struct z_erofs_pcluster *pcl)
+ DBG_BUGON(1);
+ }
+
+-/*
+- * tagged pointer with 1-bit tag for all compressed pages
+- * tag 0 - the page is just found with an extra page reference
+- */
+-typedef tagptr1_t compressed_page_t;
+-
+-#define tag_compressed_page_justfound(page) \
+- tagptr_fold(compressed_page_t, page, 1)
+-
+ static struct workqueue_struct *z_erofs_workqueue __read_mostly;
+
+ void z_erofs_exit_zip_subsystem(void)
+@@ -319,7 +310,7 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe,
+
+ for (i = 0; i < pcl->pclusterpages; ++i) {
+ struct page *page;
+- compressed_page_t t;
++ void *t; /* mark pages just found for debugging */
+ struct page *newpage = NULL;
+
+ /* the compressed page was loaded before */
+@@ -329,7 +320,7 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe,
+ page = find_get_page(mc, pcl->obj.index + i);
+
+ if (page) {
+- t = tag_compressed_page_justfound(page);
++ t = (void *)((unsigned long)page | 1);
+ } else {
+ /* I/O is needed, no possible to decompress directly */
+ standalone = false;
+@@ -345,11 +336,10 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe,
+ if (!newpage)
+ continue;
+ set_page_private(newpage, Z_EROFS_PREALLOCATED_PAGE);
+- t = tag_compressed_page_justfound(newpage);
++ t = (void *)((unsigned long)newpage | 1);
+ }
+
+- if (!cmpxchg_relaxed(&pcl->compressed_bvecs[i].page, NULL,
+- tagptr_cast_ptr(t)))
++ if (!cmpxchg_relaxed(&pcl->compressed_bvecs[i].page, NULL, t))
+ continue;
+
+ if (page)
+@@ -1192,8 +1182,6 @@ static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl,
+
+ struct address_space *mapping;
+ struct page *oldpage, *page;
+-
+- compressed_page_t t;
+ int justfound;
+
+ repeat:
+@@ -1203,10 +1191,8 @@ static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl,
+ if (!page)
+ goto out_allocpage;
+
+- /* process the target tagged pointer */
+- t = tagptr_init(compressed_page_t, page);
+- justfound = tagptr_unfold_tags(t);
+- page = tagptr_unfold_ptr(t);
++ justfound = (unsigned long)page & 1UL;
++ page = (struct page *)((unsigned long)page & ~1UL);
+
+ /*
+ * preallocated cached pages, which is used to avoid direct reclaim
+diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h
+index b139de5473a97..f196a729c7e85 100644
+--- a/fs/erofs/zdata.h
++++ b/fs/erofs/zdata.h
+@@ -7,7 +7,6 @@
+ #define __EROFS_FS_ZDATA_H
+
+ #include "internal.h"
+-#include "tagptr.h"
+
+ #define Z_EROFS_PCLUSTER_MAX_PAGES (Z_EROFS_PCLUSTER_MAX_SIZE / PAGE_SIZE)
+ #define Z_EROFS_INLINE_BVECS 2
+--
+2.39.2
+
--- /dev/null
+From 15cff145ef696d82abccbc506d9db06b3c0f8504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jan 2023 23:08:23 +0800
+Subject: erofs: simplify iloc()
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit b780d3fc6107464dcc43631a6208c43b6421f1e6 ]
+
+Actually we could pass in inodes directly to clean up all callers.
+Also rename iloc() as erofs_iloc().
+
+Link: https://lore.kernel.org/r/20230114150823.432069-1-xiang@kernel.org
+Reviewed-by: Yue Hu <huyue2@coolpad.com>
+Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Stable-dep-of: 001b8ccd0650 ("erofs: fix compact 4B support for 16k block size")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/data.c | 9 +++------
+ fs/erofs/inode.c | 2 +-
+ fs/erofs/internal.h | 16 +++++++++-------
+ fs/erofs/xattr.c | 20 +++++++-------------
+ fs/erofs/zmap.c | 13 +++++--------
+ include/trace/events/erofs.h | 4 ++--
+ 6 files changed, 27 insertions(+), 37 deletions(-)
+
+diff --git a/fs/erofs/data.c b/fs/erofs/data.c
+index fe8ac0e163f7e..b32801d716f89 100644
+--- a/fs/erofs/data.c
++++ b/fs/erofs/data.c
+@@ -95,11 +95,8 @@ static int erofs_map_blocks_flatmode(struct inode *inode,
+ map->m_pa = blknr_to_addr(vi->raw_blkaddr) + map->m_la;
+ map->m_plen = blknr_to_addr(lastblk) - offset;
+ } else if (tailendpacking) {
+- /* 2 - inode inline B: inode, [xattrs], inline last blk... */
+- struct erofs_sb_info *sbi = EROFS_SB(inode->i_sb);
+-
+- map->m_pa = iloc(sbi, vi->nid) + vi->inode_isize +
+- vi->xattr_isize + erofs_blkoff(map->m_la);
++ map->m_pa = erofs_iloc(inode) + vi->inode_isize +
++ vi->xattr_isize + erofs_blkoff(offset);
+ map->m_plen = inode->i_size - offset;
+
+ /* inline data should be located in the same meta block */
+@@ -154,7 +151,7 @@ int erofs_map_blocks(struct inode *inode,
+ unit = EROFS_BLOCK_MAP_ENTRY_SIZE; /* block map */
+
+ chunknr = map->m_la >> vi->chunkbits;
+- pos = ALIGN(iloc(EROFS_SB(sb), vi->nid) + vi->inode_isize +
++ pos = ALIGN(erofs_iloc(inode) + vi->inode_isize +
+ vi->xattr_isize, unit) + unit * chunknr;
+
+ kaddr = erofs_read_metabuf(&buf, sb, erofs_blknr(pos), EROFS_KMAP);
+diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c
+index ad2a82f2eb4cd..5aadc73d57652 100644
+--- a/fs/erofs/inode.c
++++ b/fs/erofs/inode.c
+@@ -14,7 +14,7 @@ static void *erofs_read_inode(struct erofs_buf *buf,
+ struct super_block *sb = inode->i_sb;
+ struct erofs_sb_info *sbi = EROFS_SB(sb);
+ struct erofs_inode *vi = EROFS_I(inode);
+- const erofs_off_t inode_loc = iloc(sbi, vi->nid);
++ const erofs_off_t inode_loc = erofs_iloc(inode);
+
+ erofs_blk_t blkaddr, nblks = 0;
+ void *kaddr;
+diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h
+index 340bd56a57559..d8d09fc3ed655 100644
+--- a/fs/erofs/internal.h
++++ b/fs/erofs/internal.h
+@@ -273,11 +273,6 @@ struct erofs_buf {
+ #define erofs_blkoff(addr) ((addr) % EROFS_BLKSIZ)
+ #define blknr_to_addr(nr) ((erofs_off_t)(nr) * EROFS_BLKSIZ)
+
+-static inline erofs_off_t iloc(struct erofs_sb_info *sbi, erofs_nid_t nid)
+-{
+- return blknr_to_addr(sbi->meta_blkaddr) + (nid << sbi->islotbits);
+-}
+-
+ #define EROFS_FEATURE_FUNCS(name, compat, feature) \
+ static inline bool erofs_sb_has_##name(struct erofs_sb_info *sbi) \
+ { \
+@@ -342,8 +337,15 @@ struct erofs_inode {
+ struct inode vfs_inode;
+ };
+
+-#define EROFS_I(ptr) \
+- container_of(ptr, struct erofs_inode, vfs_inode)
++#define EROFS_I(ptr) container_of(ptr, struct erofs_inode, vfs_inode)
++
++static inline erofs_off_t erofs_iloc(struct inode *inode)
++{
++ struct erofs_sb_info *sbi = EROFS_I_SB(inode);
++
++ return blknr_to_addr(sbi->meta_blkaddr) +
++ (EROFS_I(inode)->nid << sbi->islotbits);
++}
+
+ static inline unsigned long erofs_inode_datablocks(struct inode *inode)
+ {
+diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c
+index 8106bcb5a38d1..a2776abf36986 100644
+--- a/fs/erofs/xattr.c
++++ b/fs/erofs/xattr.c
+@@ -22,8 +22,7 @@ static int init_inode_xattrs(struct inode *inode)
+ struct xattr_iter it;
+ unsigned int i;
+ struct erofs_xattr_ibody_header *ih;
+- struct super_block *sb;
+- struct erofs_sb_info *sbi;
++ struct super_block *sb = inode->i_sb;
+ int ret = 0;
+
+ /* the most case is that xattrs of this inode are initialized. */
+@@ -52,15 +51,14 @@ static int init_inode_xattrs(struct inode *inode)
+ * undefined right now (maybe use later with some new sb feature).
+ */
+ if (vi->xattr_isize == sizeof(struct erofs_xattr_ibody_header)) {
+- erofs_err(inode->i_sb,
++ erofs_err(sb,
+ "xattr_isize %d of nid %llu is not supported yet",
+ vi->xattr_isize, vi->nid);
+ ret = -EOPNOTSUPP;
+ goto out_unlock;
+ } else if (vi->xattr_isize < sizeof(struct erofs_xattr_ibody_header)) {
+ if (vi->xattr_isize) {
+- erofs_err(inode->i_sb,
+- "bogus xattr ibody @ nid %llu", vi->nid);
++ erofs_err(sb, "bogus xattr ibody @ nid %llu", vi->nid);
+ DBG_BUGON(1);
+ ret = -EFSCORRUPTED;
+ goto out_unlock; /* xattr ondisk layout error */
+@@ -69,11 +67,9 @@ static int init_inode_xattrs(struct inode *inode)
+ goto out_unlock;
+ }
+
+- sb = inode->i_sb;
+- sbi = EROFS_SB(sb);
+ it.buf = __EROFS_BUF_INITIALIZER;
+- it.blkaddr = erofs_blknr(iloc(sbi, vi->nid) + vi->inode_isize);
+- it.ofs = erofs_blkoff(iloc(sbi, vi->nid) + vi->inode_isize);
++ it.blkaddr = erofs_blknr(erofs_iloc(inode) + vi->inode_isize);
++ it.ofs = erofs_blkoff(erofs_iloc(inode) + vi->inode_isize);
+
+ /* read in shared xattr array (non-atomic, see kmalloc below) */
+ it.kaddr = erofs_read_metabuf(&it.buf, sb, it.blkaddr, EROFS_KMAP);
+@@ -159,7 +155,6 @@ static int inline_xattr_iter_begin(struct xattr_iter *it,
+ struct inode *inode)
+ {
+ struct erofs_inode *const vi = EROFS_I(inode);
+- struct erofs_sb_info *const sbi = EROFS_SB(inode->i_sb);
+ unsigned int xattr_header_sz, inline_xattr_ofs;
+
+ xattr_header_sz = inlinexattr_header_size(inode);
+@@ -170,9 +165,8 @@ static int inline_xattr_iter_begin(struct xattr_iter *it,
+
+ inline_xattr_ofs = vi->inode_isize + xattr_header_sz;
+
+- it->blkaddr = erofs_blknr(iloc(sbi, vi->nid) + inline_xattr_ofs);
+- it->ofs = erofs_blkoff(iloc(sbi, vi->nid) + inline_xattr_ofs);
+-
++ it->blkaddr = erofs_blknr(erofs_iloc(inode) + inline_xattr_ofs);
++ it->ofs = erofs_blkoff(erofs_iloc(inode) + inline_xattr_ofs);
+ it->kaddr = erofs_read_metabuf(&it->buf, inode->i_sb, it->blkaddr,
+ EROFS_KMAP_ATOMIC);
+ if (IS_ERR(it->kaddr))
+diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
+index bb91cc6499725..3961bb55dea11 100644
+--- a/fs/erofs/zmap.c
++++ b/fs/erofs/zmap.c
+@@ -55,8 +55,7 @@ static int z_erofs_fill_inode_lazy(struct inode *inode)
+ if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags))
+ goto out_unlock;
+
+- pos = ALIGN(iloc(EROFS_SB(sb), vi->nid) + vi->inode_isize +
+- vi->xattr_isize, 8);
++ pos = ALIGN(erofs_iloc(inode) + vi->inode_isize + vi->xattr_isize, 8);
+ kaddr = erofs_read_metabuf(&buf, sb, erofs_blknr(pos), EROFS_KMAP);
+ if (IS_ERR(kaddr)) {
+ err = PTR_ERR(kaddr);
+@@ -169,10 +168,9 @@ static int legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m,
+ {
+ struct inode *const inode = m->inode;
+ struct erofs_inode *const vi = EROFS_I(inode);
+- const erofs_off_t ibase = iloc(EROFS_I_SB(inode), vi->nid);
+ const erofs_off_t pos =
+- Z_EROFS_VLE_LEGACY_INDEX_ALIGN(ibase + vi->inode_isize +
+- vi->xattr_isize) +
++ Z_EROFS_VLE_LEGACY_INDEX_ALIGN(erofs_iloc(inode) +
++ vi->inode_isize + vi->xattr_isize) +
+ lcn * sizeof(struct z_erofs_vle_decompressed_index);
+ struct z_erofs_vle_decompressed_index *di;
+ unsigned int advise, type;
+@@ -376,9 +374,8 @@ static int compacted_load_cluster_from_disk(struct z_erofs_maprecorder *m,
+ struct inode *const inode = m->inode;
+ struct erofs_inode *const vi = EROFS_I(inode);
+ const unsigned int lclusterbits = vi->z_logical_clusterbits;
+- const erofs_off_t ebase = ALIGN(iloc(EROFS_I_SB(inode), vi->nid) +
+- vi->inode_isize + vi->xattr_isize, 8) +
+- sizeof(struct z_erofs_map_header);
++ const erofs_off_t ebase = sizeof(struct z_erofs_map_header) +
++ ALIGN(erofs_iloc(inode) + vi->inode_isize + vi->xattr_isize, 8);
+ const unsigned int totalidx = DIV_ROUND_UP(inode->i_size, EROFS_BLKSIZ);
+ unsigned int compacted_4b_initial, compacted_2b;
+ unsigned int amortizedshift;
+diff --git a/include/trace/events/erofs.h b/include/trace/events/erofs.h
+index 4f4c44ea3a655..e095d36db9391 100644
+--- a/include/trace/events/erofs.h
++++ b/include/trace/events/erofs.h
+@@ -66,8 +66,8 @@ TRACE_EVENT(erofs_fill_inode,
+ TP_fast_assign(
+ __entry->dev = inode->i_sb->s_dev;
+ __entry->nid = EROFS_I(inode)->nid;
+- __entry->blkaddr = erofs_blknr(iloc(EROFS_I_SB(inode), __entry->nid));
+- __entry->ofs = erofs_blkoff(iloc(EROFS_I_SB(inode), __entry->nid));
++ __entry->blkaddr = erofs_blknr(erofs_iloc(inode));
++ __entry->ofs = erofs_blkoff(erofs_iloc(inode));
+ ),
+
+ TP_printk("dev = (%d,%d), nid = %llu, blkaddr %u ofs %u",
+--
+2.39.2
+
--- /dev/null
+From 5b0711f28750d10df7f5d422d639ad21e5dee74d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 11:40:36 +0100
+Subject: evm: Complete description of evm_inode_setattr()
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+[ Upstream commit b1de86d4248b273cb12c4cd7d20c08d459519f7d ]
+
+Add the description for missing parameters of evm_inode_setattr() to
+avoid the warning arising with W=n compile option.
+
+Fixes: 817b54aa45db ("evm: add evm_inode_setattr to prevent updating an invalid security.evm") # v3.2+
+Fixes: c1632a0f1120 ("fs: port ->setattr() to pass mnt_idmap") # v6.3+
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/evm/evm_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index 23d484e05e6f2..f1a26d50c1d58 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -776,7 +776,9 @@ static int evm_attr_change(struct user_namespace *mnt_userns,
+
+ /**
+ * evm_inode_setattr - prevent updating an invalid EVM extended attribute
++ * @idmap: idmap of the mount
+ * @dentry: pointer to the affected dentry
++ * @attr: iattr structure containing the new file attributes
+ *
+ * Permit update of file attributes when files have a valid EVM signature,
+ * except in the case of them having an immutable portable signature.
+--
+2.39.2
+
--- /dev/null
+From 9248a64eaa453bbb2a9c4aafacff28cdaf87c8bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 09:41:12 +0200
+Subject: evm: Fix build warnings
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+[ Upstream commit 996e0a97ebd7b11cb785794e2a83c20c1add9d92 ]
+
+Fix build warnings (function parameters description) for
+evm_read_protected_xattrs(), evm_set_key() and evm_verifyxattr().
+
+Fixes: 7626676320f3 ("evm: provide a function to set the EVM key from the kernel") # v4.5+
+Fixes: 8314b6732ae4 ("ima: Define new template fields xattrnames, xattrlengths and xattrvalues") # v5.14+
+Fixes: 2960e6cb5f7c ("evm: additional parameter to pass integrity cache entry 'iint'") # v3.2+
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/evm/evm_crypto.c | 2 +-
+ security/integrity/evm/evm_main.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index 708de9656bbd2..b9395f8ef5829 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -40,7 +40,7 @@ static const char evm_hmac[] = "hmac(sha1)";
+ /**
+ * evm_set_key() - set EVM HMAC key from the kernel
+ * @key: pointer to a buffer with the key data
+- * @size: length of the key data
++ * @keylen: length of the key data
+ *
+ * This function allows setting the EVM HMAC key from the kernel
+ * without using the "encrypted" key subsystem keys. It can be used
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index f1a26d50c1d58..a338f19447d03 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -318,7 +318,6 @@ int evm_protected_xattr_if_enabled(const char *req_xattr_name)
+ /**
+ * evm_read_protected_xattrs - read EVM protected xattr names, lengths, values
+ * @dentry: dentry of the read xattrs
+- * @inode: inode of the read xattrs
+ * @buffer: buffer xattr names, lengths or values are copied to
+ * @buffer_size: size of buffer
+ * @type: n: names, l: lengths, v: values
+@@ -390,6 +389,7 @@ int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer,
+ * @xattr_name: requested xattr
+ * @xattr_value: requested xattr value
+ * @xattr_value_len: requested xattr value length
++ * @iint: inode integrity metadata
+ *
+ * Calculate the HMAC for the given dentry and verify it against the stored
+ * security.evm xattr. For performance, use the xattr value and length
+--
+2.39.2
+
--- /dev/null
+From 85a8462a97218c583bf1638a94c105fc5e8746ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 17:42:28 +0200
+Subject: fbdev: omapfb: lcd_mipid: Fix an error handling path in
+ mipid_spi_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 79a3908d1ea6c35157a6d907b1a9d8ec06015e7a ]
+
+If 'mipid_detect()' fails, we must free 'md' to avoid a memory leak.
+
+Fixes: 66d2f99d0bb5 ("omapfb: add support for MIPI-DCS compatible LCDs")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap/lcd_mipid.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/omap/lcd_mipid.c b/drivers/video/fbdev/omap/lcd_mipid.c
+index 03cff39d392db..cc1079aad61f2 100644
+--- a/drivers/video/fbdev/omap/lcd_mipid.c
++++ b/drivers/video/fbdev/omap/lcd_mipid.c
+@@ -563,11 +563,15 @@ static int mipid_spi_probe(struct spi_device *spi)
+
+ r = mipid_detect(md);
+ if (r < 0)
+- return r;
++ goto free_md;
+
+ omapfb_register_panel(&md->panel);
+
+ return 0;
++
++free_md:
++ kfree(md);
++ return r;
+ }
+
+ static void mipid_spi_remove(struct spi_device *spi)
+--
+2.39.2
+
--- /dev/null
+From 046bd8d228d42157403647e4182a6e9a7da0e38f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 21:56:12 +0200
+Subject: fs: pipe: reveal missing function protoypes
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 247c8d2f9837a3e29e3b6b7a4aa9c36c37659dd4 ]
+
+A couple of functions from fs/pipe.c are used both internally
+and for the watch queue code, but the declaration is only
+visible when the latter is enabled:
+
+fs/pipe.c:1254:5: error: no previous prototype for 'pipe_resize_ring'
+fs/pipe.c:758:15: error: no previous prototype for 'account_pipe_buffers'
+fs/pipe.c:764:6: error: no previous prototype for 'too_many_pipe_buffers_soft'
+fs/pipe.c:771:6: error: no previous prototype for 'too_many_pipe_buffers_hard'
+fs/pipe.c:777:6: error: no previous prototype for 'pipe_is_unprivileged_user'
+
+Make the visible unconditionally to avoid these warnings.
+
+Fixes: c73be61cede5 ("pipe: Add general notification queue support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Message-Id: <20230516195629.551602-1-arnd@kernel.org>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pipe_fs_i.h | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index 6cb65df3e3ba5..28b3c6a673975 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -241,18 +241,14 @@ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);
+
+ extern const struct pipe_buf_operations nosteal_pipe_buf_ops;
+
+-#ifdef CONFIG_WATCH_QUEUE
+ unsigned long account_pipe_buffers(struct user_struct *user,
+ unsigned long old, unsigned long new);
+ bool too_many_pipe_buffers_soft(unsigned long user_bufs);
+ bool too_many_pipe_buffers_hard(unsigned long user_bufs);
+ bool pipe_is_unprivileged_user(void);
+-#endif
+
+ /* for F_SETPIPE_SZ and F_GETPIPE_SZ */
+-#ifdef CONFIG_WATCH_QUEUE
+ int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int nr_slots);
+-#endif
+ long pipe_fcntl(struct file *, unsigned int, unsigned long arg);
+ struct pipe_inode_info *get_pipe_info(struct file *file, bool for_splice);
+
+--
+2.39.2
+
--- /dev/null
+From d750ec91f35481030ea3fb31111f3fdd5f02936c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 14:32:31 -0700
+Subject: gtp: Fix use-after-free in __gtp_encap_destroy().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit ce3aee7114c575fab32a5e9e939d4bbb3dcca79f ]
+
+syzkaller reported use-after-free in __gtp_encap_destroy(). [0]
+
+It shows the same process freed sk and touched it illegally.
+
+Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock()
+and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data,
+but release_sock() is called after sock_put() releases the last refcnt.
+
+[0]:
+BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
+BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
+BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
+BUG: KASAN: slab-use-after-free in do_raw_spin_lock include/linux/spinlock.h:186 [inline]
+BUG: KASAN: slab-use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline]
+BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178
+Write of size 4 at addr ffff88800dbef398 by task syz-executor.2/2401
+
+CPU: 1 PID: 2401 Comm: syz-executor.2 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
+ print_address_description mm/kasan/report.c:351 [inline]
+ print_report+0xcc/0x620 mm/kasan/report.c:462
+ kasan_report+0xb2/0xe0 mm/kasan/report.c:572
+ check_region_inline mm/kasan/generic.c:181 [inline]
+ kasan_check_range+0x39/0x1c0 mm/kasan/generic.c:187
+ instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
+ atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
+ queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
+ do_raw_spin_lock include/linux/spinlock.h:186 [inline]
+ __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline]
+ _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178
+ spin_lock_bh include/linux/spinlock.h:355 [inline]
+ release_sock+0x1f/0x1a0 net/core/sock.c:3526
+ gtp_encap_disable_sock drivers/net/gtp.c:651 [inline]
+ gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664
+ gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728
+ unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841
+ rtnl_delete_link net/core/rtnetlink.c:3216 [inline]
+ rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268
+ rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423
+ netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548
+ netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
+ netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365
+ netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913
+ sock_sendmsg_nosec net/socket.c:724 [inline]
+ sock_sendmsg+0x1b7/0x200 net/socket.c:747
+ ____sys_sendmsg+0x75a/0x990 net/socket.c:2493
+ ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547
+ __sys_sendmsg+0xfe/0x1d0 net/socket.c:2576
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc
+RIP: 0033:0x7f1168b1fe5d
+Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48
+RSP: 002b:00007f1167edccc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f1168b1fe5d
+RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003
+RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+R13: 000000000000000b R14: 00007f1168b80530 R15: 0000000000000000
+ </TASK>
+
+Allocated by task 1483:
+ kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
+ kasan_set_track+0x25/0x30 mm/kasan/common.c:52
+ __kasan_slab_alloc+0x59/0x70 mm/kasan/common.c:328
+ kasan_slab_alloc include/linux/kasan.h:186 [inline]
+ slab_post_alloc_hook mm/slab.h:711 [inline]
+ slab_alloc_node mm/slub.c:3451 [inline]
+ slab_alloc mm/slub.c:3459 [inline]
+ __kmem_cache_alloc_lru mm/slub.c:3466 [inline]
+ kmem_cache_alloc+0x16d/0x340 mm/slub.c:3475
+ sk_prot_alloc+0x5f/0x280 net/core/sock.c:2073
+ sk_alloc+0x34/0x6c0 net/core/sock.c:2132
+ inet6_create net/ipv6/af_inet6.c:192 [inline]
+ inet6_create+0x2c7/0xf20 net/ipv6/af_inet6.c:119
+ __sock_create+0x2a1/0x530 net/socket.c:1535
+ sock_create net/socket.c:1586 [inline]
+ __sys_socket_create net/socket.c:1623 [inline]
+ __sys_socket_create net/socket.c:1608 [inline]
+ __sys_socket+0x137/0x250 net/socket.c:1651
+ __do_sys_socket net/socket.c:1664 [inline]
+ __se_sys_socket net/socket.c:1662 [inline]
+ __x64_sys_socket+0x72/0xb0 net/socket.c:1662
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc
+
+Freed by task 2401:
+ kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
+ kasan_set_track+0x25/0x30 mm/kasan/common.c:52
+ kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521
+ ____kasan_slab_free mm/kasan/common.c:236 [inline]
+ ____kasan_slab_free mm/kasan/common.c:200 [inline]
+ __kasan_slab_free+0x10c/0x1b0 mm/kasan/common.c:244
+ kasan_slab_free include/linux/kasan.h:162 [inline]
+ slab_free_hook mm/slub.c:1781 [inline]
+ slab_free_freelist_hook mm/slub.c:1807 [inline]
+ slab_free mm/slub.c:3786 [inline]
+ kmem_cache_free+0xb4/0x490 mm/slub.c:3808
+ sk_prot_free net/core/sock.c:2113 [inline]
+ __sk_destruct+0x500/0x720 net/core/sock.c:2207
+ sk_destruct+0xc1/0xe0 net/core/sock.c:2222
+ __sk_free+0xed/0x3d0 net/core/sock.c:2233
+ sk_free+0x7c/0xa0 net/core/sock.c:2244
+ sock_put include/net/sock.h:1981 [inline]
+ __gtp_encap_destroy+0x165/0x1b0 drivers/net/gtp.c:634
+ gtp_encap_disable_sock drivers/net/gtp.c:651 [inline]
+ gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664
+ gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728
+ unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841
+ rtnl_delete_link net/core/rtnetlink.c:3216 [inline]
+ rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268
+ rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423
+ netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548
+ netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
+ netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365
+ netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913
+ sock_sendmsg_nosec net/socket.c:724 [inline]
+ sock_sendmsg+0x1b7/0x200 net/socket.c:747
+ ____sys_sendmsg+0x75a/0x990 net/socket.c:2493
+ ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547
+ __sys_sendmsg+0xfe/0x1d0 net/socket.c:2576
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc
+
+The buggy address belongs to the object at ffff88800dbef300
+ which belongs to the cache UDPv6 of size 1344
+The buggy address is located 152 bytes inside of
+ freed 1344-byte region [ffff88800dbef300, ffff88800dbef840)
+
+The buggy address belongs to the physical page:
+page:00000000d31bfed5 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800dbeed40 pfn:0xdbe8
+head:00000000d31bfed5 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
+memcg:ffff888008ee0801
+flags: 0x100000000010200(slab|head|node=0|zone=1)
+page_type: 0xffffffff()
+raw: 0100000000010200 ffff88800c7a3000 dead000000000122 0000000000000000
+raw: ffff88800dbeed40 0000000080160015 00000001ffffffff ffff888008ee0801
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff88800dbef280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ffff88800dbef300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+>ffff88800dbef380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff88800dbef400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff88800dbef480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+
+Fixes: e198987e7dd7 ("gtp: fix suspicious RCU usage")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Link: https://lore.kernel.org/r/20230622213231.24651-1-kuniyu@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/gtp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index 15c7dc82107f4..acb20ad4e37eb 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -631,7 +631,9 @@ static void __gtp_encap_destroy(struct sock *sk)
+ gtp->sk1u = NULL;
+ udp_sk(sk)->encap_type = 0;
+ rcu_assign_sk_user_data(sk, NULL);
++ release_sock(sk);
+ sock_put(sk);
++ return;
+ }
+ release_sock(sk);
+ }
+--
+2.39.2
+
--- /dev/null
+From ef78edbbe21652c9e5e7af60a419c9ee18ef1c1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 18:59:37 +0100
+Subject: HID: input: map battery system charging
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Expósito <jose.exposito89@gmail.com>
+
+[ Upstream commit a608dc1c06397dc50ab773498433432fb5938f92 ]
+
+HID descriptors with Battery System (0x85) Charging (0x44) usage are
+ignored and POWER_SUPPLY_STATUS_DISCHARGING is always reported to user
+space, even when the device is charging.
+
+Map this usage and when it is reported set the right charging status.
+
+In addition, add KUnit tests to make sure that the charging status is
+correctly set and reported. They can be run with the usual command:
+
+ $ ./tools/testing/kunit/kunit.py run --kunitconfig=drivers/hid
+
+Signed-off-by: José Expósito <jose.exposito89@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Stable-dep-of: 49904a0ebf23 ("HID: uclogic: Modular KUnit tests should not depend on KUNIT=y")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/.kunitconfig | 1 +
+ drivers/hid/Kconfig | 1 +
+ drivers/hid/hid-input-test.c | 80 ++++++++++++++++++++++++++++++++++++
+ drivers/hid/hid-input.c | 36 +++++++++++++++-
+ include/linux/hid.h | 2 +
+ 5 files changed, 118 insertions(+), 2 deletions(-)
+ create mode 100644 drivers/hid/hid-input-test.c
+
+diff --git a/drivers/hid/.kunitconfig b/drivers/hid/.kunitconfig
+index 04daeff5c970e..675a8209c7aeb 100644
+--- a/drivers/hid/.kunitconfig
++++ b/drivers/hid/.kunitconfig
+@@ -1,5 +1,6 @@
+ CONFIG_KUNIT=y
+ CONFIG_USB=y
+ CONFIG_USB_HID=y
++CONFIG_HID_BATTERY_STRENGTH=y
+ CONFIG_HID_UCLOGIC=y
+ CONFIG_HID_KUNIT_TEST=y
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 185a077d59cdd..644b4913d4d85 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -1263,6 +1263,7 @@ config HID_MCP2221
+ config HID_KUNIT_TEST
+ tristate "KUnit tests for HID" if !KUNIT_ALL_TESTS
+ depends on KUNIT=y
++ depends on HID_BATTERY_STRENGTH
+ depends on HID_UCLOGIC
+ default KUNIT_ALL_TESTS
+ help
+diff --git a/drivers/hid/hid-input-test.c b/drivers/hid/hid-input-test.c
+new file mode 100644
+index 0000000000000..77c2d45ac62a7
+--- /dev/null
++++ b/drivers/hid/hid-input-test.c
+@@ -0,0 +1,80 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * HID to Linux Input mapping
++ *
++ * Copyright (c) 2022 José Expósito <jose.exposito89@gmail.com>
++ */
++
++#include <kunit/test.h>
++
++static void hid_test_input_set_battery_charge_status(struct kunit *test)
++{
++ struct hid_device *dev;
++ bool handled;
++
++ dev = kunit_kzalloc(test, sizeof(*dev), GFP_KERNEL);
++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);
++
++ handled = hidinput_set_battery_charge_status(dev, HID_DG_HEIGHT, 0);
++ KUNIT_EXPECT_FALSE(test, handled);
++ KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_UNKNOWN);
++
++ handled = hidinput_set_battery_charge_status(dev, HID_BAT_CHARGING, 0);
++ KUNIT_EXPECT_TRUE(test, handled);
++ KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_DISCHARGING);
++
++ handled = hidinput_set_battery_charge_status(dev, HID_BAT_CHARGING, 1);
++ KUNIT_EXPECT_TRUE(test, handled);
++ KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_CHARGING);
++}
++
++static void hid_test_input_get_battery_property(struct kunit *test)
++{
++ struct power_supply *psy;
++ struct hid_device *dev;
++ union power_supply_propval val;
++ int ret;
++
++ dev = kunit_kzalloc(test, sizeof(*dev), GFP_KERNEL);
++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);
++ dev->battery_avoid_query = true;
++
++ psy = kunit_kzalloc(test, sizeof(*psy), GFP_KERNEL);
++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, psy);
++ psy->drv_data = dev;
++
++ dev->battery_status = HID_BATTERY_UNKNOWN;
++ dev->battery_charge_status = POWER_SUPPLY_STATUS_CHARGING;
++ ret = hidinput_get_battery_property(psy, POWER_SUPPLY_PROP_STATUS, &val);
++ KUNIT_EXPECT_EQ(test, ret, 0);
++ KUNIT_EXPECT_EQ(test, val.intval, POWER_SUPPLY_STATUS_UNKNOWN);
++
++ dev->battery_status = HID_BATTERY_REPORTED;
++ dev->battery_charge_status = POWER_SUPPLY_STATUS_CHARGING;
++ ret = hidinput_get_battery_property(psy, POWER_SUPPLY_PROP_STATUS, &val);
++ KUNIT_EXPECT_EQ(test, ret, 0);
++ KUNIT_EXPECT_EQ(test, val.intval, POWER_SUPPLY_STATUS_CHARGING);
++
++ dev->battery_status = HID_BATTERY_REPORTED;
++ dev->battery_charge_status = POWER_SUPPLY_STATUS_DISCHARGING;
++ ret = hidinput_get_battery_property(psy, POWER_SUPPLY_PROP_STATUS, &val);
++ KUNIT_EXPECT_EQ(test, ret, 0);
++ KUNIT_EXPECT_EQ(test, val.intval, POWER_SUPPLY_STATUS_DISCHARGING);
++}
++
++static struct kunit_case hid_input_tests[] = {
++ KUNIT_CASE(hid_test_input_set_battery_charge_status),
++ KUNIT_CASE(hid_test_input_get_battery_property),
++ { }
++};
++
++static struct kunit_suite hid_input_test_suite = {
++ .name = "hid_input",
++ .test_cases = hid_input_tests,
++};
++
++kunit_test_suite(hid_input_test_suite);
++
++MODULE_DESCRIPTION("HID input KUnit tests");
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("José Expósito <jose.exposito89@gmail.com>");
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 3acaaca888acd..6e836b179bdf8 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -492,7 +492,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ if (dev->battery_status == HID_BATTERY_UNKNOWN)
+ val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
+ else
+- val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
++ val->intval = dev->battery_charge_status;
+ break;
+
+ case POWER_SUPPLY_PROP_SCOPE:
+@@ -560,6 +560,7 @@ static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type,
+ dev->battery_max = max;
+ dev->battery_report_type = report_type;
+ dev->battery_report_id = field->report->id;
++ dev->battery_charge_status = POWER_SUPPLY_STATUS_DISCHARGING;
+
+ /*
+ * Stylus is normally not connected to the device and thus we
+@@ -626,6 +627,20 @@ static void hidinput_update_battery(struct hid_device *dev, int value)
+ power_supply_changed(dev->battery);
+ }
+ }
++
++static bool hidinput_set_battery_charge_status(struct hid_device *dev,
++ unsigned int usage, int value)
++{
++ switch (usage) {
++ case HID_BAT_CHARGING:
++ dev->battery_charge_status = value ?
++ POWER_SUPPLY_STATUS_CHARGING :
++ POWER_SUPPLY_STATUS_DISCHARGING;
++ return true;
++ }
++
++ return false;
++}
+ #else /* !CONFIG_HID_BATTERY_STRENGTH */
+ static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type,
+ struct hid_field *field, bool is_percentage)
+@@ -640,6 +655,12 @@ static void hidinput_cleanup_battery(struct hid_device *dev)
+ static void hidinput_update_battery(struct hid_device *dev, int value)
+ {
+ }
++
++static bool hidinput_set_battery_charge_status(struct hid_device *dev,
++ unsigned int usage, int value)
++{
++ return false;
++}
+ #endif /* CONFIG_HID_BATTERY_STRENGTH */
+
+ static bool hidinput_field_in_collection(struct hid_device *device, struct hid_field *field,
+@@ -1234,6 +1255,9 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ hidinput_setup_battery(device, HID_INPUT_REPORT, field, true);
+ usage->type = EV_PWR;
+ return;
++ case HID_BAT_CHARGING:
++ usage->type = EV_PWR;
++ return;
+ }
+ goto unknown;
+
+@@ -1476,7 +1500,11 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
+ return;
+
+ if (usage->type == EV_PWR) {
+- hidinput_update_battery(hid, value);
++ bool handled = hidinput_set_battery_charge_status(hid, usage->hid, value);
++
++ if (!handled)
++ hidinput_update_battery(hid, value);
++
+ return;
+ }
+
+@@ -2332,3 +2360,7 @@ void hidinput_disconnect(struct hid_device *hid)
+ cancel_work_sync(&hid->led_work);
+ }
+ EXPORT_SYMBOL_GPL(hidinput_disconnect);
++
++#ifdef CONFIG_HID_KUNIT_TEST
++#include "hid-input-test.c"
++#endif
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 0a1ccc68e798a..70245a7695286 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -312,6 +312,7 @@ struct hid_item {
+ #define HID_DG_LATENCYMODE 0x000d0060
+
+ #define HID_BAT_ABSOLUTESTATEOFCHARGE 0x00850065
++#define HID_BAT_CHARGING 0x00850044
+
+ #define HID_VD_ASUS_CUSTOM_MEDIA_KEYS 0xff310076
+
+@@ -611,6 +612,7 @@ struct hid_device { /* device report descriptor */
+ __s32 battery_max;
+ __s32 battery_report_type;
+ __s32 battery_report_id;
++ __s32 battery_charge_status;
+ enum hid_battery_status battery_status;
+ bool battery_avoid_query;
+ ktime_t battery_ratelimit_time;
+--
+2.39.2
+
--- /dev/null
+From 868aafea6283b4c7dcae8e500297eefacb44e5ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 17:10:59 +0200
+Subject: HID: uclogic: Modular KUnit tests should not depend on KUNIT=y
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 49904a0ebf23b15aad288a10f5354e7cd8193121 ]
+
+While KUnit tests that cannot be built as a loadable module must depend
+on "KUNIT=y", this is not true for modular tests, where it adds an
+unnecessary limitation.
+
+Fix this by relaxing the dependency to "KUNIT".
+
+Fixes: 08809e482a1c44d9 ("HID: uclogic: KUnit best practices and naming conventions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: David Gow <davidgow@google.com>
+Reviewed-by: José Expósito <jose.exposito89@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 644b4913d4d85..9ad5e43d9961b 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -1262,7 +1262,7 @@ config HID_MCP2221
+
+ config HID_KUNIT_TEST
+ tristate "KUnit tests for HID" if !KUNIT_ALL_TESTS
+- depends on KUNIT=y
++ depends on KUNIT
+ depends on HID_BATTERY_STRENGTH
+ depends on HID_UCLOGIC
+ default KUNIT_ALL_TESTS
+--
+2.39.2
+
--- /dev/null
+From 5374ac061410d2e613a46d6fadc1ea8ab875afcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 May 2023 07:35:37 -0700
+Subject: hwmon: (f71882fg) prevent possible division by zero
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 0babf89c9cca7e074d6e59893e462e4886f481cc ]
+
+In the unlikely event that something goes wrong with the device and
+its registers, the fan_from_reg() function may return 0. This value
+will cause a division-by-zero error in the show_pwm() function.
+
+To prevent this, test the value of
+fan_from_reg(data->fan_full_speed[nr]) against 0 before performing
+the division. If the division-by-zero error is avoided, assign 0 to
+the val variable.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: df9ec2dae094 ("hwmon: (f71882fg) Reorder symbols to get rid of a few forward declarations")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Link: https://lore.kernel.org/r/20230510143537.145060-1-n.zhandarovich@fintech.ru
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/f71882fg.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
+index 70121482a6173..27207ec6f7feb 100644
+--- a/drivers/hwmon/f71882fg.c
++++ b/drivers/hwmon/f71882fg.c
+@@ -1096,8 +1096,11 @@ static ssize_t show_pwm(struct device *dev,
+ val = data->pwm[nr];
+ else {
+ /* RPM mode */
+- val = 255 * fan_from_reg(data->fan_target[nr])
+- / fan_from_reg(data->fan_full_speed[nr]);
++ if (fan_from_reg(data->fan_full_speed[nr]))
++ val = 255 * fan_from_reg(data->fan_target[nr])
++ / fan_from_reg(data->fan_full_speed[nr]);
++ else
++ val = 0;
+ }
+ mutex_unlock(&data->update_lock);
+ return sprintf(buf, "%d\n", val);
+--
+2.39.2
+
--- /dev/null
+From 58f3109fee2a1bf27ca1b400bd027c46b000ff4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 08:30:04 -0700
+Subject: hwmon: (gsc-hwmon) fix fan pwm temperature scaling
+
+From: Tim Harvey <tharvey@gateworks.com>
+
+[ Upstream commit a6d80df47ee2c69db99e4f2f8871aa4db154620b ]
+
+The GSC fan pwm temperature register is in centidegrees celcius but the
+Linux hwmon convention is to use milidegrees celcius. Fix the scaling.
+
+Fixes: 3bce5377ef66 ("hwmon: Add Gateworks System Controller support")
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Link: https://lore.kernel.org/r/20230606153004.1448086-1-tharvey@gateworks.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/gsc-hwmon.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/gsc-hwmon.c b/drivers/hwmon/gsc-hwmon.c
+index b60ec95b5edbf..74bfc21c2767b 100644
+--- a/drivers/hwmon/gsc-hwmon.c
++++ b/drivers/hwmon/gsc-hwmon.c
+@@ -82,8 +82,8 @@ static ssize_t pwm_auto_point_temp_store(struct device *dev,
+ if (kstrtol(buf, 10, &temp))
+ return -EINVAL;
+
+- temp = clamp_val(temp, 0, 10000);
+- temp = DIV_ROUND_CLOSEST(temp, 10);
++ temp = clamp_val(temp, 0, 100000);
++ temp = DIV_ROUND_CLOSEST(temp, 100);
+
+ regs[0] = temp & 0xff;
+ regs[1] = (temp >> 8) & 0xff;
+@@ -100,7 +100,7 @@ static ssize_t pwm_auto_point_pwm_show(struct device *dev,
+ {
+ struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+
+- return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10)) / 100);
++ return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10)));
+ }
+
+ static SENSOR_DEVICE_ATTR_RO(pwm1_auto_point1_pwm, pwm_auto_point_pwm, 0);
+--
+2.39.2
+
--- /dev/null
+From fd4f9e6b5fee1e7ece2d11fcab84689c53ebce66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 14:34:47 -0700
+Subject: hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on
+ ADM1272
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit b153a0bb4199566abd337119207f82b59a8cd1ca ]
+
+The PMON_CONFIG register on ADM1272 is a 16 bit register. Writing a 8 bit
+value into it clears the upper 8 bits of the register, resulting in
+unexpected side effects. Fix by writing the 16 bit register value.
+
+Also, it has been reported that temperature readings are sometimes widely
+inaccurate, to the point where readings may result in device shutdown due
+to errant overtemperature faults. Improve by enabling temperature sampling.
+
+While at it, move the common code for ADM1272 and ADM1278 into a separate
+function, and clarify in the error message that an attempt was made to
+enable both VOUT and temperature monitoring.
+
+Last but not least, return the error code reported by the underlying I2C
+controller and not -ENODEV if updating the PMON_CONFIG register fails.
+After all, this does not indicate that the chip is not present, but an
+error in the communication with the chip.
+
+Fixes: 4ff0ce227a1e ("hwmon: (pmbus/adm1275) Add support for ADM1272")
+Fixes: 9da9c2dc57b2 ("hwmon: (adm1275) enable adm1272 temperature reporting")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20230602213447.3557346-1-linux@roeck-us.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/adm1275.c | 52 +++++++++++++++++------------------
+ 1 file changed, 26 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c
+index 3b07bfb43e937..b8543c06d022a 100644
+--- a/drivers/hwmon/pmbus/adm1275.c
++++ b/drivers/hwmon/pmbus/adm1275.c
+@@ -37,10 +37,13 @@ enum chips { adm1075, adm1272, adm1275, adm1276, adm1278, adm1293, adm1294 };
+
+ #define ADM1272_IRANGE BIT(0)
+
++#define ADM1278_TSFILT BIT(15)
+ #define ADM1278_TEMP1_EN BIT(3)
+ #define ADM1278_VIN_EN BIT(2)
+ #define ADM1278_VOUT_EN BIT(1)
+
++#define ADM1278_PMON_DEFCONFIG (ADM1278_VOUT_EN | ADM1278_TEMP1_EN | ADM1278_TSFILT)
++
+ #define ADM1293_IRANGE_25 0
+ #define ADM1293_IRANGE_50 BIT(6)
+ #define ADM1293_IRANGE_100 BIT(7)
+@@ -462,6 +465,22 @@ static const struct i2c_device_id adm1275_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, adm1275_id);
+
++/* Enable VOUT & TEMP1 if not enabled (disabled by default) */
++static int adm1275_enable_vout_temp(struct i2c_client *client, int config)
++{
++ int ret;
++
++ if ((config & ADM1278_PMON_DEFCONFIG) != ADM1278_PMON_DEFCONFIG) {
++ config |= ADM1278_PMON_DEFCONFIG;
++ ret = i2c_smbus_write_word_data(client, ADM1275_PMON_CONFIG, config);
++ if (ret < 0) {
++ dev_err(&client->dev, "Failed to enable VOUT/TEMP1 monitoring\n");
++ return ret;
++ }
++ }
++ return 0;
++}
++
+ static int adm1275_probe(struct i2c_client *client)
+ {
+ s32 (*config_read_fn)(const struct i2c_client *client, u8 reg);
+@@ -615,19 +634,10 @@ static int adm1275_probe(struct i2c_client *client)
+ PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT |
+ PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP;
+
+- /* Enable VOUT & TEMP1 if not enabled (disabled by default) */
+- if ((config & (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) !=
+- (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) {
+- config |= ADM1278_VOUT_EN | ADM1278_TEMP1_EN;
+- ret = i2c_smbus_write_byte_data(client,
+- ADM1275_PMON_CONFIG,
+- config);
+- if (ret < 0) {
+- dev_err(&client->dev,
+- "Failed to enable VOUT monitoring\n");
+- return -ENODEV;
+- }
+- }
++ ret = adm1275_enable_vout_temp(client, config);
++ if (ret)
++ return ret;
++
+ if (config & ADM1278_VIN_EN)
+ info->func[0] |= PMBUS_HAVE_VIN;
+ break;
+@@ -684,19 +694,9 @@ static int adm1275_probe(struct i2c_client *client)
+ PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT |
+ PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP;
+
+- /* Enable VOUT & TEMP1 if not enabled (disabled by default) */
+- if ((config & (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) !=
+- (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) {
+- config |= ADM1278_VOUT_EN | ADM1278_TEMP1_EN;
+- ret = i2c_smbus_write_word_data(client,
+- ADM1275_PMON_CONFIG,
+- config);
+- if (ret < 0) {
+- dev_err(&client->dev,
+- "Failed to enable VOUT monitoring\n");
+- return -ENODEV;
+- }
+- }
++ ret = adm1275_enable_vout_temp(client, config);
++ if (ret)
++ return ret;
+
+ if (config & ADM1278_VIN_EN)
+ info->func[0] |= PMBUS_HAVE_VIN;
+--
+2.39.2
+
--- /dev/null
+From c3a3deb70c95672b339a6eb984f26b9c7f50f94c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jun 2023 09:58:13 +0100
+Subject: hwrng: st - keep clock enabled while hwrng is registered
+
+From: Martin Kaiser <martin@kaiser.cx>
+
+[ Upstream commit 501e197a02d4aef157f53ba3a0b9049c3e52fedc ]
+
+The st-rng driver uses devres to register itself with the hwrng core,
+the driver will be unregistered from hwrng when its device goes out of
+scope. This happens after the driver's remove function is called.
+
+However, st-rng's clock is disabled in the remove function. There's a
+short timeframe where st-rng is still registered with the hwrng core
+although its clock is disabled. I suppose the clock must be active to
+access the hardware and serve requests from the hwrng core.
+
+Switch to devm_clk_get_enabled and let devres disable the clock and
+unregister the hwrng. This avoids the race condition.
+
+Fixes: 3e75241be808 ("hwrng: drivers - Use device-managed registration API")
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/st-rng.c | 21 +--------------------
+ 1 file changed, 1 insertion(+), 20 deletions(-)
+
+diff --git a/drivers/char/hw_random/st-rng.c b/drivers/char/hw_random/st-rng.c
+index 15ba1e6fae4d2..6e9dfac9fc9f4 100644
+--- a/drivers/char/hw_random/st-rng.c
++++ b/drivers/char/hw_random/st-rng.c
+@@ -42,7 +42,6 @@
+
+ struct st_rng_data {
+ void __iomem *base;
+- struct clk *clk;
+ struct hwrng ops;
+ };
+
+@@ -85,26 +84,18 @@ static int st_rng_probe(struct platform_device *pdev)
+ if (IS_ERR(base))
+ return PTR_ERR(base);
+
+- clk = devm_clk_get(&pdev->dev, NULL);
++ clk = devm_clk_get_enabled(&pdev->dev, NULL);
+ if (IS_ERR(clk))
+ return PTR_ERR(clk);
+
+- ret = clk_prepare_enable(clk);
+- if (ret)
+- return ret;
+-
+ ddata->ops.priv = (unsigned long)ddata;
+ ddata->ops.read = st_rng_read;
+ ddata->ops.name = pdev->name;
+ ddata->base = base;
+- ddata->clk = clk;
+-
+- dev_set_drvdata(&pdev->dev, ddata);
+
+ ret = devm_hwrng_register(&pdev->dev, &ddata->ops);
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to register HW RNG\n");
+- clk_disable_unprepare(clk);
+ return ret;
+ }
+
+@@ -113,15 +104,6 @@ static int st_rng_probe(struct platform_device *pdev)
+ return 0;
+ }
+
+-static int st_rng_remove(struct platform_device *pdev)
+-{
+- struct st_rng_data *ddata = dev_get_drvdata(&pdev->dev);
+-
+- clk_disable_unprepare(ddata->clk);
+-
+- return 0;
+-}
+-
+ static const struct of_device_id st_rng_match[] __maybe_unused = {
+ { .compatible = "st,rng" },
+ {},
+@@ -134,7 +116,6 @@ static struct platform_driver st_rng_driver = {
+ .of_match_table = of_match_ptr(st_rng_match),
+ },
+ .probe = st_rng_probe,
+- .remove = st_rng_remove
+ };
+
+ module_platform_driver(st_rng_driver);
+--
+2.39.2
+
--- /dev/null
+From 16106545dfbd3ae926cd22decf516c6318304b5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 11:59:32 +0800
+Subject: hwrng: virtio - Fix race on data_avail and actual data
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit ac52578d6e8d300dd50f790f29a24169b1edd26c ]
+
+The virtio rng device kicks off a new entropy request whenever the
+data available reaches zero. When a new request occurs at the end
+of a read operation, that is, when the result of that request is
+only needed by the next reader, then there is a race between the
+writing of the new data and the next reader.
+
+This is because there is no synchronisation whatsoever between the
+writer and the reader.
+
+Fix this by writing data_avail with smp_store_release and reading
+it with smp_load_acquire when we first enter read. The subsequent
+reads are safe because they're either protected by the first load
+acquire, or by the completion mechanism.
+
+Also remove the redundant zeroing of data_idx in random_recv_done
+(data_idx must already be zero at this point) and data_avail in
+request_entropy (ditto).
+
+Reported-by: syzbot+726dc8c62c3536431ceb@syzkaller.appspotmail.com
+Fixes: f7f510ec1957 ("virtio: An entropy device, as suggested by hpa.")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/virtio-rng.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
+index a6f3a8a2aca6d..35304117338ab 100644
+--- a/drivers/char/hw_random/virtio-rng.c
++++ b/drivers/char/hw_random/virtio-rng.c
+@@ -4,6 +4,7 @@
+ * Copyright (C) 2007, 2008 Rusty Russell IBM Corporation
+ */
+
++#include <asm/barrier.h>
+ #include <linux/err.h>
+ #include <linux/hw_random.h>
+ #include <linux/scatterlist.h>
+@@ -37,13 +38,13 @@ struct virtrng_info {
+ static void random_recv_done(struct virtqueue *vq)
+ {
+ struct virtrng_info *vi = vq->vdev->priv;
++ unsigned int len;
+
+ /* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */
+- if (!virtqueue_get_buf(vi->vq, &vi->data_avail))
++ if (!virtqueue_get_buf(vi->vq, &len))
+ return;
+
+- vi->data_idx = 0;
+-
++ smp_store_release(&vi->data_avail, len);
+ complete(&vi->have_data);
+ }
+
+@@ -52,7 +53,6 @@ static void request_entropy(struct virtrng_info *vi)
+ struct scatterlist sg;
+
+ reinit_completion(&vi->have_data);
+- vi->data_avail = 0;
+ vi->data_idx = 0;
+
+ sg_init_one(&sg, vi->data, sizeof(vi->data));
+@@ -88,7 +88,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait)
+ read = 0;
+
+ /* copy available data */
+- if (vi->data_avail) {
++ if (smp_load_acquire(&vi->data_avail)) {
+ chunk = copy_data(vi, buf, size);
+ size -= chunk;
+ read += chunk;
+--
+2.39.2
+
--- /dev/null
+From e1817dc038a17b7a8eb9b102b44841d2715637ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 May 2023 12:32:16 -0400
+Subject: IB/hfi1: Fix wrong mmu_node used for user SDMA packet after
+ invalidate
+
+From: Brendan Cunningham <bcunningham@cornelisnetworks.com>
+
+[ Upstream commit c9358de193ecfb360c3ce75f27ce839ca0b0bc8c ]
+
+The hfi1 user SDMA pinned-page cache will leave a stale cache entry when
+the cache-entry's virtual address range is invalidated but that cache
+entry is in-use by an outstanding SDMA request.
+
+Subsequent user SDMA requests with buffers in or spanning the virtual
+address range of the stale cache entry will result in packets constructed
+from the wrong memory, the physical pages pointed to by the stale cache
+entry.
+
+To fix this, remove mmu_rb_node cache entries from the mmu_rb_handler
+cache independent of the cache entry's refcount. Add 'struct kref
+refcount' to struct mmu_rb_node and manage mmu_rb_node lifetime with
+kref_get() and kref_put().
+
+mmu_rb_node.refcount makes sdma_mmu_node.refcount redundant. Remove
+'atomic_t refcount' from struct sdma_mmu_node and change sdma_mmu_node
+code to use mmu_rb_node.refcount.
+
+Move the mmu_rb_handler destructor call after a
+wait-for-SDMA-request-completion call so mmu_rb_nodes that need
+mmu_rb_handler's workqueue to queue themselves up for destruction from an
+interrupt context may do so.
+
+Fixes: f48ad614c100 ("IB/hfi1: Move driver out of staging")
+Fixes: 00cbce5cbf88 ("IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests")
+Link: https://lore.kernel.org/r/168451393605.3700681.13493776139032178861.stgit@awfm-02.cornelisnetworks.com
+Reviewed-by: Dean Luick <dean.luick@cornelisnetworks.com>
+Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/ipoib_tx.c | 4 +-
+ drivers/infiniband/hw/hfi1/mmu_rb.c | 101 ++++++++++-------
+ drivers/infiniband/hw/hfi1/mmu_rb.h | 3 +
+ drivers/infiniband/hw/hfi1/sdma.c | 23 +++-
+ drivers/infiniband/hw/hfi1/sdma.h | 47 +++++---
+ drivers/infiniband/hw/hfi1/sdma_txreq.h | 2 +
+ drivers/infiniband/hw/hfi1/user_sdma.c | 137 ++++++++++--------------
+ drivers/infiniband/hw/hfi1/user_sdma.h | 1 -
+ drivers/infiniband/hw/hfi1/vnic_sdma.c | 4 +-
+ 9 files changed, 177 insertions(+), 145 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c
+index 8973a081d641e..e7d831330278d 100644
+--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c
++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c
+@@ -215,11 +215,11 @@ static int hfi1_ipoib_build_ulp_payload(struct ipoib_txreq *tx,
+ const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+
+ ret = sdma_txadd_page(dd,
+- NULL,
+ txreq,
+ skb_frag_page(frag),
+ frag->bv_offset,
+- skb_frag_size(frag));
++ skb_frag_size(frag),
++ NULL, NULL, NULL);
+ if (unlikely(ret))
+ break;
+ }
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
+index 71b9ac0188875..94f1701667301 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
+@@ -19,8 +19,7 @@ static int mmu_notifier_range_start(struct mmu_notifier *,
+ const struct mmu_notifier_range *);
+ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *,
+ unsigned long, unsigned long);
+-static void do_remove(struct mmu_rb_handler *handler,
+- struct list_head *del_list);
++static void release_immediate(struct kref *refcount);
+ static void handle_remove(struct work_struct *work);
+
+ static const struct mmu_notifier_ops mn_opts = {
+@@ -103,7 +102,11 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler)
+ }
+ spin_unlock_irqrestore(&handler->lock, flags);
+
+- do_remove(handler, &del_list);
++ while (!list_empty(&del_list)) {
++ rbnode = list_first_entry(&del_list, struct mmu_rb_node, list);
++ list_del(&rbnode->list);
++ kref_put(&rbnode->refcount, release_immediate);
++ }
+
+ /* Now the mm may be freed. */
+ mmdrop(handler->mn.mm);
+@@ -131,12 +134,6 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ }
+ __mmu_int_rb_insert(mnode, &handler->root);
+ list_add_tail(&mnode->list, &handler->lru_list);
+-
+- ret = handler->ops->insert(handler->ops_arg, mnode);
+- if (ret) {
+- __mmu_int_rb_remove(mnode, &handler->root);
+- list_del(&mnode->list); /* remove from LRU list */
+- }
+ mnode->handler = handler;
+ unlock:
+ spin_unlock_irqrestore(&handler->lock, flags);
+@@ -180,6 +177,48 @@ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler,
+ return node;
+ }
+
++/*
++ * Must NOT call while holding mnode->handler->lock.
++ * mnode->handler->ops->remove() may sleep and mnode->handler->lock is a
++ * spinlock.
++ */
++static void release_immediate(struct kref *refcount)
++{
++ struct mmu_rb_node *mnode =
++ container_of(refcount, struct mmu_rb_node, refcount);
++ mnode->handler->ops->remove(mnode->handler->ops_arg, mnode);
++}
++
++/* Caller must hold mnode->handler->lock */
++static void release_nolock(struct kref *refcount)
++{
++ struct mmu_rb_node *mnode =
++ container_of(refcount, struct mmu_rb_node, refcount);
++ list_move(&mnode->list, &mnode->handler->del_list);
++ queue_work(mnode->handler->wq, &mnode->handler->del_work);
++}
++
++/*
++ * struct mmu_rb_node->refcount kref_put() callback.
++ * Adds mmu_rb_node to mmu_rb_node->handler->del_list and queues
++ * handler->del_work on handler->wq.
++ * Does not remove mmu_rb_node from handler->lru_list or handler->rb_root.
++ * Acquires mmu_rb_node->handler->lock; do not call while already holding
++ * handler->lock.
++ */
++void hfi1_mmu_rb_release(struct kref *refcount)
++{
++ struct mmu_rb_node *mnode =
++ container_of(refcount, struct mmu_rb_node, refcount);
++ struct mmu_rb_handler *handler = mnode->handler;
++ unsigned long flags;
++
++ spin_lock_irqsave(&handler->lock, flags);
++ list_move(&mnode->list, &mnode->handler->del_list);
++ spin_unlock_irqrestore(&handler->lock, flags);
++ queue_work(handler->wq, &handler->del_work);
++}
++
+ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ {
+ struct mmu_rb_node *rbnode, *ptr;
+@@ -194,6 +233,10 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+
+ spin_lock_irqsave(&handler->lock, flags);
+ list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) {
++ /* refcount == 1 implies mmu_rb_handler has only rbnode ref */
++ if (kref_read(&rbnode->refcount) > 1)
++ continue;
++
+ if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg,
+ &stop)) {
+ __mmu_int_rb_remove(rbnode, &handler->root);
+@@ -206,7 +249,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ spin_unlock_irqrestore(&handler->lock, flags);
+
+ list_for_each_entry_safe(rbnode, ptr, &del_list, list) {
+- handler->ops->remove(handler->ops_arg, rbnode);
++ kref_put(&rbnode->refcount, release_immediate);
+ }
+ }
+
+@@ -218,7 +261,6 @@ static int mmu_notifier_range_start(struct mmu_notifier *mn,
+ struct rb_root_cached *root = &handler->root;
+ struct mmu_rb_node *node, *ptr = NULL;
+ unsigned long flags;
+- bool added = false;
+
+ spin_lock_irqsave(&handler->lock, flags);
+ for (node = __mmu_int_rb_iter_first(root, range->start, range->end-1);
+@@ -227,38 +269,16 @@ static int mmu_notifier_range_start(struct mmu_notifier *mn,
+ ptr = __mmu_int_rb_iter_next(node, range->start,
+ range->end - 1);
+ trace_hfi1_mmu_mem_invalidate(node->addr, node->len);
+- if (handler->ops->invalidate(handler->ops_arg, node)) {
+- __mmu_int_rb_remove(node, root);
+- /* move from LRU list to delete list */
+- list_move(&node->list, &handler->del_list);
+- added = true;
+- }
++ /* Remove from rb tree and lru_list. */
++ __mmu_int_rb_remove(node, root);
++ list_del_init(&node->list);
++ kref_put(&node->refcount, release_nolock);
+ }
+ spin_unlock_irqrestore(&handler->lock, flags);
+
+- if (added)
+- queue_work(handler->wq, &handler->del_work);
+-
+ return 0;
+ }
+
+-/*
+- * Call the remove function for the given handler and the list. This
+- * is expected to be called with a delete list extracted from handler.
+- * The caller should not be holding the handler lock.
+- */
+-static void do_remove(struct mmu_rb_handler *handler,
+- struct list_head *del_list)
+-{
+- struct mmu_rb_node *node;
+-
+- while (!list_empty(del_list)) {
+- node = list_first_entry(del_list, struct mmu_rb_node, list);
+- list_del(&node->list);
+- handler->ops->remove(handler->ops_arg, node);
+- }
+-}
+-
+ /*
+ * Work queue function to remove all nodes that have been queued up to
+ * be removed. The key feature is that mm->mmap_lock is not being held
+@@ -271,11 +291,16 @@ static void handle_remove(struct work_struct *work)
+ del_work);
+ struct list_head del_list;
+ unsigned long flags;
++ struct mmu_rb_node *node;
+
+ /* remove anything that is queued to get removed */
+ spin_lock_irqsave(&handler->lock, flags);
+ list_replace_init(&handler->del_list, &del_list);
+ spin_unlock_irqrestore(&handler->lock, flags);
+
+- do_remove(handler, &del_list);
++ while (!list_empty(&del_list)) {
++ node = list_first_entry(&del_list, struct mmu_rb_node, list);
++ list_del(&node->list);
++ handler->ops->remove(handler->ops_arg, node);
++ }
+ }
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.h b/drivers/infiniband/hw/hfi1/mmu_rb.h
+index ed75acdb7b839..dd2c4a0ae95b1 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.h
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.h
+@@ -16,6 +16,7 @@ struct mmu_rb_node {
+ struct rb_node node;
+ struct mmu_rb_handler *handler;
+ struct list_head list;
++ struct kref refcount;
+ };
+
+ /*
+@@ -51,6 +52,8 @@ int hfi1_mmu_rb_register(void *ops_arg,
+ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler);
+ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ struct mmu_rb_node *mnode);
++void hfi1_mmu_rb_release(struct kref *refcount);
++
+ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg);
+ struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler,
+ unsigned long addr,
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index bb2552dd29c1e..26c62162759ba 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -1593,7 +1593,20 @@ static inline void sdma_unmap_desc(
+ struct hfi1_devdata *dd,
+ struct sdma_desc *descp)
+ {
+- system_descriptor_complete(dd, descp);
++ switch (sdma_mapping_type(descp)) {
++ case SDMA_MAP_SINGLE:
++ dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp),
++ sdma_mapping_len(descp), DMA_TO_DEVICE);
++ break;
++ case SDMA_MAP_PAGE:
++ dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp),
++ sdma_mapping_len(descp), DMA_TO_DEVICE);
++ break;
++ }
++
++ if (descp->pinning_ctx && descp->ctx_put)
++ descp->ctx_put(descp->pinning_ctx);
++ descp->pinning_ctx = NULL;
+ }
+
+ /*
+@@ -3113,8 +3126,8 @@ int ext_coal_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx,
+
+ /* Add descriptor for coalesce buffer */
+ tx->desc_limit = MAX_DESC;
+- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx,
+- addr, tx->tlen);
++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx,
++ addr, tx->tlen, NULL, NULL, NULL);
+ }
+
+ return 1;
+@@ -3157,9 +3170,9 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ make_tx_sdma_desc(
+ tx,
+ SDMA_MAP_NONE,
+- NULL,
+ dd->sdma_pad_phys,
+- sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1)));
++ sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1)),
++ NULL, NULL, NULL);
+ tx->num_desc++;
+ _sdma_close_tx(dd, tx);
+ return rval;
+diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h
+index 95aaec14c6c28..7fdebab202c4f 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.h
++++ b/drivers/infiniband/hw/hfi1/sdma.h
+@@ -594,9 +594,11 @@ static inline dma_addr_t sdma_mapping_addr(struct sdma_desc *d)
+ static inline void make_tx_sdma_desc(
+ struct sdma_txreq *tx,
+ int type,
+- void *pinning_ctx,
+ dma_addr_t addr,
+- size_t len)
++ size_t len,
++ void *pinning_ctx,
++ void (*ctx_get)(void *),
++ void (*ctx_put)(void *))
+ {
+ struct sdma_desc *desc = &tx->descp[tx->num_desc];
+
+@@ -613,7 +615,11 @@ static inline void make_tx_sdma_desc(
+ << SDMA_DESC0_PHY_ADDR_SHIFT) |
+ (((u64)len & SDMA_DESC0_BYTE_COUNT_MASK)
+ << SDMA_DESC0_BYTE_COUNT_SHIFT);
++
+ desc->pinning_ctx = pinning_ctx;
++ desc->ctx_put = ctx_put;
++ if (pinning_ctx && ctx_get)
++ ctx_get(pinning_ctx);
+ }
+
+ /* helper to extend txreq */
+@@ -645,18 +651,20 @@ static inline void _sdma_close_tx(struct hfi1_devdata *dd,
+ static inline int _sdma_txadd_daddr(
+ struct hfi1_devdata *dd,
+ int type,
+- void *pinning_ctx,
+ struct sdma_txreq *tx,
+ dma_addr_t addr,
+- u16 len)
++ u16 len,
++ void *pinning_ctx,
++ void (*ctx_get)(void *),
++ void (*ctx_put)(void *))
+ {
+ int rval = 0;
+
+ make_tx_sdma_desc(
+ tx,
+ type,
+- pinning_ctx,
+- addr, len);
++ addr, len,
++ pinning_ctx, ctx_get, ctx_put);
+ WARN_ON(len > tx->tlen);
+ tx->num_desc++;
+ tx->tlen -= len;
+@@ -676,11 +684,18 @@ static inline int _sdma_txadd_daddr(
+ /**
+ * sdma_txadd_page() - add a page to the sdma_txreq
+ * @dd: the device to use for mapping
+- * @pinning_ctx: context to be released at descriptor retirement
+ * @tx: tx request to which the page is added
+ * @page: page to map
+ * @offset: offset within the page
+ * @len: length in bytes
++ * @pinning_ctx: context to be stored on struct sdma_desc .pinning_ctx. Not
++ * added if coalesce buffer is used. E.g. pointer to pinned-page
++ * cache entry for the sdma_desc.
++ * @ctx_get: optional function to take reference to @pinning_ctx. Not called if
++ * @pinning_ctx is NULL.
++ * @ctx_put: optional function to release reference to @pinning_ctx after
++ * sdma_desc completes. May be called in interrupt context so must
++ * not sleep. Not called if @pinning_ctx is NULL.
+ *
+ * This is used to add a page/offset/length descriptor.
+ *
+@@ -692,11 +707,13 @@ static inline int _sdma_txadd_daddr(
+ */
+ static inline int sdma_txadd_page(
+ struct hfi1_devdata *dd,
+- void *pinning_ctx,
+ struct sdma_txreq *tx,
+ struct page *page,
+ unsigned long offset,
+- u16 len)
++ u16 len,
++ void *pinning_ctx,
++ void (*ctx_get)(void *),
++ void (*ctx_put)(void *))
+ {
+ dma_addr_t addr;
+ int rval;
+@@ -720,7 +737,8 @@ static inline int sdma_txadd_page(
+ return -ENOSPC;
+ }
+
+- return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, pinning_ctx, tx, addr, len);
++ return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, tx, addr, len,
++ pinning_ctx, ctx_get, ctx_put);
+ }
+
+ /**
+@@ -754,8 +772,8 @@ static inline int sdma_txadd_daddr(
+ return rval;
+ }
+
+- return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, NULL, tx,
+- addr, len);
++ return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, tx, addr, len,
++ NULL, NULL, NULL);
+ }
+
+ /**
+@@ -801,7 +819,8 @@ static inline int sdma_txadd_kvaddr(
+ return -ENOSPC;
+ }
+
+- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, addr, len);
++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx, addr, len,
++ NULL, NULL, NULL);
+ }
+
+ struct iowait_work;
+@@ -1034,6 +1053,4 @@ u16 sdma_get_descq_cnt(void);
+ extern uint mod_num_sdma;
+
+ void sdma_update_lmc(struct hfi1_devdata *dd, u64 mask, u32 lid);
+-
+-void system_descriptor_complete(struct hfi1_devdata *dd, struct sdma_desc *descp);
+ #endif
+diff --git a/drivers/infiniband/hw/hfi1/sdma_txreq.h b/drivers/infiniband/hw/hfi1/sdma_txreq.h
+index fad946cb5e0d8..85ae7293c2741 100644
+--- a/drivers/infiniband/hw/hfi1/sdma_txreq.h
++++ b/drivers/infiniband/hw/hfi1/sdma_txreq.h
+@@ -20,6 +20,8 @@ struct sdma_desc {
+ /* private: don't use directly */
+ u64 qw[2];
+ void *pinning_ctx;
++ /* Release reference to @pinning_ctx. May be called in interrupt context. Must not sleep. */
++ void (*ctx_put)(void *ctx);
+ };
+
+ /**
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index ae58b48afe074..02bd62b857b75 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -62,18 +62,14 @@ static int defer_packet_queue(
+ static void activate_packet_queue(struct iowait *wait, int reason);
+ static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr,
+ unsigned long len);
+-static int sdma_rb_insert(void *arg, struct mmu_rb_node *mnode);
+ static int sdma_rb_evict(void *arg, struct mmu_rb_node *mnode,
+ void *arg2, bool *stop);
+ static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode);
+-static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode);
+
+ static struct mmu_rb_ops sdma_rb_ops = {
+ .filter = sdma_rb_filter,
+- .insert = sdma_rb_insert,
+ .evict = sdma_rb_evict,
+ .remove = sdma_rb_remove,
+- .invalidate = sdma_rb_invalidate
+ };
+
+ static int add_system_pages_to_sdma_packet(struct user_sdma_request *req,
+@@ -247,14 +243,14 @@ int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd,
+ spin_unlock(&fd->pq_rcu_lock);
+ synchronize_srcu(&fd->pq_srcu);
+ /* at this point there can be no more new requests */
+- if (pq->handler)
+- hfi1_mmu_rb_unregister(pq->handler);
+ iowait_sdma_drain(&pq->busy);
+ /* Wait until all requests have been freed. */
+ wait_event_interruptible(
+ pq->wait,
+ !atomic_read(&pq->n_reqs));
+ kfree(pq->reqs);
++ if (pq->handler)
++ hfi1_mmu_rb_unregister(pq->handler);
+ bitmap_free(pq->req_in_use);
+ kmem_cache_destroy(pq->txreq_cache);
+ flush_pq_iowait(pq);
+@@ -1275,25 +1271,17 @@ static void free_system_node(struct sdma_mmu_node *node)
+ kfree(node);
+ }
+
+-static inline void acquire_node(struct sdma_mmu_node *node)
+-{
+- atomic_inc(&node->refcount);
+- WARN_ON(atomic_read(&node->refcount) < 0);
+-}
+-
+-static inline void release_node(struct mmu_rb_handler *handler,
+- struct sdma_mmu_node *node)
+-{
+- atomic_dec(&node->refcount);
+- WARN_ON(atomic_read(&node->refcount) < 0);
+-}
+-
++/*
++ * kref_get()'s an additional kref on the returned rb_node to prevent rb_node
++ * from being released until after rb_node is assigned to an SDMA descriptor
++ * (struct sdma_desc) under add_system_iovec_to_sdma_packet(), even if the
++ * virtual address range for rb_node is invalidated between now and then.
++ */
+ static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler,
+ unsigned long start,
+ unsigned long end)
+ {
+ struct mmu_rb_node *rb_node;
+- struct sdma_mmu_node *node;
+ unsigned long flags;
+
+ spin_lock_irqsave(&handler->lock, flags);
+@@ -1302,11 +1290,12 @@ static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler,
+ spin_unlock_irqrestore(&handler->lock, flags);
+ return NULL;
+ }
+- node = container_of(rb_node, struct sdma_mmu_node, rb);
+- acquire_node(node);
++
++ /* "safety" kref to prevent release before add_system_iovec_to_sdma_packet() */
++ kref_get(&rb_node->refcount);
+ spin_unlock_irqrestore(&handler->lock, flags);
+
+- return node;
++ return container_of(rb_node, struct sdma_mmu_node, rb);
+ }
+
+ static int pin_system_pages(struct user_sdma_request *req,
+@@ -1355,6 +1344,13 @@ static int pin_system_pages(struct user_sdma_request *req,
+ return 0;
+ }
+
++/*
++ * kref refcount on *node_p will be 2 on successful addition: one kref from
++ * kref_init() for mmu_rb_handler and one kref to prevent *node_p from being
++ * released until after *node_p is assigned to an SDMA descriptor (struct
++ * sdma_desc) under add_system_iovec_to_sdma_packet(), even if the virtual
++ * address range for *node_p is invalidated between now and then.
++ */
+ static int add_system_pinning(struct user_sdma_request *req,
+ struct sdma_mmu_node **node_p,
+ unsigned long start, unsigned long len)
+@@ -1368,6 +1364,12 @@ static int add_system_pinning(struct user_sdma_request *req,
+ if (!node)
+ return -ENOMEM;
+
++ /* First kref "moves" to mmu_rb_handler */
++ kref_init(&node->rb.refcount);
++
++ /* "safety" kref to prevent release before add_system_iovec_to_sdma_packet() */
++ kref_get(&node->rb.refcount);
++
+ node->pq = pq;
+ ret = pin_system_pages(req, start, len, node, PFN_DOWN(len));
+ if (ret == 0) {
+@@ -1431,15 +1433,15 @@ static int get_system_cache_entry(struct user_sdma_request *req,
+ return 0;
+ }
+
+- SDMA_DBG(req, "prepend: node->rb.addr %lx, node->refcount %d",
+- node->rb.addr, atomic_read(&node->refcount));
++ SDMA_DBG(req, "prepend: node->rb.addr %lx, node->rb.refcount %d",
++ node->rb.addr, kref_read(&node->rb.refcount));
+ prepend_len = node->rb.addr - start;
+
+ /*
+ * This node will not be returned, instead a new node
+ * will be. So release the reference.
+ */
+- release_node(handler, node);
++ kref_put(&node->rb.refcount, hfi1_mmu_rb_release);
+
+ /* Prepend a node to cover the beginning of the allocation */
+ ret = add_system_pinning(req, node_p, start, prepend_len);
+@@ -1451,6 +1453,20 @@ static int get_system_cache_entry(struct user_sdma_request *req,
+ }
+ }
+
++static void sdma_mmu_rb_node_get(void *ctx)
++{
++ struct mmu_rb_node *node = ctx;
++
++ kref_get(&node->refcount);
++}
++
++static void sdma_mmu_rb_node_put(void *ctx)
++{
++ struct sdma_mmu_node *node = ctx;
++
++ kref_put(&node->rb.refcount, hfi1_mmu_rb_release);
++}
++
+ static int add_mapping_to_sdma_packet(struct user_sdma_request *req,
+ struct user_sdma_txreq *tx,
+ struct sdma_mmu_node *cache_entry,
+@@ -1494,9 +1510,12 @@ static int add_mapping_to_sdma_packet(struct user_sdma_request *req,
+ ctx = cache_entry;
+ }
+
+- ret = sdma_txadd_page(pq->dd, ctx, &tx->txreq,
++ ret = sdma_txadd_page(pq->dd, &tx->txreq,
+ cache_entry->pages[page_index],
+- page_offset, from_this_page);
++ page_offset, from_this_page,
++ ctx,
++ sdma_mmu_rb_node_get,
++ sdma_mmu_rb_node_put);
+ if (ret) {
+ /*
+ * When there's a failure, the entire request is freed by
+@@ -1518,8 +1537,6 @@ static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req,
+ struct user_sdma_iovec *iovec,
+ size_t from_this_iovec)
+ {
+- struct mmu_rb_handler *handler = req->pq->handler;
+-
+ while (from_this_iovec > 0) {
+ struct sdma_mmu_node *cache_entry;
+ size_t from_this_cache_entry;
+@@ -1540,15 +1557,15 @@ static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req,
+
+ ret = add_mapping_to_sdma_packet(req, tx, cache_entry, start,
+ from_this_cache_entry);
++
++ /*
++ * Done adding cache_entry to zero or more sdma_desc. Can
++ * kref_put() the "safety" kref taken under
++ * get_system_cache_entry().
++ */
++ kref_put(&cache_entry->rb.refcount, hfi1_mmu_rb_release);
++
+ if (ret) {
+- /*
+- * We're guaranteed that there will be no descriptor
+- * completion callback that releases this node
+- * because only the last descriptor referencing it
+- * has a context attached, and a failure means the
+- * last descriptor was never added.
+- */
+- release_node(handler, cache_entry);
+ SDMA_DBG(req, "add system segment failed %d", ret);
+ return ret;
+ }
+@@ -1599,42 +1616,12 @@ static int add_system_pages_to_sdma_packet(struct user_sdma_request *req,
+ return 0;
+ }
+
+-void system_descriptor_complete(struct hfi1_devdata *dd,
+- struct sdma_desc *descp)
+-{
+- switch (sdma_mapping_type(descp)) {
+- case SDMA_MAP_SINGLE:
+- dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp),
+- sdma_mapping_len(descp), DMA_TO_DEVICE);
+- break;
+- case SDMA_MAP_PAGE:
+- dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp),
+- sdma_mapping_len(descp), DMA_TO_DEVICE);
+- break;
+- }
+-
+- if (descp->pinning_ctx) {
+- struct sdma_mmu_node *node = descp->pinning_ctx;
+-
+- release_node(node->rb.handler, node);
+- }
+-}
+-
+ static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr,
+ unsigned long len)
+ {
+ return (bool)(node->addr == addr);
+ }
+
+-static int sdma_rb_insert(void *arg, struct mmu_rb_node *mnode)
+-{
+- struct sdma_mmu_node *node =
+- container_of(mnode, struct sdma_mmu_node, rb);
+-
+- atomic_inc(&node->refcount);
+- return 0;
+-}
+-
+ /*
+ * Return 1 to remove the node from the rb tree and call the remove op.
+ *
+@@ -1647,10 +1634,6 @@ static int sdma_rb_evict(void *arg, struct mmu_rb_node *mnode,
+ container_of(mnode, struct sdma_mmu_node, rb);
+ struct evict_data *evict_data = evict_arg;
+
+- /* is this node still being used? */
+- if (atomic_read(&node->refcount))
+- return 0; /* keep this node */
+-
+ /* this node will be evicted, add its pages to our count */
+ evict_data->cleared += node->npages;
+
+@@ -1668,13 +1651,3 @@ static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode)
+
+ free_system_node(node);
+ }
+-
+-static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode)
+-{
+- struct sdma_mmu_node *node =
+- container_of(mnode, struct sdma_mmu_node, rb);
+-
+- if (!atomic_read(&node->refcount))
+- return 1;
+- return 0;
+-}
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h
+index a241836371dc1..548347d4c5bc2 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.h
++++ b/drivers/infiniband/hw/hfi1/user_sdma.h
+@@ -104,7 +104,6 @@ struct hfi1_user_sdma_comp_q {
+ struct sdma_mmu_node {
+ struct mmu_rb_node rb;
+ struct hfi1_user_sdma_pkt_q *pq;
+- atomic_t refcount;
+ struct page **pages;
+ unsigned int npages;
+ };
+diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+index 727eedfba332a..cc6324d2d1ddc 100644
+--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c
++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+@@ -64,11 +64,11 @@ static noinline int build_vnic_ulp_payload(struct sdma_engine *sde,
+
+ /* combine physically continuous fragments later? */
+ ret = sdma_txadd_page(sde->dd,
+- NULL,
+ &tx->txreq,
+ skb_frag_page(frag),
+ skb_frag_off(frag),
+- skb_frag_size(frag));
++ skb_frag_size(frag),
++ NULL, NULL, NULL);
+ if (unlikely(ret))
+ goto bail_txadd;
+ }
+--
+2.39.2
+
--- /dev/null
+From 2e648b3c5eaac8ec785c52f755f686314043da6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 14:15:03 -0700
+Subject: ice: handle extts in the miscellaneous interrupt thread
+
+From: Karol Kolacinski <karol.kolacinski@intel.com>
+
+[ Upstream commit 6e8b2c88fc8cf95ed09de25946b20b7536c88cd5 ]
+
+The ice_ptp_extts_work() and ice_ptp_periodic_work() functions are both
+scheduled on the same kthread worker, pf.ptp.kworker. The
+ice_ptp_periodic_work() function sends to the firmware to interact with the
+PHY, and must block to wait for responses.
+
+This can cause delay in responding to the PFINT_OICR_TSYN_EVNT interrupt
+cause, ultimately resulting in disruption to processing an input signal of
+the frequency is high enough. In our testing, even 100 Hz signals get
+disrupted.
+
+Fix this by instead processing the signal inside the miscellaneous
+interrupt thread prior to handling Tx timestamps.
+
+Use atomic bits in a new pf->misc_thread bitmap in order to safely
+communicate which tasks require processing within the
+ice_misc_intr_thread_fn(). This ensures the communication of desired tasks
+from the ice_misc_intr() are correctly processed without racing even in the
+event that the interrupt triggers again before the thread function exits.
+
+Fixes: 172db5f91d5f ("ice: add support for auxiliary input/output pins")
+Signed-off-by: Karol Kolacinski <karol.kolacinski@intel.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice.h | 7 ++++++
+ drivers/net/ethernet/intel/ice/ice_main.c | 29 ++++++++++++++++-------
+ drivers/net/ethernet/intel/ice/ice_ptp.c | 12 +++-------
+ drivers/net/ethernet/intel/ice/ice_ptp.h | 4 ++--
+ 4 files changed, 33 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
+index ca6b877fdde81..f2be383d97df5 100644
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -491,6 +491,12 @@ enum ice_pf_flags {
+ ICE_PF_FLAGS_NBITS /* must be last */
+ };
+
++enum ice_misc_thread_tasks {
++ ICE_MISC_THREAD_EXTTS_EVENT,
++ ICE_MISC_THREAD_TX_TSTAMP,
++ ICE_MISC_THREAD_NBITS /* must be last */
++};
++
+ struct ice_switchdev_info {
+ struct ice_vsi *control_vsi;
+ struct ice_vsi *uplink_vsi;
+@@ -532,6 +538,7 @@ struct ice_pf {
+ DECLARE_BITMAP(features, ICE_F_MAX);
+ DECLARE_BITMAP(state, ICE_STATE_NBITS);
+ DECLARE_BITMAP(flags, ICE_PF_FLAGS_NBITS);
++ DECLARE_BITMAP(misc_thread, ICE_MISC_THREAD_NBITS);
+ unsigned long *avail_txqs; /* bitmap to track PF Tx queue usage */
+ unsigned long *avail_rxqs; /* bitmap to track PF Rx queue usage */
+ unsigned long serv_tmr_period;
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 4095fe40dfc9b..7a5ec3ce3407a 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -3116,20 +3116,28 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data)
+
+ if (oicr & PFINT_OICR_TSYN_TX_M) {
+ ena_mask &= ~PFINT_OICR_TSYN_TX_M;
+- if (!hw->reset_ongoing)
++ if (!hw->reset_ongoing) {
++ set_bit(ICE_MISC_THREAD_TX_TSTAMP, pf->misc_thread);
+ ret = IRQ_WAKE_THREAD;
++ }
+ }
+
+ if (oicr & PFINT_OICR_TSYN_EVNT_M) {
+ u8 tmr_idx = hw->func_caps.ts_func_info.tmr_index_owned;
+ u32 gltsyn_stat = rd32(hw, GLTSYN_STAT(tmr_idx));
+
+- /* Save EVENTs from GTSYN register */
+- pf->ptp.ext_ts_irq |= gltsyn_stat & (GLTSYN_STAT_EVENT0_M |
+- GLTSYN_STAT_EVENT1_M |
+- GLTSYN_STAT_EVENT2_M);
+ ena_mask &= ~PFINT_OICR_TSYN_EVNT_M;
+- kthread_queue_work(pf->ptp.kworker, &pf->ptp.extts_work);
++
++ if (hw->func_caps.ts_func_info.src_tmr_owned) {
++ /* Save EVENTs from GLTSYN register */
++ pf->ptp.ext_ts_irq |= gltsyn_stat &
++ (GLTSYN_STAT_EVENT0_M |
++ GLTSYN_STAT_EVENT1_M |
++ GLTSYN_STAT_EVENT2_M);
++
++ set_bit(ICE_MISC_THREAD_EXTTS_EVENT, pf->misc_thread);
++ ret = IRQ_WAKE_THREAD;
++ }
+ }
+
+ #define ICE_AUX_CRIT_ERR (PFINT_OICR_PE_CRITERR_M | PFINT_OICR_HMC_ERR_M | PFINT_OICR_PE_PUSH_M)
+@@ -3173,8 +3181,13 @@ static irqreturn_t ice_misc_intr_thread_fn(int __always_unused irq, void *data)
+ if (ice_is_reset_in_progress(pf->state))
+ return IRQ_HANDLED;
+
+- while (!ice_ptp_process_ts(pf))
+- usleep_range(50, 100);
++ if (test_and_clear_bit(ICE_MISC_THREAD_EXTTS_EVENT, pf->misc_thread))
++ ice_ptp_extts_event(pf);
++
++ if (test_and_clear_bit(ICE_MISC_THREAD_TX_TSTAMP, pf->misc_thread)) {
++ while (!ice_ptp_process_ts(pf))
++ usleep_range(50, 100);
++ }
+
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
+index a3585ede829bb..46b0063a5e128 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
+@@ -1478,15 +1478,11 @@ static int ice_ptp_adjfine(struct ptp_clock_info *info, long scaled_ppm)
+ }
+
+ /**
+- * ice_ptp_extts_work - Workqueue task function
+- * @work: external timestamp work structure
+- *
+- * Service for PTP external clock event
++ * ice_ptp_extts_event - Process PTP external clock event
++ * @pf: Board private structure
+ */
+-static void ice_ptp_extts_work(struct kthread_work *work)
++void ice_ptp_extts_event(struct ice_pf *pf)
+ {
+- struct ice_ptp *ptp = container_of(work, struct ice_ptp, extts_work);
+- struct ice_pf *pf = container_of(ptp, struct ice_pf, ptp);
+ struct ptp_clock_event event;
+ struct ice_hw *hw = &pf->hw;
+ u8 chan, tmr_idx;
+@@ -2512,7 +2508,6 @@ void ice_ptp_prepare_for_reset(struct ice_pf *pf)
+ ice_ptp_cfg_timestamp(pf, false);
+
+ kthread_cancel_delayed_work_sync(&ptp->work);
+- kthread_cancel_work_sync(&ptp->extts_work);
+
+ if (test_bit(ICE_PFR_REQ, pf->state))
+ return;
+@@ -2610,7 +2605,6 @@ static int ice_ptp_init_work(struct ice_pf *pf, struct ice_ptp *ptp)
+
+ /* Initialize work functions */
+ kthread_init_delayed_work(&ptp->work, ice_ptp_periodic_work);
+- kthread_init_work(&ptp->extts_work, ice_ptp_extts_work);
+
+ /* Allocate a kworker for handling work required for the ports
+ * connected to the PTP hardware clock.
+diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.h b/drivers/net/ethernet/intel/ice/ice_ptp.h
+index 028349295b719..e689c05bb001f 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ptp.h
++++ b/drivers/net/ethernet/intel/ice/ice_ptp.h
+@@ -159,7 +159,6 @@ struct ice_ptp_port {
+ * struct ice_ptp - data used for integrating with CONFIG_PTP_1588_CLOCK
+ * @port: data for the PHY port initialization procedure
+ * @work: delayed work function for periodic tasks
+- * @extts_work: work function for handling external Tx timestamps
+ * @cached_phc_time: a cached copy of the PHC time for timestamp extension
+ * @cached_phc_jiffies: jiffies when cached_phc_time was last updated
+ * @ext_ts_chan: the external timestamp channel in use
+@@ -180,7 +179,6 @@ struct ice_ptp_port {
+ struct ice_ptp {
+ struct ice_ptp_port port;
+ struct kthread_delayed_work work;
+- struct kthread_work extts_work;
+ u64 cached_phc_time;
+ unsigned long cached_phc_jiffies;
+ u8 ext_ts_chan;
+@@ -246,6 +244,7 @@ int ice_ptp_get_ts_config(struct ice_pf *pf, struct ifreq *ifr);
+ void ice_ptp_cfg_timestamp(struct ice_pf *pf, bool ena);
+ int ice_get_ptp_clock_index(struct ice_pf *pf);
+
++void ice_ptp_extts_event(struct ice_pf *pf);
+ s8 ice_ptp_request_ts(struct ice_ptp_tx *tx, struct sk_buff *skb);
+ bool ice_ptp_process_ts(struct ice_pf *pf);
+
+@@ -274,6 +273,7 @@ static inline int ice_get_ptp_clock_index(struct ice_pf *pf)
+ return -1;
+ }
+
++static inline void ice_ptp_extts_event(struct ice_pf *pf) { }
+ static inline s8
+ ice_ptp_request_ts(struct ice_ptp_tx *tx, struct sk_buff *skb)
+ {
+--
+2.39.2
+
--- /dev/null
+From 151afd10f10c67925ea11e99be0e6163b7d84e1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 15:30:42 +0200
+Subject: igc: Enable and fix RX hash usage by netstack
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 84214ab4689f962b4bfc47fc9a5838d25ac4274d ]
+
+When function igc_rx_hash() was introduced in v4.20 via commit 0507ef8a0372
+("igc: Add transmit and receive fastpath and interrupt handlers"), the
+hardware wasn't configured to provide RSS hash, thus it made sense to not
+enable net_device NETIF_F_RXHASH feature bit.
+
+The NIC hardware was configured to enable RSS hash info in v5.2 via commit
+2121c2712f82 ("igc: Add multiple receive queues control supporting"), but
+forgot to set the NETIF_F_RXHASH feature bit.
+
+The original implementation of igc_rx_hash() didn't extract the associated
+pkt_hash_type, but statically set PKT_HASH_TYPE_L3. The largest portions of
+this patch are about extracting the RSS Type from the hardware and mapping
+this to enum pkt_hash_types. This was based on Foxville i225 software user
+manual rev-1.3.1 and tested on Intel Ethernet Controller I225-LM (rev 03).
+
+For UDP it's worth noting that RSS (type) hashing have been disabled both for
+IPv4 and IPv6 (see IGC_MRQC_RSS_FIELD_IPV4_UDP + IGC_MRQC_RSS_FIELD_IPV6_UDP)
+because hardware RSS doesn't handle fragmented pkts well when enabled (can
+cause out-of-order). This results in PKT_HASH_TYPE_L3 for UDP packets, and
+hash value doesn't include UDP port numbers. Not being PKT_HASH_TYPE_L4, have
+the effect that netstack will do a software based hash calc calling into
+flow_dissect, but only when code calls skb_get_hash(), which doesn't
+necessary happen for local delivery.
+
+For QA verification testing I wrote a small bpftrace prog:
+ [0] https://github.com/xdp-project/xdp-project/blob/master/areas/hints/monitor_skb_hash_on_dev.bt
+
+Fixes: 2121c2712f82 ("igc: Add multiple receive queues control supporting")
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Song Yoong Siang <yoong.siang.song@intel.com>
+Link: https://lore.kernel.org/bpf/168182464270.616355.11391652654430626584.stgit@firesoul
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc.h | 28 ++++++++++++++++++++
+ drivers/net/ethernet/intel/igc/igc_main.c | 31 ++++++++++++++++++++---
+ 2 files changed, 55 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h
+index df3e26c0cf01a..f83cbc4a1afa8 100644
+--- a/drivers/net/ethernet/intel/igc/igc.h
++++ b/drivers/net/ethernet/intel/igc/igc.h
+@@ -13,6 +13,7 @@
+ #include <linux/ptp_clock_kernel.h>
+ #include <linux/timecounter.h>
+ #include <linux/net_tstamp.h>
++#include <linux/bitfield.h>
+
+ #include "igc_hw.h"
+
+@@ -311,6 +312,33 @@ extern char igc_driver_name[];
+ #define IGC_MRQC_RSS_FIELD_IPV4_UDP 0x00400000
+ #define IGC_MRQC_RSS_FIELD_IPV6_UDP 0x00800000
+
++/* RX-desc Write-Back format RSS Type's */
++enum igc_rss_type_num {
++ IGC_RSS_TYPE_NO_HASH = 0,
++ IGC_RSS_TYPE_HASH_TCP_IPV4 = 1,
++ IGC_RSS_TYPE_HASH_IPV4 = 2,
++ IGC_RSS_TYPE_HASH_TCP_IPV6 = 3,
++ IGC_RSS_TYPE_HASH_IPV6_EX = 4,
++ IGC_RSS_TYPE_HASH_IPV6 = 5,
++ IGC_RSS_TYPE_HASH_TCP_IPV6_EX = 6,
++ IGC_RSS_TYPE_HASH_UDP_IPV4 = 7,
++ IGC_RSS_TYPE_HASH_UDP_IPV6 = 8,
++ IGC_RSS_TYPE_HASH_UDP_IPV6_EX = 9,
++ IGC_RSS_TYPE_MAX = 10,
++};
++#define IGC_RSS_TYPE_MAX_TABLE 16
++#define IGC_RSS_TYPE_MASK GENMASK(3,0) /* 4-bits (3:0) = mask 0x0F */
++
++/* igc_rss_type - Rx descriptor RSS type field */
++static inline u32 igc_rss_type(const union igc_adv_rx_desc *rx_desc)
++{
++ /* RSS Type 4-bits (3:0) number: 0-9 (above 9 is reserved)
++ * Accessing the same bits via u16 (wb.lower.lo_dword.hs_rss.pkt_info)
++ * is slightly slower than via u32 (wb.lower.lo_dword.data)
++ */
++ return le32_get_bits(rx_desc->wb.lower.lo_dword.data, IGC_RSS_TYPE_MASK);
++}
++
+ /* Interrupt defines */
+ #define IGC_START_ITR 648 /* ~6000 ints/sec */
+ #define IGC_4K_ITR 980
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index 3509974c1f8e4..b67a6a81474f5 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -1684,14 +1684,36 @@ static void igc_rx_checksum(struct igc_ring *ring,
+ le32_to_cpu(rx_desc->wb.upper.status_error));
+ }
+
++/* Mapping HW RSS Type to enum pkt_hash_types */
++static const enum pkt_hash_types igc_rss_type_table[IGC_RSS_TYPE_MAX_TABLE] = {
++ [IGC_RSS_TYPE_NO_HASH] = PKT_HASH_TYPE_L2,
++ [IGC_RSS_TYPE_HASH_TCP_IPV4] = PKT_HASH_TYPE_L4,
++ [IGC_RSS_TYPE_HASH_IPV4] = PKT_HASH_TYPE_L3,
++ [IGC_RSS_TYPE_HASH_TCP_IPV6] = PKT_HASH_TYPE_L4,
++ [IGC_RSS_TYPE_HASH_IPV6_EX] = PKT_HASH_TYPE_L3,
++ [IGC_RSS_TYPE_HASH_IPV6] = PKT_HASH_TYPE_L3,
++ [IGC_RSS_TYPE_HASH_TCP_IPV6_EX] = PKT_HASH_TYPE_L4,
++ [IGC_RSS_TYPE_HASH_UDP_IPV4] = PKT_HASH_TYPE_L4,
++ [IGC_RSS_TYPE_HASH_UDP_IPV6] = PKT_HASH_TYPE_L4,
++ [IGC_RSS_TYPE_HASH_UDP_IPV6_EX] = PKT_HASH_TYPE_L4,
++ [10] = PKT_HASH_TYPE_NONE, /* RSS Type above 9 "Reserved" by HW */
++ [11] = PKT_HASH_TYPE_NONE, /* keep array sized for SW bit-mask */
++ [12] = PKT_HASH_TYPE_NONE, /* to handle future HW revisons */
++ [13] = PKT_HASH_TYPE_NONE,
++ [14] = PKT_HASH_TYPE_NONE,
++ [15] = PKT_HASH_TYPE_NONE,
++};
++
+ static inline void igc_rx_hash(struct igc_ring *ring,
+ union igc_adv_rx_desc *rx_desc,
+ struct sk_buff *skb)
+ {
+- if (ring->netdev->features & NETIF_F_RXHASH)
+- skb_set_hash(skb,
+- le32_to_cpu(rx_desc->wb.lower.hi_dword.rss),
+- PKT_HASH_TYPE_L3);
++ if (ring->netdev->features & NETIF_F_RXHASH) {
++ u32 rss_hash = le32_to_cpu(rx_desc->wb.lower.hi_dword.rss);
++ u32 rss_type = igc_rss_type(rx_desc);
++
++ skb_set_hash(skb, rss_hash, igc_rss_type_table[rss_type]);
++ }
+ }
+
+ static void igc_rx_vlan(struct igc_ring *rx_ring,
+@@ -6518,6 +6540,7 @@ static int igc_probe(struct pci_dev *pdev,
+ netdev->features |= NETIF_F_TSO;
+ netdev->features |= NETIF_F_TSO6;
+ netdev->features |= NETIF_F_TSO_ECN;
++ netdev->features |= NETIF_F_RXHASH;
+ netdev->features |= NETIF_F_RXCSUM;
+ netdev->features |= NETIF_F_HW_CSUM;
+ netdev->features |= NETIF_F_SCTP_CRC;
+--
+2.39.2
+
--- /dev/null
+From 95759714c192baab77208ff91c4176ac1695ec2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 09:41:13 +0200
+Subject: ima: Fix build warnings
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+[ Upstream commit 95526d13038c2bbddd567a4d8e39fac42484e182 ]
+
+Fix build warnings (function parameters description) for
+ima_collect_modsig(), ima_match_policy() and ima_parse_add_rule().
+
+Fixes: 15588227e086 ("ima: Collect modsig") # v5.4+
+Fixes: 2fe5d6def167 ("ima: integrity appraisal extension") # v5.14+
+Fixes: 4af4662fa4a9 ("integrity: IMA policy") # v3.2+
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_modsig.c | 3 +++
+ security/integrity/ima/ima_policy.c | 3 ++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/security/integrity/ima/ima_modsig.c b/security/integrity/ima/ima_modsig.c
+index fb25723c65bc4..3e7bee30080f2 100644
+--- a/security/integrity/ima/ima_modsig.c
++++ b/security/integrity/ima/ima_modsig.c
+@@ -89,6 +89,9 @@ int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len,
+
+ /**
+ * ima_collect_modsig - Calculate the file hash without the appended signature.
++ * @modsig: parsed module signature
++ * @buf: data to verify the signature on
++ * @size: data size
+ *
+ * Since the modsig is part of the file contents, the hash used in its signature
+ * isn't the same one ordinarily calculated by IMA. Therefore PKCS7 code
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 2edff7f58c25c..bdc40535ff489 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -694,6 +694,7 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
+ * @secid: LSM secid of the task to be validated
+ * @func: IMA hook identifier
+ * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
++ * @flags: IMA actions to consider (e.g. IMA_MEASURE | IMA_APPRAISE)
+ * @pcr: set the pcr to extend
+ * @template_desc: the template that should be used for this rule
+ * @func_data: func specific data, may be NULL
+@@ -1885,7 +1886,7 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
+
+ /**
+ * ima_parse_add_rule - add a rule to ima_policy_rules
+- * @rule - ima measurement policy rule
++ * @rule: ima measurement policy rule
+ *
+ * Avoid locking by allowing just one writer at a time in ima_write_policy()
+ * Returns the length of the rule parsed, an error code on failure
+--
+2.39.2
+
--- /dev/null
+From 38369b834255c2d2ba20012aaac833703ee2c6b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 May 2023 17:27:55 -0700
+Subject: Input: adxl34x - do not hardcode interrupt trigger type
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit e96220bce5176ed2309f77f061dcc0430b82b25e ]
+
+Instead of hardcoding IRQ trigger type to IRQF_TRIGGER_HIGH, let's
+respect the settings specified in the firmware description.
+
+Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Acked-by: Michael Hennerich <michael.hennerich@analog.com>
+Link: https://lore.kernel.org/r/20230509203555.549158-1-marex@denx.de
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/adxl34x.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
+index a4af314392a9f..69e359ff51805 100644
+--- a/drivers/input/misc/adxl34x.c
++++ b/drivers/input/misc/adxl34x.c
+@@ -811,8 +811,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
+ AC_WRITE(ac, POWER_CTL, 0);
+
+ err = request_threaded_irq(ac->irq, NULL, adxl34x_irq,
+- IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+- dev_name(dev), ac);
++ IRQF_ONESHOT, dev_name(dev), ac);
+ if (err) {
+ dev_err(dev, "irq %d busy?\n", ac->irq);
+ goto err_free_mem;
+--
+2.39.2
+
--- /dev/null
+From 663c6dd6f6cc1ecff71862f12362f8402278f680 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 May 2023 17:01:45 -0700
+Subject: Input: drv260x - sleep between polling GO bit
+
+From: Luca Weiss <luca@z3ntu.xyz>
+
+[ Upstream commit efef661dfa6bf8cbafe4cd6a97433fcef0118967 ]
+
+When doing the initial startup there's no need to poll without any
+delay and spam the I2C bus.
+
+Let's sleep 15ms between each attempt, which is the same time as used
+in the vendor driver.
+
+Fixes: 7132fe4f5687 ("Input: drv260x - add TI drv260x haptics driver")
+Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
+Link: https://lore.kernel.org/r/20230430-drv260x-improvements-v1-2-1fb28b4cc698@z3ntu.xyz
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/drv260x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c
+index 0efe56f49aa94..1923924fdd444 100644
+--- a/drivers/input/misc/drv260x.c
++++ b/drivers/input/misc/drv260x.c
+@@ -435,6 +435,7 @@ static int drv260x_init(struct drv260x_data *haptics)
+ }
+
+ do {
++ usleep_range(15000, 15500);
+ error = regmap_read(haptics->regmap, DRV260X_GO, &cal_buf);
+ if (error) {
+ dev_err(&haptics->client->dev,
+--
+2.39.2
+
--- /dev/null
+From 9dfac3c63a6f224245645b0722e83dd7b7f07f25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 12:05:32 -0700
+Subject: Input: pm8941-powerkey - fix debounce on gen2+ PMICs
+
+From: Caleb Connolly <caleb.connolly@linaro.org>
+
+[ Upstream commit 8c9cce9cb81b5fdc6e66bf3f129727b89e8daab7 ]
+
+Since PM8998/PM660, the power key debounce register was redefined to
+support shorter debounce times. On PM8941 the shortest debounce time
+(represented by register value 0) was 15625us, on PM8998 the shortest
+debounce time is 62us, with the default being 2ms.
+
+Adjust the bit shift to correctly program debounce on PM8998 and newer.
+
+Fixes: 68c581d5e7d8 ("Input: add Qualcomm PM8941 power key driver")
+Signed-off-by: Caleb Connolly <caleb.connolly@linaro.org>
+Link: https://lore.kernel.org/r/20230529-pm8941-pwrkey-debounce-v1-2-c043a6d5c814@linaro.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/pm8941-pwrkey.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/input/misc/pm8941-pwrkey.c b/drivers/input/misc/pm8941-pwrkey.c
+index 549df01b6ee33..5dd68a02c4451 100644
+--- a/drivers/input/misc/pm8941-pwrkey.c
++++ b/drivers/input/misc/pm8941-pwrkey.c
+@@ -50,7 +50,10 @@
+ #define PON_RESIN_PULL_UP BIT(0)
+
+ #define PON_DBC_CTL 0x71
+-#define PON_DBC_DELAY_MASK 0x7
++#define PON_DBC_DELAY_MASK_GEN1 0x7
++#define PON_DBC_DELAY_MASK_GEN2 0xf
++#define PON_DBC_SHIFT_GEN1 6
++#define PON_DBC_SHIFT_GEN2 14
+
+ struct pm8941_data {
+ unsigned int pull_up_bit;
+@@ -247,7 +250,7 @@ static int pm8941_pwrkey_probe(struct platform_device *pdev)
+ struct device *parent;
+ struct device_node *regmap_node;
+ const __be32 *addr;
+- u32 req_delay;
++ u32 req_delay, mask, delay_shift;
+ int error;
+
+ if (of_property_read_u32(pdev->dev.of_node, "debounce", &req_delay))
+@@ -336,12 +339,20 @@ static int pm8941_pwrkey_probe(struct platform_device *pdev)
+ pwrkey->input->phys = pwrkey->data->phys;
+
+ if (pwrkey->data->supports_debounce_config) {
+- req_delay = (req_delay << 6) / USEC_PER_SEC;
++ if (pwrkey->subtype >= PON_SUBTYPE_GEN2_PRIMARY) {
++ mask = PON_DBC_DELAY_MASK_GEN2;
++ delay_shift = PON_DBC_SHIFT_GEN2;
++ } else {
++ mask = PON_DBC_DELAY_MASK_GEN1;
++ delay_shift = PON_DBC_SHIFT_GEN1;
++ }
++
++ req_delay = (req_delay << delay_shift) / USEC_PER_SEC;
+ req_delay = ilog2(req_delay);
+
+ error = regmap_update_bits(pwrkey->regmap,
+ pwrkey->baseaddr + PON_DBC_CTL,
+- PON_DBC_DELAY_MASK,
++ mask,
+ req_delay);
+ if (error) {
+ dev_err(&pdev->dev, "failed to set debounce: %d\n",
+--
+2.39.2
+
--- /dev/null
+From a5bdd8e3708421e74a7b09cd107f0533796a6344 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 12:39:48 +0100
+Subject: iommu/virtio: Detach domain on endpoint release
+
+From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+
+[ Upstream commit 809d0810e3520da669d231303608cdf5fe5c1a70 ]
+
+When an endpoint is released, for example a PCIe VF being destroyed or a
+function hot-unplugged, it should be detached from its domain. Send a
+DETACH request.
+
+Fixes: edcd69ab9a32 ("iommu: Add virtio-iommu driver")
+Reported-by: Akihiko Odaki <akihiko.odaki@daynix.com>
+Link: https://lore.kernel.org/all/15bf1b00-3aa0-973a-3a86-3fa5c4d41d2c@daynix.com/
+Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Tested-by: Akihiko Odaki <akihiko.odaki@daynix.com>
+Link: https://lore.kernel.org/r/20230515113946.1017624-2-jean-philippe@linaro.org
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/virtio-iommu.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
+index 8b1b5c270e502..fe02ac772b651 100644
+--- a/drivers/iommu/virtio-iommu.c
++++ b/drivers/iommu/virtio-iommu.c
+@@ -789,6 +789,29 @@ static int viommu_attach_dev(struct iommu_domain *domain, struct device *dev)
+ return 0;
+ }
+
++static void viommu_detach_dev(struct viommu_endpoint *vdev)
++{
++ int i;
++ struct virtio_iommu_req_detach req;
++ struct viommu_domain *vdomain = vdev->vdomain;
++ struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(vdev->dev);
++
++ if (!vdomain)
++ return;
++
++ req = (struct virtio_iommu_req_detach) {
++ .head.type = VIRTIO_IOMMU_T_DETACH,
++ .domain = cpu_to_le32(vdomain->id),
++ };
++
++ for (i = 0; i < fwspec->num_ids; i++) {
++ req.endpoint = cpu_to_le32(fwspec->ids[i]);
++ WARN_ON(viommu_send_req_sync(vdev->viommu, &req, sizeof(req)));
++ }
++ vdomain->nr_endpoints--;
++ vdev->vdomain = NULL;
++}
++
+ static int viommu_map_pages(struct iommu_domain *domain, unsigned long iova,
+ phys_addr_t paddr, size_t pgsize, size_t pgcount,
+ int prot, gfp_t gfp, size_t *mapped)
+@@ -991,6 +1014,7 @@ static void viommu_release_device(struct device *dev)
+ {
+ struct viommu_endpoint *vdev = dev_iommu_priv_get(dev);
+
++ viommu_detach_dev(vdev);
+ iommu_put_resv_regions(dev, &vdev->resv_regions);
+ kfree(vdev);
+ }
+--
+2.39.2
+
--- /dev/null
+From 911c6aa4a7df241884963c0861be4866caac935f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 12:39:50 +0100
+Subject: iommu/virtio: Return size mapped for a detached domain
+
+From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+
+[ Upstream commit 7061b6af34686e7e2364b7240cfb061293218f2d ]
+
+When map() is called on a detached domain, the domain does not exist in
+the device so we do not send a MAP request, but we do update the
+internal mapping tree, to be replayed on the next attach. Since this
+constitutes a successful iommu_map() call, return *mapped in this case
+too.
+
+Fixes: 7e62edd7a33a ("iommu/virtio: Add map/unmap_pages() callbacks implementation")
+Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/r/20230515113946.1017624-3-jean-philippe@linaro.org
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/virtio-iommu.c | 33 +++++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
+index fe02ac772b651..fd86ccb709ec5 100644
+--- a/drivers/iommu/virtio-iommu.c
++++ b/drivers/iommu/virtio-iommu.c
+@@ -834,25 +834,26 @@ static int viommu_map_pages(struct iommu_domain *domain, unsigned long iova,
+ if (ret)
+ return ret;
+
+- map = (struct virtio_iommu_req_map) {
+- .head.type = VIRTIO_IOMMU_T_MAP,
+- .domain = cpu_to_le32(vdomain->id),
+- .virt_start = cpu_to_le64(iova),
+- .phys_start = cpu_to_le64(paddr),
+- .virt_end = cpu_to_le64(end),
+- .flags = cpu_to_le32(flags),
+- };
+-
+- if (!vdomain->nr_endpoints)
+- return 0;
++ if (vdomain->nr_endpoints) {
++ map = (struct virtio_iommu_req_map) {
++ .head.type = VIRTIO_IOMMU_T_MAP,
++ .domain = cpu_to_le32(vdomain->id),
++ .virt_start = cpu_to_le64(iova),
++ .phys_start = cpu_to_le64(paddr),
++ .virt_end = cpu_to_le64(end),
++ .flags = cpu_to_le32(flags),
++ };
+
+- ret = viommu_send_req_sync(vdomain->viommu, &map, sizeof(map));
+- if (ret)
+- viommu_del_mappings(vdomain, iova, end);
+- else if (mapped)
++ ret = viommu_send_req_sync(vdomain->viommu, &map, sizeof(map));
++ if (ret) {
++ viommu_del_mappings(vdomain, iova, end);
++ return ret;
++ }
++ }
++ if (mapped)
+ *mapped = size;
+
+- return ret;
++ return 0;
+ }
+
+ static size_t viommu_unmap_pages(struct iommu_domain *domain, unsigned long iova,
+--
+2.39.2
+
--- /dev/null
+From d0e3663ce1cde94a4c9c7a5b48a36cad6ca70c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jun 2023 17:33:47 +0800
+Subject: ipvlan: Fix return value of ipvlan_queue_xmit()
+
+From: Cambda Zhu <cambda@linux.alibaba.com>
+
+[ Upstream commit 8a9922e7be6d042fa00f894c376473b17a162b66 ]
+
+ipvlan_queue_xmit() should return NET_XMIT_XXX, but
+ipvlan_xmit_mode_l2/l3() returns rx_handler_result_t or NET_RX_XXX
+in some cases. ipvlan_rcv_frame() will only return RX_HANDLER_CONSUMED
+in ipvlan_xmit_mode_l2/l3() because 'local' is true. It's equal to
+NET_XMIT_SUCCESS. But dev_forward_skb() can return NET_RX_SUCCESS or
+NET_RX_DROP, and returning NET_RX_DROP(NET_XMIT_DROP) will increase
+both ipvlan and ipvlan->phy_dev drops counter.
+
+The skb to forward can be treated as xmitted successfully. This patch
+makes ipvlan_queue_xmit() return NET_XMIT_SUCCESS for forward skb.
+
+Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
+Signed-off-by: Cambda Zhu <cambda@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20230626093347.7492-1-cambda@linux.alibaba.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipvlan/ipvlan_core.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
+index 2de3bd3b0c278..59e29e08398a0 100644
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -585,7 +585,8 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
+ consume_skb(skb);
+ return NET_XMIT_DROP;
+ }
+- return ipvlan_rcv_frame(addr, &skb, true);
++ ipvlan_rcv_frame(addr, &skb, true);
++ return NET_XMIT_SUCCESS;
+ }
+ }
+ out:
+@@ -611,7 +612,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
+ consume_skb(skb);
+ return NET_XMIT_DROP;
+ }
+- return ipvlan_rcv_frame(addr, &skb, true);
++ ipvlan_rcv_frame(addr, &skb, true);
++ return NET_XMIT_SUCCESS;
+ }
+ }
+ skb = skb_share_check(skb, GFP_ATOMIC);
+@@ -623,7 +625,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
+ * the skb for the main-dev. At the RX side we just return
+ * RX_PASS for it to be processed further on the stack.
+ */
+- return dev_forward_skb(ipvlan->phy_dev, skb);
++ dev_forward_skb(ipvlan->phy_dev, skb);
++ return NET_XMIT_SUCCESS;
+
+ } else if (is_multicast_ether_addr(eth->h_dest)) {
+ skb_reset_mac_header(skb);
+--
+2.39.2
+
--- /dev/null
+From a63082d3f485e71655242aabf3f0be74c0bc503c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 May 2023 18:33:42 +0200
+Subject: irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
+
+From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+
+[ Upstream commit 4848229494a323eeaab62eee5574ef9f7de80374 ]
+
+The initialization function for the J-Core AIC aic_irq_of_init() is
+currently missing the call to irq_alloc_descs() which allocates and
+initializes all the IRQ descriptors. Add missing function call and
+return the error code from irq_alloc_descs() in case the allocation
+fails.
+
+Fixes: 981b58f66cfc ("irqchip/jcore-aic: Add J-Core AIC driver")
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Tested-by: Rob Landley <rob@landley.net>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20230510163343.43090-1-glaubitz@physik.fu-berlin.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-jcore-aic.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/irqchip/irq-jcore-aic.c b/drivers/irqchip/irq-jcore-aic.c
+index 5f47d8ee4ae39..b9dcc8e78c750 100644
+--- a/drivers/irqchip/irq-jcore-aic.c
++++ b/drivers/irqchip/irq-jcore-aic.c
+@@ -68,6 +68,7 @@ static int __init aic_irq_of_init(struct device_node *node,
+ unsigned min_irq = JCORE_AIC2_MIN_HWIRQ;
+ unsigned dom_sz = JCORE_AIC_MAX_HWIRQ+1;
+ struct irq_domain *domain;
++ int ret;
+
+ pr_info("Initializing J-Core AIC\n");
+
+@@ -100,6 +101,12 @@ static int __init aic_irq_of_init(struct device_node *node,
+ jcore_aic.irq_unmask = noop;
+ jcore_aic.name = "AIC";
+
++ ret = irq_alloc_descs(-1, min_irq, dom_sz - min_irq,
++ of_node_to_nid(node));
++
++ if (ret < 0)
++ return ret;
++
+ domain = irq_domain_add_legacy(node, dom_sz - min_irq, min_irq, min_irq,
+ &jcore_aic_irqdomain_ops,
+ &jcore_aic);
+--
+2.39.2
+
--- /dev/null
+From 7e840ee0f7d819afff062441e70afc7ac46236a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 17:56:14 +0200
+Subject: irqchip/stm32-exti: Fix warning on initialized field overwritten
+
+From: Antonio Borneo <antonio.borneo@foss.st.com>
+
+[ Upstream commit 48f31e496488a25f443c0df52464da446fb1d10c ]
+
+While compiling with W=1, both gcc and clang complain about a
+tricky way to initialize an array by filling it with a non-zero
+value and then overrride some of the array elements.
+In this case the override is intentional, so just disable the
+specific warning for only this part of the code.
+
+Note: the flag "-Woverride-init" is recognized by both compilers,
+but the warning msg from clang reports "-Winitializer-overrides".
+The doc of clang clarifies that the two flags are synonyms, so use
+here only the flag name common on both compilers.
+
+Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
+Fixes: c297493336b7 ("irqchip/stm32-exti: Simplify irq description table")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20230601155614.34490-1-antonio.borneo@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-stm32-exti.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
+index 6a3f7498ea8ea..8bbb2b114636c 100644
+--- a/drivers/irqchip/irq-stm32-exti.c
++++ b/drivers/irqchip/irq-stm32-exti.c
+@@ -173,6 +173,16 @@ static struct irq_chip stm32_exti_h_chip_direct;
+ #define EXTI_INVALID_IRQ U8_MAX
+ #define STM32MP1_DESC_IRQ_SIZE (ARRAY_SIZE(stm32mp1_exti_banks) * IRQS_PER_BANK)
+
++/*
++ * Use some intentionally tricky logic here to initialize the whole array to
++ * EXTI_INVALID_IRQ, but then override certain fields, requiring us to indicate
++ * that we "know" that there are overrides in this structure, and we'll need to
++ * disable that warning from W=1 builds.
++ */
++__diag_push();
++__diag_ignore_all("-Woverride-init",
++ "logic to initialize all and then override some is OK");
++
+ static const u8 stm32mp1_desc_irq[] = {
+ /* default value */
+ [0 ... (STM32MP1_DESC_IRQ_SIZE - 1)] = EXTI_INVALID_IRQ,
+@@ -266,6 +276,8 @@ static const u8 stm32mp13_desc_irq[] = {
+ [70] = 98,
+ };
+
++__diag_pop();
++
+ static const struct stm32_exti_drv_data stm32mp1_drv_data = {
+ .exti_banks = stm32mp1_exti_banks,
+ .bank_nr = ARRAY_SIZE(stm32mp1_exti_banks),
+--
+2.39.2
+
--- /dev/null
+From 2c19277d5c9ddf606b3b8610fcc9ca776686dafa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jun 2023 00:11:43 +0000
+Subject: kbuild: Disable GCOV for *.mod.o
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit 25a21fbb934a0d989e1858f83c2ddf4cfb2ebe30 ]
+
+With GCOV_PROFILE_ALL, Clang injects __llvm_gcov_* functions to each
+object file, including the *.mod.o. As we filter out CC_FLAGS_CFI
+for *.mod.o, the compiler won't generate type hashes for the
+injected functions, and therefore indirectly calling them during
+module loading trips indirect call checking.
+
+Enabling CFI for *.mod.o isn't sufficient to fix this issue after
+commit 0c3e806ec0f9 ("x86/cfi: Add boot time hash randomization"),
+as *.mod.o aren't processed by objtool, which means any hashes
+emitted there won't be randomized. Therefore, in addition to
+disabling CFI for *.mod.o, also disable GCOV, as the object files
+don't otherwise contain any executable code.
+
+Fixes: cf68fffb66d6 ("add support for Clang CFI")
+Reported-by: Joe Fradley <joefradley@google.com>
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.modfinal | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/Makefile.modfinal b/scripts/Makefile.modfinal
+index 25bedd83644b0..3af5e5807983a 100644
+--- a/scripts/Makefile.modfinal
++++ b/scripts/Makefile.modfinal
+@@ -23,7 +23,7 @@ modname = $(notdir $(@:.mod.o=))
+ part-of-module = y
+
+ quiet_cmd_cc_o_c = CC [M] $@
+- cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI), $(c_flags)) -c -o $@ $<
++ cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV), $(c_flags)) -c -o $@ $<
+
+ %.mod.o: %.mod.c FORCE
+ $(call if_changed_dep,cc_o_c)
+--
+2.39.2
+
--- /dev/null
+From 677e43770670e357e50cf7bf639fc64ab13b72ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 17:31:17 +0200
+Subject: kcsan: Don't expect 64 bits atomic builtins from 32 bits
+ architectures
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 353e7300a1db928e427462f2745f9a2cd1625b3d ]
+
+Activating KCSAN on a 32 bits architecture leads to the following
+link-time failure:
+
+ LD .tmp_vmlinux.kallsyms1
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_load':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_load_8'
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_store':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_store_8'
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_exchange':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_exchange_8'
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_add':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_add_8'
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_sub':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_sub_8'
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_and':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_and_8'
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_or':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_or_8'
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_xor':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_xor_8'
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_nand':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_nand_8'
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_strong':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8'
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_weak':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8'
+ powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_val':
+ kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8'
+
+32 bits architectures don't have 64 bits atomic builtins. Only
+include DEFINE_TSAN_ATOMIC_OPS(64) on 64 bits architectures.
+
+Fixes: 0f8ad5f2e934 ("kcsan: Add support for atomic builtins")
+Suggested-by: Marco Elver <elver@google.com>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Marco Elver <elver@google.com>
+Acked-by: Marco Elver <elver@google.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/d9c6afc28d0855240171a4e0ad9ffcdb9d07fceb.1683892665.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kcsan/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/kcsan/core.c b/kernel/kcsan/core.c
+index 5a60cc52adc0c..8a7baf4e332e3 100644
+--- a/kernel/kcsan/core.c
++++ b/kernel/kcsan/core.c
+@@ -1270,7 +1270,9 @@ static __always_inline void kcsan_atomic_builtin_memorder(int memorder)
+ DEFINE_TSAN_ATOMIC_OPS(8);
+ DEFINE_TSAN_ATOMIC_OPS(16);
+ DEFINE_TSAN_ATOMIC_OPS(32);
++#ifdef CONFIG_64BIT
+ DEFINE_TSAN_ATOMIC_OPS(64);
++#endif
+
+ void __tsan_atomic_thread_fence(int memorder);
+ void __tsan_atomic_thread_fence(int memorder)
+--
+2.39.2
+
--- /dev/null
+From 6b1df7cf428a2121a184b39616c164b299005d34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 May 2023 20:34:34 +0800
+Subject: kexec: fix a memory leak in crash_shrink_memory()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 1cba6c4309f03de570202c46f03df3f73a0d4c82 ]
+
+Patch series "kexec: enable kexec_crash_size to support two crash kernel
+regions".
+
+When crashkernel=X fails to reserve region under 4G, it will fall back to
+reserve region above 4G and a region of the default size will also be
+reserved under 4G. Unfortunately, /sys/kernel/kexec_crash_size only
+supports one crash kernel region now, the user cannot sense the low memory
+reserved by reading /sys/kernel/kexec_crash_size. Also, low memory cannot
+be freed by writing this file.
+
+For example:
+resource_size(crashk_res) = 512M
+resource_size(crashk_low_res) = 256M
+
+The result of 'cat /sys/kernel/kexec_crash_size' is 512M, but it should be
+768M. When we execute 'echo 0 > /sys/kernel/kexec_crash_size', the size
+of crashk_res becomes 0 and resource_size(crashk_low_res) is still 256 MB,
+which is incorrect.
+
+Since crashk_res manages the memory with high address and crashk_low_res
+manages the memory with low address, crashk_low_res is shrunken only when
+all crashk_res is shrunken. And because when there is only one crash
+kernel region, crashk_res is always used. Therefore, if all crashk_res is
+shrunken and crashk_low_res still exists, swap them.
+
+This patch (of 6):
+
+If the value of parameter 'new_size' is in the semi-open and semi-closed
+interval (crashk_res.end - KEXEC_CRASH_MEM_ALIGN + 1, crashk_res.end], the
+calculation result of ram_res is:
+
+ ram_res->start = crashk_res.end + 1
+ ram_res->end = crashk_res.end
+
+The operation of insert_resource() fails, and ram_res is not added to
+iomem_resource. As a result, the memory of the control block ram_res is
+leaked.
+
+In fact, on all architectures, the start address and size of crashk_res
+are already aligned by KEXEC_CRASH_MEM_ALIGN. Therefore, we do not need
+to round up crashk_res.start again. Instead, we should round up
+'new_size' in advance.
+
+Link: https://lkml.kernel.org/r/20230527123439.772-1-thunder.leizhen@huawei.com
+Link: https://lkml.kernel.org/r/20230527123439.772-2-thunder.leizhen@huawei.com
+Fixes: 6480e5a09237 ("kdump: add missing RAM resource in crash_shrink_memory()")
+Fixes: 06a7f711246b ("kexec: premit reduction of the reserved memory size")
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Acked-by: Baoquan He <bhe@redhat.com>
+Cc: Cong Wang <amwang@redhat.com>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kexec_core.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
+index ca2743f9c634e..79c012fbb49c8 100644
+--- a/kernel/kexec_core.c
++++ b/kernel/kexec_core.c
+@@ -1035,6 +1035,7 @@ int crash_shrink_memory(unsigned long new_size)
+ start = crashk_res.start;
+ end = crashk_res.end;
+ old_size = (end == 0) ? 0 : end - start + 1;
++ new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN);
+ if (new_size >= old_size) {
+ ret = (new_size == old_size) ? 0 : -EINVAL;
+ goto unlock;
+@@ -1046,9 +1047,7 @@ int crash_shrink_memory(unsigned long new_size)
+ goto unlock;
+ }
+
+- start = roundup(start, KEXEC_CRASH_MEM_ALIGN);
+- end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN);
+-
++ end = start + new_size;
+ crash_free_reserved_phys_range(end, crashk_res.end);
+
+ if ((start == end) && (crashk_res.parent != NULL))
+--
+2.39.2
+
--- /dev/null
+From 19360243dd89e7019e791f5cfed71a16256a56b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 11:47:43 +0100
+Subject: kselftest: vDSO: Fix accumulation of uninitialized ret when
+ CLOCK_REALTIME is undefined
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 375b9ff53cb6f9c042817b75f2be0a650626dc4f ]
+
+In the unlikely case that CLOCK_REALTIME is not defined, variable ret is
+not initialized and further accumulation of return values to ret can leave
+ret in an undefined state. Fix this by initialized ret to zero and changing
+the assignment of ret to an accumulation for the CLOCK_REALTIME case.
+
+Fixes: 03f55c7952c9 ("kselftest: Extend vDSO selftest to clock_getres")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/vdso_test_clock_getres.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/vDSO/vdso_test_clock_getres.c b/tools/testing/selftests/vDSO/vdso_test_clock_getres.c
+index 15dcee16ff726..38d46a8bf7cba 100644
+--- a/tools/testing/selftests/vDSO/vdso_test_clock_getres.c
++++ b/tools/testing/selftests/vDSO/vdso_test_clock_getres.c
+@@ -84,12 +84,12 @@ static inline int vdso_test_clock(unsigned int clock_id)
+
+ int main(int argc, char **argv)
+ {
+- int ret;
++ int ret = 0;
+
+ #if _POSIX_TIMERS > 0
+
+ #ifdef CLOCK_REALTIME
+- ret = vdso_test_clock(CLOCK_REALTIME);
++ ret += vdso_test_clock(CLOCK_REALTIME);
+ #endif
+
+ #ifdef CLOCK_BOOTTIME
+--
+2.39.2
+
--- /dev/null
+From 5f6cd72e492d443ffeea0fd6a327a1b19f625da8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jun 2023 10:19:38 +0200
+Subject: ksmbd: avoid field overflow warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9cedc58bdbe9fff9aacd0ca19ee5777659f28fd7 ]
+
+clang warns about a possible field overflow in a memcpy:
+
+In file included from fs/smb/server/smb_common.c:7:
+include/linux/fortify-string.h:583:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
+ __write_overflow_field(p_size_field, size);
+
+It appears to interpret the "&out[baselen + 4]" as referring to a single
+byte of the character array, while the equivalen "out + baselen + 4" is
+seen as an offset into the array.
+
+I don't see that kind of warning elsewhere, so just go with the simple
+rework.
+
+Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c
+index 05d7f3e910bf4..d937e2f45c829 100644
+--- a/fs/smb/server/smb_common.c
++++ b/fs/smb/server/smb_common.c
+@@ -536,7 +536,7 @@ int ksmbd_extract_shortname(struct ksmbd_conn *conn, const char *longname,
+ out[baselen + 3] = PERIOD;
+
+ if (dot_present)
+- memcpy(&out[baselen + 4], extension, 4);
++ memcpy(out + baselen + 4, extension, 4);
+ else
+ out[baselen + 4] = '\0';
+ smbConvertToUTF16((__le16 *)shortname, out, PATH_MAX,
+--
+2.39.2
+
--- /dev/null
+From 375781f3d010a4f3e65df5a7610a0b526c161b15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jun 2023 20:06:57 +0100
+Subject: lib/ts_bm: reset initial match offset for every block of text
+
+From: Jeremy Sowden <jeremy@azazel.net>
+
+[ Upstream commit 6f67fbf8192da80c4db01a1800c7fceaca9cf1f9 ]
+
+The `shift` variable which indicates the offset in the string at which
+to start matching the pattern is initialized to `bm->patlen - 1`, but it
+is not reset when a new block is retrieved. This means the implemen-
+tation may start looking at later and later positions in each successive
+block and miss occurrences of the pattern at the beginning. E.g.,
+consider a HTTP packet held in a non-linear skb, where the HTTP request
+line occurs in the second block:
+
+ [... 52 bytes of packet headers ...]
+ GET /bmtest HTTP/1.1\r\nHost: www.example.com\r\n\r\n
+
+and the pattern is "GET /bmtest".
+
+Once the first block comprising the packet headers has been examined,
+`shift` will be pointing to somewhere near the end of the block, and so
+when the second block is examined the request line at the beginning will
+be missed.
+
+Reinitialize the variable for each new block.
+
+Fixes: 8082e4ed0a61 ("[LIB]: Boyer-Moore extension for textsearch infrastructure strike #2")
+Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1390
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/ts_bm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/ts_bm.c b/lib/ts_bm.c
+index 1f2234221dd11..c8ecbf74ef295 100644
+--- a/lib/ts_bm.c
++++ b/lib/ts_bm.c
+@@ -60,10 +60,12 @@ static unsigned int bm_find(struct ts_config *conf, struct ts_state *state)
+ struct ts_bm *bm = ts_config_priv(conf);
+ unsigned int i, text_len, consumed = state->offset;
+ const u8 *text;
+- int shift = bm->patlen - 1, bs;
++ int bs;
+ const u8 icase = conf->flags & TS_IGNORECASE;
+
+ for (;;) {
++ int shift = bm->patlen - 1;
++
+ text_len = conf->get_next_block(consumed, &text, conf, state);
+
+ if (unlikely(text_len == 0))
+--
+2.39.2
+
--- /dev/null
+From 3ec4b068fc4ec36a90cda33cc90c911b1ca93dc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 18:36:38 -0700
+Subject: libbpf: btf_dump_type_data_check_overflow needs to consider
+ BTF_MEMBER_BITFIELD_SIZE
+
+From: Martin KaFai Lau <martin.lau@kernel.org>
+
+[ Upstream commit c39028b333f3a3a765c5c0b9726b8e38aedf0ba1 ]
+
+The btf_dump/struct_data selftest is failing with:
+
+ [...]
+ test_btf_dump_struct_data:FAIL:unexpected return value dumping fs_context unexpected unexpected return value dumping fs_context: actual -7 != expected 264
+ [...]
+
+The reason is in btf_dump_type_data_check_overflow(). It does not use
+BTF_MEMBER_BITFIELD_SIZE from the struct's member (btf_member). Instead,
+it is using the enum size which is 4. It had been working till the recent
+commit 4e04143c869c ("fs_context: drop the unused lsm_flags member")
+removed an integer member which also removed the 4 bytes padding at the
+end of the fs_context. Missing this 4 bytes padding exposed this bug. In
+particular, when btf_dump_type_data_check_overflow() reaches the member
+'phase', -E2BIG is returned.
+
+The fix is to pass bit_sz to btf_dump_type_data_check_overflow(). In
+btf_dump_type_data_check_overflow(), it does a different size check when
+bit_sz is not zero.
+
+The current fs_context:
+
+[3600] ENUM 'fs_context_purpose' encoding=UNSIGNED size=4 vlen=3
+ 'FS_CONTEXT_FOR_MOUNT' val=0
+ 'FS_CONTEXT_FOR_SUBMOUNT' val=1
+ 'FS_CONTEXT_FOR_RECONFIGURE' val=2
+[3601] ENUM 'fs_context_phase' encoding=UNSIGNED size=4 vlen=7
+ 'FS_CONTEXT_CREATE_PARAMS' val=0
+ 'FS_CONTEXT_CREATING' val=1
+ 'FS_CONTEXT_AWAITING_MOUNT' val=2
+ 'FS_CONTEXT_AWAITING_RECONF' val=3
+ 'FS_CONTEXT_RECONF_PARAMS' val=4
+ 'FS_CONTEXT_RECONFIGURING' val=5
+ 'FS_CONTEXT_FAILED' val=6
+[3602] STRUCT 'fs_context' size=264 vlen=21
+ 'ops' type_id=3603 bits_offset=0
+ 'uapi_mutex' type_id=235 bits_offset=64
+ 'fs_type' type_id=872 bits_offset=1216
+ 'fs_private' type_id=21 bits_offset=1280
+ 'sget_key' type_id=21 bits_offset=1344
+ 'root' type_id=781 bits_offset=1408
+ 'user_ns' type_id=251 bits_offset=1472
+ 'net_ns' type_id=984 bits_offset=1536
+ 'cred' type_id=1785 bits_offset=1600
+ 'log' type_id=3621 bits_offset=1664
+ 'source' type_id=42 bits_offset=1792
+ 'security' type_id=21 bits_offset=1856
+ 's_fs_info' type_id=21 bits_offset=1920
+ 'sb_flags' type_id=20 bits_offset=1984
+ 'sb_flags_mask' type_id=20 bits_offset=2016
+ 's_iflags' type_id=20 bits_offset=2048
+ 'purpose' type_id=3600 bits_offset=2080 bitfield_size=8
+ 'phase' type_id=3601 bits_offset=2088 bitfield_size=8
+ 'need_free' type_id=67 bits_offset=2096 bitfield_size=1
+ 'global' type_id=67 bits_offset=2097 bitfield_size=1
+ 'oldapi' type_id=67 bits_offset=2098 bitfield_size=1
+
+Fixes: 920d16af9b42 ("libbpf: BTF dumper support for typed data")
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20230428013638.1581263-1-martin.lau@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf_dump.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
+index 4cd1d49c94d6d..713264899250a 100644
+--- a/tools/lib/bpf/btf_dump.c
++++ b/tools/lib/bpf/btf_dump.c
+@@ -2213,9 +2213,25 @@ static int btf_dump_type_data_check_overflow(struct btf_dump *d,
+ const struct btf_type *t,
+ __u32 id,
+ const void *data,
+- __u8 bits_offset)
++ __u8 bits_offset,
++ __u8 bit_sz)
+ {
+- __s64 size = btf__resolve_size(d->btf, id);
++ __s64 size;
++
++ if (bit_sz) {
++ /* bits_offset is at most 7. bit_sz is at most 128. */
++ __u8 nr_bytes = (bits_offset + bit_sz + 7) / 8;
++
++ /* When bit_sz is non zero, it is called from
++ * btf_dump_struct_data() where it only cares about
++ * negative error value.
++ * Return nr_bytes in success case to make it
++ * consistent as the regular integer case below.
++ */
++ return data + nr_bytes > d->typed_dump->data_end ? -E2BIG : nr_bytes;
++ }
++
++ size = btf__resolve_size(d->btf, id);
+
+ if (size < 0 || size >= INT_MAX) {
+ pr_warn("unexpected size [%zu] for id [%u]\n",
+@@ -2370,7 +2386,7 @@ static int btf_dump_dump_type_data(struct btf_dump *d,
+ {
+ int size, err = 0;
+
+- size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset);
++ size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset, bit_sz);
+ if (size < 0)
+ return size;
+ err = btf_dump_type_data_check_zero(d, t, id, data, bits_offset, bit_sz);
+--
+2.39.2
+
--- /dev/null
+From ae3bd5d5e11204b4f65fb88bbdc798424ba630b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 23:55:02 -0700
+Subject: libbpf: fix offsetof() and container_of() to work with CO-RE
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit bdeeed3498c7871c17465bb4f11d1bc67f9098af ]
+
+It seems like __builtin_offset() doesn't preserve CO-RE field
+relocations properly. So if offsetof() macro is defined through
+__builtin_offset(), CO-RE-enabled BPF code using container_of() will be
+subtly and silently broken.
+
+To avoid this problem, redefine offsetof() and container_of() in the
+form that works with CO-RE relocations more reliably.
+
+Fixes: 5fbc220862fc ("tools/libpf: Add offsetof/container_of macro in bpf_helpers.h")
+Reported-by: Lennart Poettering <lennart@poettering.net>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/r/20230509065502.2306180-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/bpf_helpers.h | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/tools/lib/bpf/bpf_helpers.h b/tools/lib/bpf/bpf_helpers.h
+index d37c4fe2849d2..2b3b300bf4dfa 100644
+--- a/tools/lib/bpf/bpf_helpers.h
++++ b/tools/lib/bpf/bpf_helpers.h
+@@ -77,16 +77,21 @@
+ /*
+ * Helper macros to manipulate data structures
+ */
+-#ifndef offsetof
+-#define offsetof(TYPE, MEMBER) ((unsigned long)&((TYPE *)0)->MEMBER)
+-#endif
+-#ifndef container_of
++
++/* offsetof() definition that uses __builtin_offset() might not preserve field
++ * offset CO-RE relocation properly, so force-redefine offsetof() using
++ * old-school approach which works with CO-RE correctly
++ */
++#undef offsetof
++#define offsetof(type, member) ((unsigned long)&((type *)0)->member)
++
++/* redefined container_of() to ensure we use the above offsetof() macro */
++#undef container_of
+ #define container_of(ptr, type, member) \
+ ({ \
+ void *__mptr = (void *)(ptr); \
+ ((type *)(__mptr - offsetof(type, member))); \
+ })
+-#endif
+
+ /*
+ * Compiler (optimization) barrier.
+--
+2.39.2
+
--- /dev/null
+From 7c56d1de5d33094091700a8af15c9bb1da96bed4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jun 2023 07:14:14 +1000
+Subject: lockd: drop inappropriate svc_get() from locked_get()
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit 665e89ab7c5af1f2d260834c861a74b01a30f95f ]
+
+The below-mentioned patch was intended to simplify refcounting on the
+svc_serv used by locked. The goal was to only ever have a single
+reference from the single thread. To that end we dropped a call to
+lockd_start_svc() (except when creating thread) which would take a
+reference, and dropped the svc_put(serv) that would drop that reference.
+
+Unfortunately we didn't also remove the svc_get() from
+lockd_create_svc() in the case where the svc_serv already existed.
+So after the patch:
+ - on the first call the svc_serv was allocated and the one reference
+ was given to the thread, so there are no extra references
+ - on subsequent calls svc_get() was called so there is now an extra
+ reference.
+This is clearly not consistent.
+
+The inconsistency is also clear in the current code in lockd_get()
+takes *two* references, one on nlmsvc_serv and one by incrementing
+nlmsvc_users. This clearly does not match lockd_put().
+
+So: drop that svc_get() from lockd_get() (which used to be in
+lockd_create_svc().
+
+Reported-by: Ido Schimmel <idosch@idosch.org>
+Closes: https://lore.kernel.org/linux-nfs/ZHsI%2FH16VX9kJQX1@shredder/T/#u
+Fixes: b73a2972041b ("lockd: move lockd_start_svc() call into lockd_create_svc()")
+Signed-off-by: NeilBrown <neilb@suse.de>
+Tested-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/lockd/svc.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
+index 59ef8a1f843f3..5579e67da17db 100644
+--- a/fs/lockd/svc.c
++++ b/fs/lockd/svc.c
+@@ -355,7 +355,6 @@ static int lockd_get(void)
+ int error;
+
+ if (nlmsvc_serv) {
+- svc_get(nlmsvc_serv);
+ nlmsvc_users++;
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 9f83b7dd5aade2c47b058776940ecf00ad0309bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jun 2023 08:00:58 +0100
+Subject: locking/atomic: arm: fix sync ops
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit dda5f312bb09e56e7a1c3e3851f2000eb2e9c879 ]
+
+The sync_*() ops on arch/arm are defined in terms of the regular bitops
+with no special handling. This is not correct, as UP kernels elide
+barriers for the fully-ordered operations, and so the required ordering
+is lost when such UP kernels are run under a hypervsior on an SMP
+system.
+
+Fix this by defining sync ops with the required barriers.
+
+Note: On 32-bit arm, the sync_*() ops are currently only used by Xen,
+which requires ARMv7, but the semantics can be implemented for ARMv6+.
+
+Fixes: e54d2f61528165bb ("xen/arm: sync_bitops")
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230605070124.3741859-2-mark.rutland@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/assembler.h | 17 +++++++++++++++++
+ arch/arm/include/asm/sync_bitops.h | 29 +++++++++++++++++++++++++----
+ arch/arm/lib/bitops.h | 14 +++++++++++---
+ arch/arm/lib/testchangebit.S | 4 ++++
+ arch/arm/lib/testclearbit.S | 4 ++++
+ arch/arm/lib/testsetbit.S | 4 ++++
+ 6 files changed, 65 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index 90fbe4a3f9c84..84912b19cac85 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -402,6 +402,23 @@ ALT_UP_B(.L0_\@)
+ #endif
+ .endm
+
++/*
++ * Raw SMP data memory barrier
++ */
++ .macro __smp_dmb mode
++#if __LINUX_ARM_ARCH__ >= 7
++ .ifeqs "\mode","arm"
++ dmb ish
++ .else
++ W(dmb) ish
++ .endif
++#elif __LINUX_ARM_ARCH__ == 6
++ mcr p15, 0, r0, c7, c10, 5 @ dmb
++#else
++ .error "Incompatible SMP platform"
++#endif
++ .endm
++
+ #if defined(CONFIG_CPU_V7M)
+ /*
+ * setmode is used to assert to be in svc mode during boot. For v7-M
+diff --git a/arch/arm/include/asm/sync_bitops.h b/arch/arm/include/asm/sync_bitops.h
+index 6f5d627c44a3c..f46b3c570f92e 100644
+--- a/arch/arm/include/asm/sync_bitops.h
++++ b/arch/arm/include/asm/sync_bitops.h
+@@ -14,14 +14,35 @@
+ * ops which are SMP safe even on a UP kernel.
+ */
+
++/*
++ * Unordered
++ */
++
+ #define sync_set_bit(nr, p) _set_bit(nr, p)
+ #define sync_clear_bit(nr, p) _clear_bit(nr, p)
+ #define sync_change_bit(nr, p) _change_bit(nr, p)
+-#define sync_test_and_set_bit(nr, p) _test_and_set_bit(nr, p)
+-#define sync_test_and_clear_bit(nr, p) _test_and_clear_bit(nr, p)
+-#define sync_test_and_change_bit(nr, p) _test_and_change_bit(nr, p)
+ #define sync_test_bit(nr, addr) test_bit(nr, addr)
+-#define arch_sync_cmpxchg arch_cmpxchg
+
++/*
++ * Fully ordered
++ */
++
++int _sync_test_and_set_bit(int nr, volatile unsigned long * p);
++#define sync_test_and_set_bit(nr, p) _sync_test_and_set_bit(nr, p)
++
++int _sync_test_and_clear_bit(int nr, volatile unsigned long * p);
++#define sync_test_and_clear_bit(nr, p) _sync_test_and_clear_bit(nr, p)
++
++int _sync_test_and_change_bit(int nr, volatile unsigned long * p);
++#define sync_test_and_change_bit(nr, p) _sync_test_and_change_bit(nr, p)
++
++#define arch_sync_cmpxchg(ptr, old, new) \
++({ \
++ __typeof__(*(ptr)) __ret; \
++ __smp_mb__before_atomic(); \
++ __ret = arch_cmpxchg_relaxed((ptr), (old), (new)); \
++ __smp_mb__after_atomic(); \
++ __ret; \
++})
+
+ #endif
+diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
+index 95bd359912889..f069d1b2318e6 100644
+--- a/arch/arm/lib/bitops.h
++++ b/arch/arm/lib/bitops.h
+@@ -28,7 +28,7 @@ UNWIND( .fnend )
+ ENDPROC(\name )
+ .endm
+
+- .macro testop, name, instr, store
++ .macro __testop, name, instr, store, barrier
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+@@ -38,7 +38,7 @@ UNWIND( .fnstart )
+ mov r0, r0, lsr #5
+ add r1, r1, r0, lsl #2 @ Get word offset
+ mov r3, r2, lsl r3 @ create mask
+- smp_dmb
++ \barrier
+ #if __LINUX_ARM_ARCH__ >= 7 && defined(CONFIG_SMP)
+ .arch_extension mp
+ ALT_SMP(W(pldw) [r1])
+@@ -50,13 +50,21 @@ UNWIND( .fnstart )
+ strex ip, r2, [r1]
+ cmp ip, #0
+ bne 1b
+- smp_dmb
++ \barrier
+ cmp r0, #0
+ movne r0, #1
+ 2: bx lr
+ UNWIND( .fnend )
+ ENDPROC(\name )
+ .endm
++
++ .macro testop, name, instr, store
++ __testop \name, \instr, \store, smp_dmb
++ .endm
++
++ .macro sync_testop, name, instr, store
++ __testop \name, \instr, \store, __smp_dmb
++ .endm
+ #else
+ .macro bitop, name, instr
+ ENTRY( \name )
+diff --git a/arch/arm/lib/testchangebit.S b/arch/arm/lib/testchangebit.S
+index 4ebecc67e6e04..f13fe9bc2399a 100644
+--- a/arch/arm/lib/testchangebit.S
++++ b/arch/arm/lib/testchangebit.S
+@@ -10,3 +10,7 @@
+ .text
+
+ testop _test_and_change_bit, eor, str
++
++#if __LINUX_ARM_ARCH__ >= 6
++sync_testop _sync_test_and_change_bit, eor, str
++#endif
+diff --git a/arch/arm/lib/testclearbit.S b/arch/arm/lib/testclearbit.S
+index 009afa0f5b4a7..4d2c5ca620ebf 100644
+--- a/arch/arm/lib/testclearbit.S
++++ b/arch/arm/lib/testclearbit.S
+@@ -10,3 +10,7 @@
+ .text
+
+ testop _test_and_clear_bit, bicne, strne
++
++#if __LINUX_ARM_ARCH__ >= 6
++sync_testop _sync_test_and_clear_bit, bicne, strne
++#endif
+diff --git a/arch/arm/lib/testsetbit.S b/arch/arm/lib/testsetbit.S
+index f3192e55acc87..649dbab65d8d0 100644
+--- a/arch/arm/lib/testsetbit.S
++++ b/arch/arm/lib/testsetbit.S
+@@ -10,3 +10,7 @@
+ .text
+
+ testop _test_and_set_bit, orreq, streq
++
++#if __LINUX_ARM_ARCH__ >= 6
++sync_testop _sync_test_and_set_bit, orreq, streq
++#endif
+--
+2.39.2
+
--- /dev/null
+From 2e44b94246aa2272ea30075ecbbe5b86d58b9b77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 May 2023 21:11:01 +0800
+Subject: md/raid1-10: factor out a helper to add bio to plug
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 5ec6ca140a034682e421e2e808ef5ddfdfd65242 ]
+
+The code in raid1 and raid10 is identical, prepare to limit the number
+of plugged bios.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230529131106.2123367-3-yukuai1@huaweicloud.com
+Stable-dep-of: 7db922bae3ab ("md/raid1-10: submit write io directly if bitmap is not enabled")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid1-10.c | 16 ++++++++++++++++
+ drivers/md/raid1.c | 12 +-----------
+ drivers/md/raid10.c | 11 +----------
+ 3 files changed, 18 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c
+index e61f6cad4e08e..9bf19a3409cef 100644
+--- a/drivers/md/raid1-10.c
++++ b/drivers/md/raid1-10.c
+@@ -109,3 +109,19 @@ static void md_bio_reset_resync_pages(struct bio *bio, struct resync_pages *rp,
+ size -= len;
+ } while (idx++ < RESYNC_PAGES && size > 0);
+ }
++
++static inline bool raid1_add_bio_to_plug(struct mddev *mddev, struct bio *bio,
++ blk_plug_cb_fn unplug)
++{
++ struct raid1_plug_cb *plug = NULL;
++ struct blk_plug_cb *cb = blk_check_plugged(unplug, mddev,
++ sizeof(*plug));
++
++ if (!cb)
++ return false;
++
++ plug = container_of(cb, struct raid1_plug_cb, cb);
++ bio_list_add(&plug->pending, bio);
++
++ return true;
++}
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 58f705f429480..f3f2078d69e77 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1343,8 +1343,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
+ struct bitmap *bitmap = mddev->bitmap;
+ unsigned long flags;
+ struct md_rdev *blocked_rdev;
+- struct blk_plug_cb *cb;
+- struct raid1_plug_cb *plug = NULL;
+ int first_clone;
+ int max_sectors;
+ bool write_behind = false;
+@@ -1573,15 +1571,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
+ r1_bio->sector);
+ /* flush_pending_writes() needs access to the rdev so...*/
+ mbio->bi_bdev = (void *)rdev;
+-
+- cb = blk_check_plugged(raid1_unplug, mddev, sizeof(*plug));
+- if (cb)
+- plug = container_of(cb, struct raid1_plug_cb, cb);
+- else
+- plug = NULL;
+- if (plug) {
+- bio_list_add(&plug->pending, mbio);
+- } else {
++ if (!raid1_add_bio_to_plug(mddev, mbio, raid1_unplug)) {
+ spin_lock_irqsave(&conf->device_lock, flags);
+ bio_list_add(&conf->pending_bio_list, mbio);
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 386c16c398269..14001cceb6186 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1288,8 +1288,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio,
+ const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC;
+ const blk_opf_t do_fua = bio->bi_opf & REQ_FUA;
+ unsigned long flags;
+- struct blk_plug_cb *cb;
+- struct raid1_plug_cb *plug = NULL;
+ struct r10conf *conf = mddev->private;
+ struct md_rdev *rdev;
+ int devnum = r10_bio->devs[n_copy].devnum;
+@@ -1329,14 +1327,7 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio,
+
+ atomic_inc(&r10_bio->remaining);
+
+- cb = blk_check_plugged(raid10_unplug, mddev, sizeof(*plug));
+- if (cb)
+- plug = container_of(cb, struct raid1_plug_cb, cb);
+- else
+- plug = NULL;
+- if (plug) {
+- bio_list_add(&plug->pending, mbio);
+- } else {
++ if (!raid1_add_bio_to_plug(mddev, mbio, raid10_unplug)) {
+ spin_lock_irqsave(&conf->device_lock, flags);
+ bio_list_add(&conf->pending_bio_list, mbio);
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+--
+2.39.2
+
--- /dev/null
+From 38bed6664d0c4d6a21e0d3fcd7ce027c380f95d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 May 2023 21:11:02 +0800
+Subject: md/raid1-10: factor out a helper to submit normal write
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 8295efbe68c080047e98d9c0eb5cb933b238a8cb ]
+
+There are multiple places to do the same thing, factor out a helper to
+prevent redundant code, and the helper will be used in following patch
+as well.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230529131106.2123367-4-yukuai1@huaweicloud.com
+Stable-dep-of: 7db922bae3ab ("md/raid1-10: submit write io directly if bitmap is not enabled")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid1-10.c | 17 +++++++++++++++++
+ drivers/md/raid1.c | 13 ++-----------
+ drivers/md/raid10.c | 26 ++++----------------------
+ 3 files changed, 23 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c
+index 9bf19a3409cef..506299bd55cb6 100644
+--- a/drivers/md/raid1-10.c
++++ b/drivers/md/raid1-10.c
+@@ -110,6 +110,23 @@ static void md_bio_reset_resync_pages(struct bio *bio, struct resync_pages *rp,
+ } while (idx++ < RESYNC_PAGES && size > 0);
+ }
+
++
++static inline void raid1_submit_write(struct bio *bio)
++{
++ struct md_rdev *rdev = (struct md_rdev *)bio->bi_bdev;
++
++ bio->bi_next = NULL;
++ bio_set_dev(bio, rdev->bdev);
++ if (test_bit(Faulty, &rdev->flags))
++ bio_io_error(bio);
++ else if (unlikely(bio_op(bio) == REQ_OP_DISCARD &&
++ !bdev_max_discard_sectors(bio->bi_bdev)))
++ /* Just ignore it */
++ bio_endio(bio);
++ else
++ submit_bio_noacct(bio);
++}
++
+ static inline bool raid1_add_bio_to_plug(struct mddev *mddev, struct bio *bio,
+ blk_plug_cb_fn unplug)
+ {
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index f3f2078d69e77..ac64c587191b9 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -799,17 +799,8 @@ static void flush_bio_list(struct r1conf *conf, struct bio *bio)
+
+ while (bio) { /* submit pending writes */
+ struct bio *next = bio->bi_next;
+- struct md_rdev *rdev = (void *)bio->bi_bdev;
+- bio->bi_next = NULL;
+- bio_set_dev(bio, rdev->bdev);
+- if (test_bit(Faulty, &rdev->flags)) {
+- bio_io_error(bio);
+- } else if (unlikely((bio_op(bio) == REQ_OP_DISCARD) &&
+- !bdev_max_discard_sectors(bio->bi_bdev)))
+- /* Just ignore it */
+- bio_endio(bio);
+- else
+- submit_bio_noacct(bio);
++
++ raid1_submit_write(bio);
+ bio = next;
+ cond_resched();
+ }
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 14001cceb6186..ea6228ff3bb5e 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -917,17 +917,8 @@ static void flush_pending_writes(struct r10conf *conf)
+
+ while (bio) { /* submit pending writes */
+ struct bio *next = bio->bi_next;
+- struct md_rdev *rdev = (void*)bio->bi_bdev;
+- bio->bi_next = NULL;
+- bio_set_dev(bio, rdev->bdev);
+- if (test_bit(Faulty, &rdev->flags)) {
+- bio_io_error(bio);
+- } else if (unlikely((bio_op(bio) == REQ_OP_DISCARD) &&
+- !bdev_max_discard_sectors(bio->bi_bdev)))
+- /* Just ignore it */
+- bio_endio(bio);
+- else
+- submit_bio_noacct(bio);
++
++ raid1_submit_write(bio);
+ bio = next;
+ }
+ blk_finish_plug(&plug);
+@@ -1136,17 +1127,8 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
+
+ while (bio) { /* submit pending writes */
+ struct bio *next = bio->bi_next;
+- struct md_rdev *rdev = (void*)bio->bi_bdev;
+- bio->bi_next = NULL;
+- bio_set_dev(bio, rdev->bdev);
+- if (test_bit(Faulty, &rdev->flags)) {
+- bio_io_error(bio);
+- } else if (unlikely((bio_op(bio) == REQ_OP_DISCARD) &&
+- !bdev_max_discard_sectors(bio->bi_bdev)))
+- /* Just ignore it */
+- bio_endio(bio);
+- else
+- submit_bio_noacct(bio);
++
++ raid1_submit_write(bio);
+ bio = next;
+ }
+ kfree(plug);
+--
+2.39.2
+
--- /dev/null
+From 1b1c497acf4212539a351bf90f908f99d5bae1c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 May 2023 21:11:03 +0800
+Subject: md/raid1-10: submit write io directly if bitmap is not enabled
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 7db922bae3abdf0a1db81ef7228cc0b996a0c1e3 ]
+
+Commit 6cce3b23f6f8 ("[PATCH] md: write intent bitmap support for raid10")
+add bitmap support, and it changed that write io is submitted through
+daemon thread because bitmap need to be updated before write io. And
+later, plug is used to fix performance regression because all the write io
+will go to demon thread, which means io can't be issued concurrently.
+
+However, if bitmap is not enabled, the write io should not go to daemon
+thread in the first place, and plug is not needed as well.
+
+Fixes: 6cce3b23f6f8 ("[PATCH] md: write intent bitmap support for raid10")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230529131106.2123367-5-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md-bitmap.c | 4 +---
+ drivers/md/md-bitmap.h | 7 +++++++
+ drivers/md/raid1-10.c | 13 +++++++++++--
+ 3 files changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
+index 9640741e8d369..8bbeeec70905c 100644
+--- a/drivers/md/md-bitmap.c
++++ b/drivers/md/md-bitmap.c
+@@ -993,7 +993,6 @@ static int md_bitmap_file_test_bit(struct bitmap *bitmap, sector_t block)
+ return set;
+ }
+
+-
+ /* this gets called when the md device is ready to unplug its underlying
+ * (slave) device queues -- before we let any writes go down, we need to
+ * sync the dirty pages of the bitmap file to disk */
+@@ -1003,8 +1002,7 @@ void md_bitmap_unplug(struct bitmap *bitmap)
+ int dirty, need_write;
+ int writing = 0;
+
+- if (!bitmap || !bitmap->storage.filemap ||
+- test_bit(BITMAP_STALE, &bitmap->flags))
++ if (!md_bitmap_enabled(bitmap))
+ return;
+
+ /* look at each page to see if there are any set bits that need to be
+diff --git a/drivers/md/md-bitmap.h b/drivers/md/md-bitmap.h
+index cfd7395de8fd3..3a4750952b3a7 100644
+--- a/drivers/md/md-bitmap.h
++++ b/drivers/md/md-bitmap.h
+@@ -273,6 +273,13 @@ int md_bitmap_copy_from_slot(struct mddev *mddev, int slot,
+ sector_t *lo, sector_t *hi, bool clear_bits);
+ void md_bitmap_free(struct bitmap *bitmap);
+ void md_bitmap_wait_behind_writes(struct mddev *mddev);
++
++static inline bool md_bitmap_enabled(struct bitmap *bitmap)
++{
++ return bitmap && bitmap->storage.filemap &&
++ !test_bit(BITMAP_STALE, &bitmap->flags);
++}
++
+ #endif
+
+ #endif
+diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c
+index 506299bd55cb6..73cc3cb9154d8 100644
+--- a/drivers/md/raid1-10.c
++++ b/drivers/md/raid1-10.c
+@@ -131,9 +131,18 @@ static inline bool raid1_add_bio_to_plug(struct mddev *mddev, struct bio *bio,
+ blk_plug_cb_fn unplug)
+ {
+ struct raid1_plug_cb *plug = NULL;
+- struct blk_plug_cb *cb = blk_check_plugged(unplug, mddev,
+- sizeof(*plug));
++ struct blk_plug_cb *cb;
++
++ /*
++ * If bitmap is not enabled, it's safe to submit the io directly, and
++ * this can get optimal performance.
++ */
++ if (!md_bitmap_enabled(mddev->bitmap)) {
++ raid1_submit_write(bio);
++ return true;
++ }
+
++ cb = blk_check_plugged(unplug, mddev, sizeof(*plug));
+ if (!cb)
+ return false;
+
+--
+2.39.2
+
--- /dev/null
+From d6b477420b1b9f106a17daeb8e0df5e90cb6487b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 21:48:05 +0800
+Subject: md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 301867b1c16805aebbc306aafa6ecdc68b73c7e5 ]
+
+If we write a large number to md/bitmap_set_bits, md_bitmap_checkpage()
+will return -EINVAL because 'page >= bitmap->pages', but the return value
+was not checked immediately in md_bitmap_get_counter() in order to set
+*blocks value and slab-out-of-bounds occurs.
+
+Move check of 'page >= bitmap->pages' to md_bitmap_get_counter() and
+return directly if true.
+
+Fixes: ef4256733506 ("md/bitmap: optimise scanning of empty bitmaps.")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230515134808.3936750-2-linan666@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md-bitmap.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
+index e7cc6ba1b657f..9640741e8d369 100644
+--- a/drivers/md/md-bitmap.c
++++ b/drivers/md/md-bitmap.c
+@@ -54,14 +54,7 @@ __acquires(bitmap->lock)
+ {
+ unsigned char *mappage;
+
+- if (page >= bitmap->pages) {
+- /* This can happen if bitmap_start_sync goes beyond
+- * End-of-device while looking for a whole page.
+- * It is harmless.
+- */
+- return -EINVAL;
+- }
+-
++ WARN_ON_ONCE(page >= bitmap->pages);
+ if (bitmap->bp[page].hijacked) /* it's hijacked, don't try to alloc */
+ return 0;
+
+@@ -1364,6 +1357,14 @@ __acquires(bitmap->lock)
+ sector_t csize;
+ int err;
+
++ if (page >= bitmap->pages) {
++ /*
++ * This can happen if bitmap_start_sync goes beyond
++ * End-of-device while looking for a whole page or
++ * user set a huge number to sysfs bitmap_set_bits.
++ */
++ return NULL;
++ }
+ err = md_bitmap_checkpage(bitmap, page, create, 0);
+
+ if (bitmap->bp[page].hijacked ||
+--
+2.39.2
+
--- /dev/null
+From a1d1d7ea461c4beacb14bc3c0aba4cc0823e7f11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 17:18:39 +0800
+Subject: md/raid10: fix io loss while replacement replace rdev
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 2ae6aaf76912bae53c74b191569d2ab484f24bf3 ]
+
+When removing a disk with replacement, the replacement will be used to
+replace rdev. During this process, there is a brief window in which both
+rdev and replacement are read as NULL in raid10_write_request(). This
+will result in io not being submitted but it should be.
+
+ //remove //write
+ raid10_remove_disk raid10_write_request
+ mirror->rdev = NULL
+ read rdev -> NULL
+ mirror->rdev = mirror->replacement
+ mirror->replacement = NULL
+ read replacement -> NULL
+
+Fix it by reading replacement first and rdev later, meanwhile, use smp_mb()
+to prevent memory reordering.
+
+Fixes: 475b0321a4df ("md/raid10: writes should get directed to replacement as well as original.")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230602091839.743798-3-linan666@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 0eb2eb83ddb9e..386c16c398269 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -779,8 +779,16 @@ static struct md_rdev *read_balance(struct r10conf *conf,
+ disk = r10_bio->devs[slot].devnum;
+ rdev = rcu_dereference(conf->mirrors[disk].replacement);
+ if (rdev == NULL || test_bit(Faulty, &rdev->flags) ||
+- r10_bio->devs[slot].addr + sectors > rdev->recovery_offset)
++ r10_bio->devs[slot].addr + sectors >
++ rdev->recovery_offset) {
++ /*
++ * Read replacement first to prevent reading both rdev
++ * and replacement as NULL during replacement replace
++ * rdev.
++ */
++ smp_mb();
+ rdev = rcu_dereference(conf->mirrors[disk].rdev);
++ }
+ if (rdev == NULL ||
+ test_bit(Faulty, &rdev->flags))
+ continue;
+@@ -1477,9 +1485,15 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,
+
+ for (i = 0; i < conf->copies; i++) {
+ int d = r10_bio->devs[i].devnum;
+- struct md_rdev *rdev = rcu_dereference(conf->mirrors[d].rdev);
+- struct md_rdev *rrdev = rcu_dereference(
+- conf->mirrors[d].replacement);
++ struct md_rdev *rdev, *rrdev;
++
++ rrdev = rcu_dereference(conf->mirrors[d].replacement);
++ /*
++ * Read replacement first to prevent reading both rdev and
++ * replacement as NULL during replacement replace rdev.
++ */
++ smp_mb();
++ rdev = rcu_dereference(conf->mirrors[d].rdev);
+ if (rdev == rrdev)
+ rrdev = NULL;
+ if (rdev && (test_bit(Faulty, &rdev->flags)))
+--
+2.39.2
+
--- /dev/null
+From dc741a7e0e3f40c7ab899861f2e02b5e6505b50d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 May 2023 15:22:15 +0800
+Subject: md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 34817a2441747b48e444cb0e05d84e14bc9443da ]
+
+There are two check of 'mreplace' in raid10_sync_request(). In the first
+check, 'need_replace' will be set and 'mreplace' will be used later if
+no-Faulty 'mreplace' exists, In the second check, 'mreplace' will be
+set to NULL if it is Faulty, but 'need_replace' will not be changed
+accordingly. null-ptr-deref occurs if Faulty is set between two check.
+
+Fix it by merging two checks into one. And replace 'need_replace' with
+'mreplace' because their values are always the same.
+
+Fixes: ee37d7314a32 ("md/raid10: Fix raid10 replace hang when new added disk faulty")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230527072218.2365857-2-linan666@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 67398394cc9c9..0eb2eb83ddb9e 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3436,7 +3436,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
+ int must_sync;
+ int any_working;
+ int need_recover = 0;
+- int need_replace = 0;
+ struct raid10_info *mirror = &conf->mirrors[i];
+ struct md_rdev *mrdev, *mreplace;
+
+@@ -3448,11 +3447,10 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
+ !test_bit(Faulty, &mrdev->flags) &&
+ !test_bit(In_sync, &mrdev->flags))
+ need_recover = 1;
+- if (mreplace != NULL &&
+- !test_bit(Faulty, &mreplace->flags))
+- need_replace = 1;
++ if (mreplace && test_bit(Faulty, &mreplace->flags))
++ mreplace = NULL;
+
+- if (!need_recover && !need_replace) {
++ if (!need_recover && !mreplace) {
+ rcu_read_unlock();
+ continue;
+ }
+@@ -3468,8 +3466,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
+ rcu_read_unlock();
+ continue;
+ }
+- if (mreplace && test_bit(Faulty, &mreplace->flags))
+- mreplace = NULL;
+ /* Unless we are doing a full sync, or a replacement
+ * we only need to recover the block if it is set in
+ * the bitmap
+@@ -3592,11 +3588,11 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
+ bio = r10_bio->devs[1].repl_bio;
+ if (bio)
+ bio->bi_end_io = NULL;
+- /* Note: if need_replace, then bio
++ /* Note: if replace is not NULL, then bio
+ * cannot be NULL as r10buf_pool_alloc will
+ * have allocated it.
+ */
+- if (!need_replace)
++ if (!mreplace)
+ break;
+ bio->bi_next = biolist;
+ biolist = bio;
+--
+2.39.2
+
--- /dev/null
+From 548a23eca974abb9b8ee85fcad94e9c5a0c43b4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 May 2023 15:25:33 +0800
+Subject: md/raid10: fix overflow of md/safe_mode_delay
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 6beb489b2eed25978523f379a605073f99240c50 ]
+
+There is no input check when echo md/safe_mode_delay in safe_delay_store().
+And msec might also overflow when HZ < 1000 in safe_delay_show(), Fix it by
+checking overflow in safe_delay_store() and use unsigned long conversion in
+safe_delay_show().
+
+Fixes: 72e02075a33f ("md: factor out parsing of fixed-point numbers")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230522072535.1523740-2-linan666@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index bb73a541bb193..0c97531d35038 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -3830,8 +3830,9 @@ int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale)
+ static ssize_t
+ safe_delay_show(struct mddev *mddev, char *page)
+ {
+- int msec = (mddev->safemode_delay*1000)/HZ;
+- return sprintf(page, "%d.%03d\n", msec/1000, msec%1000);
++ unsigned int msec = ((unsigned long)mddev->safemode_delay*1000)/HZ;
++
++ return sprintf(page, "%u.%03u\n", msec/1000, msec%1000);
+ }
+ static ssize_t
+ safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len)
+@@ -3843,7 +3844,7 @@ safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len)
+ return -EINVAL;
+ }
+
+- if (strict_strtoul_scaled(cbuf, &msec, 3) < 0)
++ if (strict_strtoul_scaled(cbuf, &msec, 3) < 0 || msec > UINT_MAX / HZ)
+ return -EINVAL;
+ if (msec == 0)
+ mddev->safemode_delay = 0;
+--
+2.39.2
+
--- /dev/null
+From 88ef16eebb72999150fd7bdce4407a6aff3c430e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 May 2023 15:25:34 +0800
+Subject: md/raid10: fix wrong setting of max_corr_read_errors
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit f8b20a405428803bd9881881d8242c9d72c6b2b2 ]
+
+There is no input check when echo md/max_read_errors and overflow might
+occur. Add check of input number.
+
+Fixes: 1e50915fe0bb ("raid: improve MD/raid10 handling of correctable read errors.")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230522072535.1523740-3-linan666@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 0c97531d35038..829e1bd9bcbf9 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -4513,6 +4513,8 @@ max_corrected_read_errors_store(struct mddev *mddev, const char *buf, size_t len
+ rv = kstrtouint(buf, 10, &n);
+ if (rv < 0)
+ return rv;
++ if (n > INT_MAX)
++ return -EINVAL;
+ atomic_set(&mddev->max_corr_read_errors, n);
+ return len;
+ }
+--
+2.39.2
+
--- /dev/null
+From e169f7e89d2c82fd6baf145613ef3e8e308cff11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 May 2023 13:29:31 +0200
+Subject: memory: brcmstb_dpfe: fix testing array offset after use
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 1d9e93fad549bc38f593147479ee063f2872c170 ]
+
+Code should first check for valid value of array offset, then use it as
+the index. Fixes smatch warning:
+
+ drivers/memory/brcmstb_dpfe.c:443 __send_command() error: testing array offset 'cmd' after use.
+
+Fixes: 2f330caff577 ("memory: brcmstb: Add driver for DPFE")
+Acked-by: Markus Mayer <mmayer@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://lore.kernel.org/r/20230513112931.176066-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/brcmstb_dpfe.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
+index 76c82e9c8fceb..9339f80b21c50 100644
+--- a/drivers/memory/brcmstb_dpfe.c
++++ b/drivers/memory/brcmstb_dpfe.c
+@@ -434,15 +434,17 @@ static void __finalize_command(struct brcmstb_dpfe_priv *priv)
+ static int __send_command(struct brcmstb_dpfe_priv *priv, unsigned int cmd,
+ u32 result[])
+ {
+- const u32 *msg = priv->dpfe_api->command[cmd];
+ void __iomem *regs = priv->regs;
+ unsigned int i, chksum, chksum_idx;
++ const u32 *msg;
+ int ret = 0;
+ u32 resp;
+
+ if (cmd >= DPFE_CMD_MAX)
+ return -1;
+
++ msg = priv->dpfe_api->command[cmd];
++
+ mutex_lock(&priv->lock);
+
+ /* Wait for DCPU to become ready */
+--
+2.39.2
+
--- /dev/null
+From dea0440665944b1736f1d4a44b3960d586aac44f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 22:27:04 +0200
+Subject: memstick r592: make memstick_debug_get_tpc_name() static
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 434587df9f7fd68575f99a889cc5f2efc2eaee5e ]
+
+There are no other files referencing this function, apparently
+it was left global to avoid an 'unused function' warning when
+the only caller is left out. With a 'W=1' build, it causes
+a 'missing prototype' warning though:
+
+drivers/memstick/host/r592.c:47:13: error: no previous prototype for 'memstick_debug_get_tpc_name' [-Werror=missing-prototypes]
+
+Annotate the function as 'static __maybe_unused' to avoid both
+problems.
+
+Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20230516202714.560929-1-arnd@kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/host/r592.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
+index 42bfc46842b82..461f5ffd02bc1 100644
+--- a/drivers/memstick/host/r592.c
++++ b/drivers/memstick/host/r592.c
+@@ -44,12 +44,10 @@ static const char *tpc_names[] = {
+ * memstick_debug_get_tpc_name - debug helper that returns string for
+ * a TPC number
+ */
+-const char *memstick_debug_get_tpc_name(int tpc)
++static __maybe_unused const char *memstick_debug_get_tpc_name(int tpc)
+ {
+ return tpc_names[tpc-1];
+ }
+-EXPORT_SYMBOL(memstick_debug_get_tpc_name);
+-
+
+ /* Read a register*/
+ static inline u32 r592_read_reg(struct r592_device *dev, int address)
+--
+2.39.2
+
--- /dev/null
+From bfb66726b6abc83dcca11250f5a095ad9aca914c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 16:56:36 +0200
+Subject: MIPS: DTS: CI20: Add parent supplies to ACT8600 regulators
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit fbf1e42093f8d6346baf17079585fbcebb2ff284 ]
+
+Provide parent regulators to the ACT8600 regulators that need one.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Stable-dep-of: 944520f85d5b ("MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/ingenic/ci20.dts | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts
+index 994c7ebfddc80..0da8182698e36 100644
+--- a/arch/mips/boot/dts/ingenic/ci20.dts
++++ b/arch/mips/boot/dts/ingenic/ci20.dts
+@@ -242,16 +242,19 @@ regulators {
+ vddcore: DCDC1 {
+ regulator-min-microvolt = <1100000>;
+ regulator-max-microvolt = <1100000>;
++ vp1-supply = <&vcc_33v>;
+ regulator-always-on;
+ };
+ vddmem: DCDC2 {
+ regulator-min-microvolt = <1500000>;
+ regulator-max-microvolt = <1500000>;
++ vp2-supply = <&vcc_33v>;
+ regulator-always-on;
+ };
+ vcc_33: DCDC3 {
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
++ vp3-supply = <&vcc_33v>;
+ regulator-always-on;
+ };
+ vcc_50: SUDCDC_REG4 {
+@@ -262,21 +265,25 @@ vcc_50: SUDCDC_REG4 {
+ vcc_25: LDO5 {
+ regulator-min-microvolt = <2500000>;
+ regulator-max-microvolt = <2500000>;
++ inl-supply = <&vcc_33v>;
+ regulator-always-on;
+ };
+ wifi_io: LDO6 {
+ regulator-min-microvolt = <2500000>;
+ regulator-max-microvolt = <2500000>;
++ inl-supply = <&vcc_33v>;
+ regulator-always-on;
+ };
+ cim_io_28: LDO7 {
+ regulator-min-microvolt = <2800000>;
+ regulator-max-microvolt = <2800000>;
++ inl-supply = <&vcc_33v>;
+ regulator-always-on;
+ };
+ cim_io_15: LDO8 {
+ regulator-min-microvolt = <1500000>;
+ regulator-max-microvolt = <1500000>;
++ inl-supply = <&vcc_33v>;
+ regulator-always-on;
+ };
+ vrtc_18: LDO_REG9 {
+--
+2.39.2
+
--- /dev/null
+From 22800b93383156a4c30e421edc2bce1df81ab8c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 16:56:35 +0200
+Subject: MIPS: DTS: CI20: Fix ACT8600 regulator node names
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 08384e80a70fb1942510ab5f0ce27bad134e634e ]
+
+The Device Tree was using invalid node names for the ACT8600 regulators.
+To be fair, it is not the original committer's fault, as the
+documentation did gives invalid names as well.
+
+In theory, the fix should have been to modify the driver to accept the
+alternative names. However, even though the act8865 driver spits
+warnings, the kernel seemed to work fine with what is currently
+supported upstream. For that reason, I think it is okay to just update
+the DTS.
+
+I removed the "regulator-name" too, since they really didn't bring any
+information. The node names are enough.
+
+Fixes: 73f2b940474d ("MIPS: CI20: DTS: Add I2C nodes")
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/ingenic/ci20.dts | 27 ++++++++-------------------
+ 1 file changed, 8 insertions(+), 19 deletions(-)
+
+diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts
+index 8f21d2304737c..994c7ebfddc80 100644
+--- a/arch/mips/boot/dts/ingenic/ci20.dts
++++ b/arch/mips/boot/dts/ingenic/ci20.dts
+@@ -237,59 +237,49 @@ &i2c0 {
+ act8600: act8600@5a {
+ compatible = "active-semi,act8600";
+ reg = <0x5a>;
+- status = "okay";
+
+ regulators {
+- vddcore: SUDCDC1 {
+- regulator-name = "DCDC_REG1";
++ vddcore: DCDC1 {
+ regulator-min-microvolt = <1100000>;
+ regulator-max-microvolt = <1100000>;
+ regulator-always-on;
+ };
+- vddmem: SUDCDC2 {
+- regulator-name = "DCDC_REG2";
++ vddmem: DCDC2 {
+ regulator-min-microvolt = <1500000>;
+ regulator-max-microvolt = <1500000>;
+ regulator-always-on;
+ };
+- vcc_33: SUDCDC3 {
+- regulator-name = "DCDC_REG3";
++ vcc_33: DCDC3 {
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+ regulator-always-on;
+ };
+- vcc_50: SUDCDC4 {
+- regulator-name = "SUDCDC_REG4";
++ vcc_50: SUDCDC_REG4 {
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+ regulator-always-on;
+ };
+- vcc_25: LDO_REG5 {
+- regulator-name = "LDO_REG5";
++ vcc_25: LDO5 {
+ regulator-min-microvolt = <2500000>;
+ regulator-max-microvolt = <2500000>;
+ regulator-always-on;
+ };
+- wifi_io: LDO_REG6 {
+- regulator-name = "LDO_REG6";
++ wifi_io: LDO6 {
+ regulator-min-microvolt = <2500000>;
+ regulator-max-microvolt = <2500000>;
+ regulator-always-on;
+ };
+- vcc_28: LDO_REG7 {
+- regulator-name = "LDO_REG7";
++ cim_io_28: LDO7 {
+ regulator-min-microvolt = <2800000>;
+ regulator-max-microvolt = <2800000>;
+ regulator-always-on;
+ };
+- vcc_15: LDO_REG8 {
+- regulator-name = "LDO_REG8";
++ cim_io_15: LDO8 {
+ regulator-min-microvolt = <1500000>;
+ regulator-max-microvolt = <1500000>;
+ regulator-always-on;
+ };
+ vrtc_18: LDO_REG9 {
+- regulator-name = "LDO_REG9";
+ /* Despite the datasheet stating 3.3V
+ * for REG9 and the driver expecting that,
+ * REG9 outputs 1.8V.
+@@ -303,7 +293,6 @@ vrtc_18: LDO_REG9 {
+ regulator-always-on;
+ };
+ vcc_11: LDO_REG10 {
+- regulator-name = "LDO_REG10";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <1200000>;
+ regulator-always-on;
+--
+2.39.2
+
--- /dev/null
+From 4e09d8e67aecb3958787b56bc17a193de5f9a5e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 19:59:34 +0200
+Subject: MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 944520f85d5b1fb2f9ea243be41f9c9af3d4cef3 ]
+
+Commit 08384e80a70f ("MIPS: DTS: CI20: Fix ACT8600 regulator node
+names") caused the VDDCORE power supply (regulated by the ACT8600's
+DCDC1 output) to drop from a voltage of 1.2V configured by the
+bootloader, to the 1.1V set in the Device Tree.
+
+According to the documentation, the VDDCORE supply should be between
+0.99V and 1.21V; both values are therefore within the supported range.
+
+However, VDDCORE being 1.1V results in the CI20 being very unstable,
+with corrupted memory, failures to boot, or reboots at random. The
+reason might be succint drops of the voltage below the minimum required.
+
+Raising the minimum voltage to 1.125 volts seems to be enough to address
+this issue, while still keeping a relatively low core voltage which
+helps for power consumption and thermals.
+
+Fixes: 08384e80a70f ("MIPS: DTS: CI20: Fix ACT8600 regulator node names")
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/ingenic/ci20.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts
+index 0da8182698e36..6a179e0322c59 100644
+--- a/arch/mips/boot/dts/ingenic/ci20.dts
++++ b/arch/mips/boot/dts/ingenic/ci20.dts
+@@ -240,8 +240,8 @@ act8600: act8600@5a {
+
+ regulators {
+ vddcore: DCDC1 {
+- regulator-min-microvolt = <1100000>;
+- regulator-max-microvolt = <1100000>;
++ regulator-min-microvolt = <1125000>;
++ regulator-max-microvolt = <1125000>;
+ vp1-supply = <&vcc_33v>;
+ regulator-always-on;
+ };
+--
+2.39.2
+
--- /dev/null
+From a9fb646dc55f1e08aa01917af99818efd6bfa78f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 12:27:13 +0200
+Subject: mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from
+ 11/2019
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit c467c8f081859d4f4ca4eee4fba54bb5d85d6c97 ]
+
+This microSD card never clears Flush Cache bit after cache flush has
+been started in sd_flush_cache(). This leads e.g. to failure to mount
+file system. Add a quirk which disables the SD cache for this specific
+card from specific manufacturing date of 11/2019, since on newer dated
+cards from 05/2023 the cache flush works correctly.
+
+Fixes: 08ebf903af57 ("mmc: core: Fixup support for writeback-cache for eMMC and SD")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Link: https://lore.kernel.org/r/20230620102713.7701-1-marex@denx.de
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/card.h | 30 +++++++++++++++++++++++-------
+ drivers/mmc/core/quirks.h | 13 +++++++++++++
+ drivers/mmc/core/sd.c | 2 +-
+ include/linux/mmc/card.h | 1 +
+ 4 files changed, 38 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
+index cfdd1ff40b865..4edf9057fa79d 100644
+--- a/drivers/mmc/core/card.h
++++ b/drivers/mmc/core/card.h
+@@ -53,6 +53,10 @@ struct mmc_fixup {
+ unsigned int manfid;
+ unsigned short oemid;
+
++ /* Manufacturing date */
++ unsigned short year;
++ unsigned char month;
++
+ /* SDIO-specific fields. You can use SDIO_ANY_ID here of course */
+ u16 cis_vendor, cis_device;
+
+@@ -68,6 +72,8 @@ struct mmc_fixup {
+
+ #define CID_MANFID_ANY (-1u)
+ #define CID_OEMID_ANY ((unsigned short) -1)
++#define CID_YEAR_ANY ((unsigned short) -1)
++#define CID_MONTH_ANY ((unsigned char) -1)
+ #define CID_NAME_ANY (NULL)
+
+ #define EXT_CSD_REV_ANY (-1u)
+@@ -81,17 +87,21 @@ struct mmc_fixup {
+ #define CID_MANFID_APACER 0x27
+ #define CID_MANFID_KINGSTON 0x70
+ #define CID_MANFID_HYNIX 0x90
++#define CID_MANFID_KINGSTON_SD 0x9F
+ #define CID_MANFID_NUMONYX 0xFE
+
+ #define END_FIXUP { NULL }
+
+-#define _FIXUP_EXT(_name, _manfid, _oemid, _rev_start, _rev_end, \
+- _cis_vendor, _cis_device, \
+- _fixup, _data, _ext_csd_rev) \
++#define _FIXUP_EXT(_name, _manfid, _oemid, _year, _month, \
++ _rev_start, _rev_end, \
++ _cis_vendor, _cis_device, \
++ _fixup, _data, _ext_csd_rev) \
+ { \
+ .name = (_name), \
+ .manfid = (_manfid), \
+ .oemid = (_oemid), \
++ .year = (_year), \
++ .month = (_month), \
+ .rev_start = (_rev_start), \
+ .rev_end = (_rev_end), \
+ .cis_vendor = (_cis_vendor), \
+@@ -103,8 +113,8 @@ struct mmc_fixup {
+
+ #define MMC_FIXUP_REV(_name, _manfid, _oemid, _rev_start, _rev_end, \
+ _fixup, _data, _ext_csd_rev) \
+- _FIXUP_EXT(_name, _manfid, \
+- _oemid, _rev_start, _rev_end, \
++ _FIXUP_EXT(_name, _manfid, _oemid, CID_YEAR_ANY, CID_MONTH_ANY, \
++ _rev_start, _rev_end, \
+ SDIO_ANY_ID, SDIO_ANY_ID, \
+ _fixup, _data, _ext_csd_rev) \
+
+@@ -118,8 +128,9 @@ struct mmc_fixup {
+ _ext_csd_rev)
+
+ #define SDIO_FIXUP(_vendor, _device, _fixup, _data) \
+- _FIXUP_EXT(CID_NAME_ANY, CID_MANFID_ANY, \
+- CID_OEMID_ANY, 0, -1ull, \
++ _FIXUP_EXT(CID_NAME_ANY, CID_MANFID_ANY, CID_OEMID_ANY, \
++ CID_YEAR_ANY, CID_MONTH_ANY, \
++ 0, -1ull, \
+ _vendor, _device, \
+ _fixup, _data, EXT_CSD_REV_ANY) \
+
+@@ -264,4 +275,9 @@ static inline int mmc_card_broken_sd_discard(const struct mmc_card *c)
+ return c->quirks & MMC_QUIRK_BROKEN_SD_DISCARD;
+ }
+
++static inline int mmc_card_broken_sd_cache(const struct mmc_card *c)
++{
++ return c->quirks & MMC_QUIRK_BROKEN_SD_CACHE;
++}
++
+ #endif
+diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
+index 29b9497936df9..a7ffbc930ea9d 100644
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -53,6 +53,15 @@ static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = {
+ MMC_FIXUP("MMC32G", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc,
+ MMC_QUIRK_BLK_NO_CMD23),
+
++ /*
++ * Kingston Canvas Go! Plus microSD cards never finish SD cache flush.
++ * This has so far only been observed on cards from 11/2019, while new
++ * cards from 2023/05 do not exhibit this behavior.
++ */
++ _FIXUP_EXT("SD64G", CID_MANFID_KINGSTON_SD, 0x5449, 2019, 11,
++ 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++ MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
++
+ /*
+ * Some SD cards lockup while using CMD23 multiblock transfers.
+ */
+@@ -209,6 +218,10 @@ static inline void mmc_fixup_device(struct mmc_card *card,
+ if (f->of_compatible &&
+ !mmc_fixup_of_compatible_match(card, f->of_compatible))
+ continue;
++ if (f->year != CID_YEAR_ANY && f->year != card->cid.year)
++ continue;
++ if (f->month != CID_MONTH_ANY && f->month != card->cid.month)
++ continue;
+
+ dev_dbg(&card->dev, "calling %ps\n", f->vendor_fixup);
+ f->vendor_fixup(card, f->data);
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index 72b664ed90cf6..246ce027ae0aa 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1170,7 +1170,7 @@ static int sd_parse_ext_reg_perf(struct mmc_card *card, u8 fno, u8 page,
+ card->ext_perf.feature_support |= SD_EXT_PERF_HOST_MAINT;
+
+ /* Cache support at bit 0. */
+- if (reg_buf[4] & BIT(0))
++ if ((reg_buf[4] & BIT(0)) && !mmc_card_broken_sd_cache(card))
+ card->ext_perf.feature_support |= SD_EXT_PERF_CACHE;
+
+ /* Command queue support indicated via queue depth bits (0 to 4). */
+diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
+index c726ea7812552..daa2f40d9ce65 100644
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -294,6 +294,7 @@ struct mmc_card {
+ #define MMC_QUIRK_TRIM_BROKEN (1<<12) /* Skip trim */
+ #define MMC_QUIRK_BROKEN_HPI (1<<13) /* Disable broken HPI support */
+ #define MMC_QUIRK_BROKEN_SD_DISCARD (1<<14) /* Disable broken SD discard support */
++#define MMC_QUIRK_BROKEN_SD_CACHE (1<<15) /* Disable broken SD cache support */
+
+ bool reenable_cmdq; /* Re-enable Command Queue */
+
+--
+2.39.2
+
--- /dev/null
+From 5826b701c871b884f2c7137e69ed2b2eccfa4d24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 May 2023 06:44:54 -0700
+Subject: mmc: mediatek: Avoid ugly error message when SDIO wakeup IRQ isn't
+ used
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit a3332b7aad346b14770797e03ddd02ebdb14db41 ]
+
+When I boot a kukui-kodama board, I see an ugly warning in my kernel
+log:
+ mtk-msdc 11240000.mmc: error -ENXIO: IRQ sdio_wakeup not found
+
+It's pretty normal not to have an "sdio_wakeup" IRQ defined. In fact,
+no device trees in mainline seem to have it. Let's use the
+platform_get_irq_byname_optional() to avoid the error message.
+
+Fixes: 527f36f5efa4 ("mmc: mediatek: add support for SDIO eint wakup IRQ")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Link: https://lore.kernel.org/r/20230510064434.1.I935404c5396e6bf952e99bb7ffb744c6f7fd430b@changeid
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/mtk-sd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index 425efb3fba048..1a0d4dc24717c 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -2685,7 +2685,7 @@ static int msdc_drv_probe(struct platform_device *pdev)
+
+ /* Support for SDIO eint irq ? */
+ if ((mmc->pm_caps & MMC_PM_WAKE_SDIO_IRQ) && (mmc->pm_caps & MMC_PM_KEEP_POWER)) {
+- host->eint_irq = platform_get_irq_byname(pdev, "sdio_wakeup");
++ host->eint_irq = platform_get_irq_byname_optional(pdev, "sdio_wakeup");
+ if (host->eint_irq > 0) {
+ host->pins_eint = pinctrl_lookup_state(host->pinctrl, "state_eint");
+ if (IS_ERR(host->pins_eint)) {
+--
+2.39.2
+
--- /dev/null
+From ea73218c3ea9b849e42724c78ac6eb1bcb108aed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jun 2023 11:23:40 +0300
+Subject: modpost: fix off by one in is_executable_section()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 3a3f1e573a105328a2cca45a7cfbebabbf5e3192 ]
+
+The > comparison should be >= to prevent an out of bounds array
+access.
+
+Fixes: 52dc0595d540 ("modpost: handle relocations mismatch in __ex_table.")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 9e370e77f52d1..e6be7fc2625fd 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1297,7 +1297,7 @@ static void default_mismatch_handler(const char *modname, struct elf_info *elf,
+
+ static int is_executable_section(struct elf_info* elf, unsigned int section_index)
+ {
+- if (section_index > elf->num_sections)
++ if (section_index >= elf->num_sections)
+ fatal("section_index is outside elf->num_sections!\n");
+
+ return ((elf->sechdrs[section_index].sh_flags & SHF_EXECINSTR) == SHF_EXECINSTR);
+--
+2.39.2
+
--- /dev/null
+From 1e508ab222e42e219baaa3aff1846db50f823f7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 21:09:56 +0900
+Subject: modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 56a24b8ce6a7f9c4a21b2276a8644f6f3d8fc14d ]
+
+addend_arm_rel() processes R_ARM_PC24, R_ARM_CALL, R_ARM_JUMP24 in a
+wrong way.
+
+Here, test code.
+
+[test code for R_ARM_JUMP24]
+
+ .section .init.text,"ax"
+ bar:
+ bx lr
+
+ .section .text,"ax"
+ .globl foo
+ foo:
+ b bar
+
+[test code for R_ARM_CALL]
+
+ .section .init.text,"ax"
+ bar:
+ bx lr
+
+ .section .text,"ax"
+ .globl foo
+ foo:
+ push {lr}
+ bl bar
+ pop {pc}
+
+If you compile it with ARM multi_v7_defconfig, modpost will show the
+symbol name, (unknown).
+
+ WARNING: modpost: vmlinux.o: section mismatch in reference: foo (section: .text) -> (unknown) (section: .init.text)
+
+(You need to use GNU linker instead of LLD to reproduce it.)
+
+Fix the code to make modpost show the correct symbol name.
+
+I imported (with adjustment) sign_extend32() from include/linux/bitops.h.
+
+The '+8' is the compensation for pc-relative instruction. It is
+documented in "ELF for the Arm Architecture" [1].
+
+ "If the relocation is pc-relative then compensation for the PC bias
+ (the PC value is 8 bytes ahead of the executing instruction in Arm
+ state and 4 bytes in Thumb state) must be encoded in the relocation
+ by the object producer."
+
+[1]: https://github.com/ARM-software/abi-aa/blob/main/aaelf32/aaelf32.rst
+
+Fixes: 56a974fa2d59 ("kbuild: make better section mismatch reports on arm")
+Fixes: 6e2e340b59d2 ("ARM: 7324/1: modpost: Fix section warnings for ARM for many compilers")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index f7a67f111d846..9e370e77f52d1 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1419,12 +1419,20 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
+ #define R_ARM_THM_JUMP19 51
+ #endif
+
++static int32_t sign_extend32(int32_t value, int index)
++{
++ uint8_t shift = 31 - index;
++
++ return (int32_t)(value << shift) >> shift;
++}
++
+ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
+ {
+ unsigned int r_typ = ELF_R_TYPE(r->r_info);
+ Elf_Sym *sym = elf->symtab_start + ELF_R_SYM(r->r_info);
+ void *loc = reloc_location(elf, sechdr, r);
+ uint32_t inst;
++ int32_t offset;
+
+ switch (r_typ) {
+ case R_ARM_ABS32:
+@@ -1434,6 +1442,10 @@ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
+ case R_ARM_PC24:
+ case R_ARM_CALL:
+ case R_ARM_JUMP24:
++ inst = TO_NATIVE(*(uint32_t *)loc);
++ offset = sign_extend32((inst & 0x00ffffff) << 2, 25);
++ r->r_addend = offset + sym->st_value + 8;
++ break;
+ case R_ARM_THM_CALL:
+ case R_ARM_THM_JUMP24:
+ case R_ARM_THM_JUMP19:
+--
+2.39.2
+
--- /dev/null
+From 6a60909d7801814c56ce0d16f31130286ce011da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 21:09:55 +0900
+Subject: modpost: fix section mismatch message for R_ARM_ABS32
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit b7c63520f6703a25eebb4f8138fed764fcae1c6f ]
+
+addend_arm_rel() processes R_ARM_ABS32 in a wrong way.
+
+Here, test code.
+
+ [test code 1]
+
+ #include <linux/init.h>
+
+ int __initdata foo;
+ int get_foo(void) { return foo; }
+
+If you compile it with ARM versatile_defconfig, modpost will show the
+symbol name, (unknown).
+
+ WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> (unknown) (section: .init.data)
+
+(You need to use GNU linker instead of LLD to reproduce it.)
+
+If you compile it for other architectures, modpost will show the correct
+symbol name.
+
+ WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> foo (section: .init.data)
+
+For R_ARM_ABS32, addend_arm_rel() sets r->r_addend to a wrong value.
+
+I just mimicked the code in arch/arm/kernel/module.c.
+
+However, there is more difficulty for ARM.
+
+Here, test code.
+
+ [test code 2]
+
+ #include <linux/init.h>
+
+ int __initdata foo;
+ int get_foo(void) { return foo; }
+
+ int __initdata bar;
+ int get_bar(void) { return bar; }
+
+With this commit applied, modpost will show the following messages
+for ARM versatile_defconfig:
+
+ WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> foo (section: .init.data)
+ WARNING: modpost: vmlinux.o: section mismatch in reference: get_bar (section: .text) -> foo (section: .init.data)
+
+The reference from 'get_bar' to 'foo' seems wrong.
+
+I have no solution for this because it is true in assembly level.
+
+In the following output, relocation at 0x1c is no longer associated
+with 'bar'. The two relocation entries point to the same symbol, and
+the offset to 'bar' is encoded in the instruction 'r0, [r3, #4]'.
+
+ Disassembly of section .text:
+
+ 00000000 <get_foo>:
+ 0: e59f3004 ldr r3, [pc, #4] @ c <get_foo+0xc>
+ 4: e5930000 ldr r0, [r3]
+ 8: e12fff1e bx lr
+ c: 00000000 .word 0x00000000
+
+ 00000010 <get_bar>:
+ 10: e59f3004 ldr r3, [pc, #4] @ 1c <get_bar+0xc>
+ 14: e5930004 ldr r0, [r3, #4]
+ 18: e12fff1e bx lr
+ 1c: 00000000 .word 0x00000000
+
+ Relocation section '.rel.text' at offset 0x244 contains 2 entries:
+ Offset Info Type Sym.Value Sym. Name
+ 0000000c 00000c02 R_ARM_ABS32 00000000 .init.data
+ 0000001c 00000c02 R_ARM_ABS32 00000000 .init.data
+
+When find_elf_symbol() gets into a situation where relsym->st_name is
+zero, there is no guarantee to get the symbol name as written in C.
+
+I am keeping the current logic because it is useful in many architectures,
+but the symbol name is not always correct depending on the optimization.
+I left some comments in find_tosym().
+
+Fixes: 56a974fa2d59 ("kbuild: make better section mismatch reports on arm")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index d08cf73e4a3ff..f7a67f111d846 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1157,6 +1157,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
+ if (relsym->st_name != 0)
+ return relsym;
+
++ /*
++ * Strive to find a better symbol name, but the resulting name may not
++ * match the symbol referenced in the original code.
++ */
+ relsym_secindex = get_secindex(elf, relsym);
+ for (sym = elf->symtab_start; sym < elf->symtab_stop; sym++) {
+ if (get_secindex(elf, sym) != relsym_secindex)
+@@ -1418,12 +1422,14 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
+ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
+ {
+ unsigned int r_typ = ELF_R_TYPE(r->r_info);
++ Elf_Sym *sym = elf->symtab_start + ELF_R_SYM(r->r_info);
++ void *loc = reloc_location(elf, sechdr, r);
++ uint32_t inst;
+
+ switch (r_typ) {
+ case R_ARM_ABS32:
+- /* From ARM ABI: (S + A) | T */
+- r->r_addend = (int)(long)
+- (elf->symtab_start + ELF_R_SYM(r->r_info));
++ inst = TO_NATIVE(*(uint32_t *)loc);
++ r->r_addend = inst + sym->st_value;
+ break;
+ case R_ARM_PC24:
+ case R_ARM_CALL:
+--
+2.39.2
+
--- /dev/null
+From 4ac55579ea380759c370329f63fe0f099c6ab699 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 00:27:19 +0900
+Subject: modpost: remove broken calculation of exception_table_entry size
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit d0acc76a49aa917c1a455d11d32d34a01e8b2835 ]
+
+find_extable_entry_size() is completely broken. It has awesome comments
+about how to calculate sizeof(struct exception_table_entry).
+
+It was based on these assumptions:
+
+ - struct exception_table_entry has two fields
+ - both of the fields have the same size
+
+Then, we came up with this equation:
+
+ (offset of the second field) * 2 == (size of struct)
+
+It was true for all architectures when commit 52dc0595d540 ("modpost:
+handle relocations mismatch in __ex_table.") was applied.
+
+Our mathematics broke when commit 548acf19234d ("x86/mm: Expand the
+exception table logic to allow new handling options") introduced the
+third field.
+
+Now, the definition of exception_table_entry is highly arch-dependent.
+
+For x86, sizeof(struct exception_table_entry) is apparently 12, but
+find_extable_entry_size() sets extable_entry_size to 8.
+
+I could fix it, but I do not see much value in this code.
+
+extable_entry_size is used just for selecting a slightly different
+error message.
+
+If the first field ("insn") references to a non-executable section,
+
+ The relocation at %s+0x%lx references
+ section "%s" which is not executable, IOW
+ it is not possible for the kernel to fault
+ at that address. Something is seriously wrong
+ and should be fixed.
+
+If the second field ("fixup") references to a non-executable section,
+
+ The relocation at %s+0x%lx references
+ section "%s" which is not executable, IOW
+ the kernel will fault if it ever tries to
+ jump to it. Something is seriously wrong
+ and should be fixed.
+
+Merge the two error messages rather than adding even more complexity.
+
+Change fatal() to error() to make it continue running and catch more
+possible errors.
+
+Fixes: 548acf19234d ("x86/mm: Expand the exception table logic to allow new handling options")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 60 +++----------------------------------------
+ 1 file changed, 3 insertions(+), 57 deletions(-)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 1dfa80c6b471e..d08cf73e4a3ff 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1299,43 +1299,6 @@ static int is_executable_section(struct elf_info* elf, unsigned int section_inde
+ return ((elf->sechdrs[section_index].sh_flags & SHF_EXECINSTR) == SHF_EXECINSTR);
+ }
+
+-/*
+- * We rely on a gross hack in section_rel[a]() calling find_extable_entry_size()
+- * to know the sizeof(struct exception_table_entry) for the target architecture.
+- */
+-static unsigned int extable_entry_size = 0;
+-static void find_extable_entry_size(const char* const sec, const Elf_Rela* r)
+-{
+- /*
+- * If we're currently checking the second relocation within __ex_table,
+- * that relocation offset tells us the offsetof(struct
+- * exception_table_entry, fixup) which is equal to sizeof(struct
+- * exception_table_entry) divided by two. We use that to our advantage
+- * since there's no portable way to get that size as every architecture
+- * seems to go with different sized types. Not pretty but better than
+- * hard-coding the size for every architecture..
+- */
+- if (!extable_entry_size)
+- extable_entry_size = r->r_offset * 2;
+-}
+-
+-static inline bool is_extable_fault_address(Elf_Rela *r)
+-{
+- /*
+- * extable_entry_size is only discovered after we've handled the
+- * _second_ relocation in __ex_table, so only abort when we're not
+- * handling the first reloc and extable_entry_size is zero.
+- */
+- if (r->r_offset && extable_entry_size == 0)
+- fatal("extable_entry size hasn't been discovered!\n");
+-
+- return ((r->r_offset == 0) ||
+- (r->r_offset % extable_entry_size == 0));
+-}
+-
+-#define is_second_extable_reloc(Start, Cur, Sec) \
+- (((Cur) == (Start) + 1) && (strcmp("__ex_table", (Sec)) == 0))
+-
+ static void report_extable_warnings(const char* modname, struct elf_info* elf,
+ const struct sectioncheck* const mismatch,
+ Elf_Rela* r, Elf_Sym* sym,
+@@ -1392,22 +1355,9 @@ static void extable_mismatch_handler(const char* modname, struct elf_info *elf,
+ "You might get more information about where this is\n"
+ "coming from by using scripts/check_extable.sh %s\n",
+ fromsec, (long)r->r_offset, tosec, modname);
+- else if (!is_executable_section(elf, get_secindex(elf, sym))) {
+- if (is_extable_fault_address(r))
+- fatal("The relocation at %s+0x%lx references\n"
+- "section \"%s\" which is not executable, IOW\n"
+- "it is not possible for the kernel to fault\n"
+- "at that address. Something is seriously wrong\n"
+- "and should be fixed.\n",
+- fromsec, (long)r->r_offset, tosec);
+- else
+- fatal("The relocation at %s+0x%lx references\n"
+- "section \"%s\" which is not executable, IOW\n"
+- "the kernel will fault if it ever tries to\n"
+- "jump to it. Something is seriously wrong\n"
+- "and should be fixed.\n",
+- fromsec, (long)r->r_offset, tosec);
+- }
++ else if (!is_executable_section(elf, get_secindex(elf, sym)))
++ error("%s+0x%lx references non-executable section '%s'\n",
++ fromsec, (long)r->r_offset, tosec);
+ }
+
+ static void check_section_mismatch(const char *modname, struct elf_info *elf,
+@@ -1569,8 +1519,6 @@ static void section_rela(const char *modname, struct elf_info *elf,
+ /* Skip special sections */
+ if (is_shndx_special(sym->st_shndx))
+ continue;
+- if (is_second_extable_reloc(start, rela, fromsec))
+- find_extable_entry_size(fromsec, &r);
+ check_section_mismatch(modname, elf, &r, sym, fromsec);
+ }
+ }
+@@ -1628,8 +1576,6 @@ static void section_rel(const char *modname, struct elf_info *elf,
+ /* Skip special sections */
+ if (is_shndx_special(sym->st_shndx))
+ continue;
+- if (is_second_extable_reloc(start, rel, fromsec))
+- find_extable_entry_size(fromsec, &r);
+ check_section_mismatch(modname, elf, &r, sym, fromsec);
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 174b20818df9f634a03ef1807c71544dab66d513 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 22:22:45 +0300
+Subject: net: axienet: Move reset before 64-bit DMA detection
+
+From: Maxim Kochetkov <fido_max@inbox.ru>
+
+[ Upstream commit f1bc9fc4a06de0108e0dca2a9a7e99ba1fc632f9 ]
+
+64-bit DMA detection will fail if axienet was started before (by boot
+loader, boot ROM, etc). In this state axienet will not start properly.
+XAXIDMA_TX_CDESC_OFFSET + 4 register (MM2S_CURDESC_MSB) is used to detect
+64-bit DMA capability here. But datasheet says: When DMACR.RS is 1
+(axienet is in enabled state), CURDESC_PTR becomes Read Only (RO) and
+is used to fetch the first descriptor. So iowrite32()/ioread32() trick
+to this register to detect 64-bit DMA will not work.
+So move axienet reset before 64-bit DMA detection.
+
+Fixes: f735c40ed93c ("net: axienet: Autodetect 64-bit DMA capability")
+Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
+Reviewed-by: Robert Hancock <robert.hancock@calian.com>
+Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Link: https://lore.kernel.org/r/20230622192245.116864-1-fido_max@inbox.ru
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index d1d772580da98..d14648558338b 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -2043,6 +2043,11 @@ static int axienet_probe(struct platform_device *pdev)
+ goto cleanup_clk;
+ }
+
++ /* Reset core now that clocks are enabled, prior to accessing MDIO */
++ ret = __axienet_device_reset(lp);
++ if (ret)
++ goto cleanup_clk;
++
+ /* Autodetect the need for 64-bit DMA pointers.
+ * When the IP is configured for a bus width bigger than 32 bits,
+ * writing the MSB registers is mandatory, even if they are all 0.
+@@ -2097,11 +2102,6 @@ static int axienet_probe(struct platform_device *pdev)
+ lp->coalesce_count_tx = XAXIDMA_DFT_TX_THRESHOLD;
+ lp->coalesce_usec_tx = XAXIDMA_DFT_TX_USEC;
+
+- /* Reset core now that clocks are enabled, prior to accessing MDIO */
+- ret = __axienet_device_reset(lp);
+- if (ret)
+- goto cleanup_clk;
+-
+ ret = axienet_mdio_setup(lp);
+ if (ret)
+ dev_warn(&pdev->dev,
+--
+2.39.2
+
--- /dev/null
+From 0d42fa69c739856e9b1063f89aa59ec305d17cf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jun 2023 17:10:07 +0800
+Subject: net: nfc: Fix use-after-free caused by nfc_llcp_find_local
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 6709d4b7bc2e079241fdef15d1160581c5261c10 ]
+
+This commit fixes several use-after-free that caused by function
+nfc_llcp_find_local(). For example, one UAF can happen when below buggy
+time window occurs.
+
+// nfc_genl_llc_get_params | // nfc_unregister_device
+ |
+dev = nfc_get_device(idx); | device_lock(...)
+if (!dev) | dev->shutting_down = true;
+ return -ENODEV; | device_unlock(...);
+ |
+device_lock(...); | // nfc_llcp_unregister_device
+ | nfc_llcp_find_local()
+nfc_llcp_find_local(...); |
+ | local_cleanup()
+if (!local) { |
+ rc = -ENODEV; | // nfc_llcp_local_put
+ goto exit; | kref_put(.., local_release)
+} |
+ | // local_release
+ | list_del(&local->list)
+ // nfc_genl_send_params | kfree()
+ local->dev->idx !!!UAF!!! |
+ |
+
+and the crash trace for the one of the discussed UAF like:
+
+BUG: KASAN: slab-use-after-free in nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
+Read of size 8 at addr ffff888105b0e410 by task 20114
+
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
+ print_address_description mm/kasan/report.c:319 [inline]
+ print_report+0xcc/0x620 mm/kasan/report.c:430
+ kasan_report+0xb2/0xe0 mm/kasan/report.c:536
+ nfc_genl_send_params net/nfc/netlink.c:999 [inline]
+ nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
+ genl_family_rcv_msg_doit.isra.0+0x1ee/0x2e0 net/netlink/genetlink.c:968
+ genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
+ genl_rcv_msg+0x503/0x7d0 net/netlink/genetlink.c:1065
+ netlink_rcv_skb+0x161/0x430 net/netlink/af_netlink.c:2548
+ genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
+ netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
+ netlink_unicast+0x644/0x900 net/netlink/af_netlink.c:1365
+ netlink_sendmsg+0x934/0xe70 net/netlink/af_netlink.c:1913
+ sock_sendmsg_nosec net/socket.c:724 [inline]
+ sock_sendmsg+0x1b6/0x200 net/socket.c:747
+ ____sys_sendmsg+0x6e9/0x890 net/socket.c:2501
+ ___sys_sendmsg+0x110/0x1b0 net/socket.c:2555
+ __sys_sendmsg+0xf7/0x1d0 net/socket.c:2584
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc
+RIP: 0033:0x7f34640a2389
+RSP: 002b:00007f3463415168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+RAX: ffffffffffffffda RBX: 00007f34641c1f80 RCX: 00007f34640a2389
+RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006
+RBP: 00007f34640ed493 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+R13: 00007ffe38449ecf R14: 00007f3463415300 R15: 0000000000022000
+ </TASK>
+
+Allocated by task 20116:
+ kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
+ kasan_set_track+0x25/0x30 mm/kasan/common.c:52
+ ____kasan_kmalloc mm/kasan/common.c:374 [inline]
+ __kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:383
+ kmalloc include/linux/slab.h:580 [inline]
+ kzalloc include/linux/slab.h:720 [inline]
+ nfc_llcp_register_device+0x49/0xa40 net/nfc/llcp_core.c:1567
+ nfc_register_device+0x61/0x260 net/nfc/core.c:1124
+ nci_register_device+0x776/0xb20 net/nfc/nci/core.c:1257
+ virtual_ncidev_open+0x147/0x230 drivers/nfc/virtual_ncidev.c:148
+ misc_open+0x379/0x4a0 drivers/char/misc.c:165
+ chrdev_open+0x26c/0x780 fs/char_dev.c:414
+ do_dentry_open+0x6c4/0x12a0 fs/open.c:920
+ do_open fs/namei.c:3560 [inline]
+ path_openat+0x24fe/0x37e0 fs/namei.c:3715
+ do_filp_open+0x1ba/0x410 fs/namei.c:3742
+ do_sys_openat2+0x171/0x4c0 fs/open.c:1356
+ do_sys_open fs/open.c:1372 [inline]
+ __do_sys_openat fs/open.c:1388 [inline]
+ __se_sys_openat fs/open.c:1383 [inline]
+ __x64_sys_openat+0x143/0x200 fs/open.c:1383
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc
+
+Freed by task 20115:
+ kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
+ kasan_set_track+0x25/0x30 mm/kasan/common.c:52
+ kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521
+ ____kasan_slab_free mm/kasan/common.c:236 [inline]
+ ____kasan_slab_free mm/kasan/common.c:200 [inline]
+ __kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244
+ kasan_slab_free include/linux/kasan.h:162 [inline]
+ slab_free_hook mm/slub.c:1781 [inline]
+ slab_free_freelist_hook mm/slub.c:1807 [inline]
+ slab_free mm/slub.c:3787 [inline]
+ __kmem_cache_free+0x7a/0x190 mm/slub.c:3800
+ local_release net/nfc/llcp_core.c:174 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ nfc_llcp_local_put net/nfc/llcp_core.c:182 [inline]
+ nfc_llcp_local_put net/nfc/llcp_core.c:177 [inline]
+ nfc_llcp_unregister_device+0x206/0x290 net/nfc/llcp_core.c:1620
+ nfc_unregister_device+0x160/0x1d0 net/nfc/core.c:1179
+ virtual_ncidev_close+0x52/0xa0 drivers/nfc/virtual_ncidev.c:163
+ __fput+0x252/0xa20 fs/file_table.c:321
+ task_work_run+0x174/0x270 kernel/task_work.c:179
+ resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
+ exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
+ exit_to_user_mode_prepare+0x108/0x110 kernel/entry/common.c:204
+ __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
+ syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:297
+ do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc
+
+Last potentially related work creation:
+ kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
+ __kasan_record_aux_stack+0x95/0xb0 mm/kasan/generic.c:491
+ kvfree_call_rcu+0x29/0xa80 kernel/rcu/tree.c:3328
+ drop_sysctl_table+0x3be/0x4e0 fs/proc/proc_sysctl.c:1735
+ unregister_sysctl_table.part.0+0x9c/0x190 fs/proc/proc_sysctl.c:1773
+ unregister_sysctl_table+0x24/0x30 fs/proc/proc_sysctl.c:1753
+ neigh_sysctl_unregister+0x5f/0x80 net/core/neighbour.c:3895
+ addrconf_notify+0x140/0x17b0 net/ipv6/addrconf.c:3684
+ notifier_call_chain+0xbe/0x210 kernel/notifier.c:87
+ call_netdevice_notifiers_info+0xb5/0x150 net/core/dev.c:1937
+ call_netdevice_notifiers_extack net/core/dev.c:1975 [inline]
+ call_netdevice_notifiers net/core/dev.c:1989 [inline]
+ dev_change_name+0x3c3/0x870 net/core/dev.c:1211
+ dev_ifsioc+0x800/0xf70 net/core/dev_ioctl.c:376
+ dev_ioctl+0x3d9/0xf80 net/core/dev_ioctl.c:542
+ sock_do_ioctl+0x160/0x260 net/socket.c:1213
+ sock_ioctl+0x3f9/0x670 net/socket.c:1316
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:870 [inline]
+ __se_sys_ioctl fs/ioctl.c:856 [inline]
+ __x64_sys_ioctl+0x19e/0x210 fs/ioctl.c:856
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc
+
+The buggy address belongs to the object at ffff888105b0e400
+ which belongs to the cache kmalloc-1k of size 1024
+The buggy address is located 16 bytes inside of
+ freed 1024-byte region [ffff888105b0e400, ffff888105b0e800)
+
+The buggy address belongs to the physical page:
+head:ffffea000416c200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
+flags: 0x200000000010200(slab|head|node=0|zone=2)
+raw: 0200000000010200 ffff8881000430c0 ffffea00044c7010 ffffea0004510e10
+raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff888105b0e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ffff888105b0e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+>ffff888105b0e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff888105b0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff888105b0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+
+In summary, this patch solves those use-after-free by
+
+1. Re-implement the nfc_llcp_find_local(). The current version does not
+grab the reference when getting the local from the linked list. For
+example, the llcp_sock_bind() gets the reference like below:
+
+// llcp_sock_bind()
+
+ local = nfc_llcp_find_local(dev); // A
+ ..... \
+ | raceable
+ ..... /
+ llcp_sock->local = nfc_llcp_local_get(local); // B
+
+There is an apparent race window that one can drop the reference
+and free the local object fetched in (A) before (B) gets the reference.
+
+2. Some callers of the nfc_llcp_find_local() do not grab the reference
+at all. For example, the nfc_genl_llc_{{get/set}_params/sdreq} functions.
+We add the nfc_llcp_local_put() for them. Moreover, we add the necessary
+error handling function to put the reference.
+
+3. Add the nfc_llcp_remove_local() helper. The local object is removed
+from the linked list in local_release() when all reference is gone. This
+patch removes it when nfc_llcp_unregister_device() is called.
+
+Therefore, every caller of nfc_llcp_find_local() will get a reference
+even when the nfc_llcp_unregister_device() is called. This promises no
+use-after-free for the local object is ever possible.
+
+Fixes: 52feb444a903 ("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support")
+Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/nfc/llcp.h | 1 -
+ net/nfc/llcp_commands.c | 12 +++++++---
+ net/nfc/llcp_core.c | 49 +++++++++++++++++++++++++++++++++++------
+ net/nfc/llcp_sock.c | 18 ++++++++-------
+ net/nfc/netlink.c | 20 ++++++++++++-----
+ net/nfc/nfc.h | 1 +
+ 6 files changed, 77 insertions(+), 24 deletions(-)
+
+diff --git a/net/nfc/llcp.h b/net/nfc/llcp.h
+index c1d9be636933c..d8345ed57c954 100644
+--- a/net/nfc/llcp.h
++++ b/net/nfc/llcp.h
+@@ -201,7 +201,6 @@ void nfc_llcp_sock_link(struct llcp_sock_list *l, struct sock *s);
+ void nfc_llcp_sock_unlink(struct llcp_sock_list *l, struct sock *s);
+ void nfc_llcp_socket_remote_param_init(struct nfc_llcp_sock *sock);
+ struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev);
+-struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local);
+ int nfc_llcp_local_put(struct nfc_llcp_local *local);
+ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
+ struct nfc_llcp_sock *sock);
+diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
+index cdb001de06928..e2680a3bef799 100644
+--- a/net/nfc/llcp_commands.c
++++ b/net/nfc/llcp_commands.c
+@@ -359,6 +359,7 @@ int nfc_llcp_send_symm(struct nfc_dev *dev)
+ struct sk_buff *skb;
+ struct nfc_llcp_local *local;
+ u16 size = 0;
++ int err;
+
+ local = nfc_llcp_find_local(dev);
+ if (local == NULL)
+@@ -368,8 +369,10 @@ int nfc_llcp_send_symm(struct nfc_dev *dev)
+ size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;
+
+ skb = alloc_skb(size, GFP_KERNEL);
+- if (skb == NULL)
+- return -ENOMEM;
++ if (skb == NULL) {
++ err = -ENOMEM;
++ goto out;
++ }
+
+ skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
+
+@@ -379,8 +382,11 @@ int nfc_llcp_send_symm(struct nfc_dev *dev)
+
+ nfc_llcp_send_to_raw_sock(local, skb, NFC_DIRECTION_TX);
+
+- return nfc_data_exchange(dev, local->target_idx, skb,
++ err = nfc_data_exchange(dev, local->target_idx, skb,
+ nfc_llcp_recv, local);
++out:
++ nfc_llcp_local_put(local);
++ return err;
+ }
+
+ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
+diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
+index a27e1842b2a09..f60e424e06076 100644
+--- a/net/nfc/llcp_core.c
++++ b/net/nfc/llcp_core.c
+@@ -17,6 +17,8 @@
+ static u8 llcp_magic[3] = {0x46, 0x66, 0x6d};
+
+ static LIST_HEAD(llcp_devices);
++/* Protects llcp_devices list */
++static DEFINE_SPINLOCK(llcp_devices_lock);
+
+ static void nfc_llcp_rx_skb(struct nfc_llcp_local *local, struct sk_buff *skb);
+
+@@ -141,7 +143,7 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool device,
+ write_unlock(&local->raw_sockets.lock);
+ }
+
+-struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
++static struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
+ {
+ kref_get(&local->ref);
+
+@@ -169,7 +171,6 @@ static void local_release(struct kref *ref)
+
+ local = container_of(ref, struct nfc_llcp_local, ref);
+
+- list_del(&local->list);
+ local_cleanup(local);
+ kfree(local);
+ }
+@@ -282,12 +283,33 @@ static void nfc_llcp_sdreq_timer(struct timer_list *t)
+ struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev)
+ {
+ struct nfc_llcp_local *local;
++ struct nfc_llcp_local *res = NULL;
+
++ spin_lock(&llcp_devices_lock);
+ list_for_each_entry(local, &llcp_devices, list)
+- if (local->dev == dev)
++ if (local->dev == dev) {
++ res = nfc_llcp_local_get(local);
++ break;
++ }
++ spin_unlock(&llcp_devices_lock);
++
++ return res;
++}
++
++static struct nfc_llcp_local *nfc_llcp_remove_local(struct nfc_dev *dev)
++{
++ struct nfc_llcp_local *local, *tmp;
++
++ spin_lock(&llcp_devices_lock);
++ list_for_each_entry_safe(local, tmp, &llcp_devices, list)
++ if (local->dev == dev) {
++ list_del(&local->list);
++ spin_unlock(&llcp_devices_lock);
+ return local;
++ }
++ spin_unlock(&llcp_devices_lock);
+
+- pr_debug("No device found\n");
++ pr_warn("Shutting down device not found\n");
+
+ return NULL;
+ }
+@@ -608,12 +630,15 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
+
+ *general_bytes_len = local->gb_len;
+
++ nfc_llcp_local_put(local);
++
+ return local->gb;
+ }
+
+ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
+ {
+ struct nfc_llcp_local *local;
++ int err;
+
+ if (gb_len < 3 || gb_len > NFC_MAX_GT_LEN)
+ return -EINVAL;
+@@ -630,12 +655,16 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
+
+ if (memcmp(local->remote_gb, llcp_magic, 3)) {
+ pr_err("MAC does not support LLCP\n");
+- return -EINVAL;
++ err = -EINVAL;
++ goto out;
+ }
+
+- return nfc_llcp_parse_gb_tlv(local,
++ err = nfc_llcp_parse_gb_tlv(local,
+ &local->remote_gb[3],
+ local->remote_gb_len - 3);
++out:
++ nfc_llcp_local_put(local);
++ return err;
+ }
+
+ static u8 nfc_llcp_dsap(const struct sk_buff *pdu)
+@@ -1517,6 +1546,8 @@ int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb)
+
+ __nfc_llcp_recv(local, skb);
+
++ nfc_llcp_local_put(local);
++
+ return 0;
+ }
+
+@@ -1533,6 +1564,8 @@ void nfc_llcp_mac_is_down(struct nfc_dev *dev)
+
+ /* Close and purge all existing sockets */
+ nfc_llcp_socket_release(local, true, 0);
++
++ nfc_llcp_local_put(local);
+ }
+
+ void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
+@@ -1558,6 +1591,8 @@ void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
+ mod_timer(&local->link_timer,
+ jiffies + msecs_to_jiffies(local->remote_lto));
+ }
++
++ nfc_llcp_local_put(local);
+ }
+
+ int nfc_llcp_register_device(struct nfc_dev *ndev)
+@@ -1608,7 +1643,7 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
+
+ void nfc_llcp_unregister_device(struct nfc_dev *dev)
+ {
+- struct nfc_llcp_local *local = nfc_llcp_find_local(dev);
++ struct nfc_llcp_local *local = nfc_llcp_remove_local(dev);
+
+ if (local == NULL) {
+ pr_debug("No such device\n");
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index 77642d18a3b43..645677f84dba2 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -99,7 +99,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
+ }
+
+ llcp_sock->dev = dev;
+- llcp_sock->local = nfc_llcp_local_get(local);
++ llcp_sock->local = local;
+ llcp_sock->nfc_protocol = llcp_addr.nfc_protocol;
+ llcp_sock->service_name_len = min_t(unsigned int,
+ llcp_addr.service_name_len,
+@@ -186,7 +186,7 @@ static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr *addr,
+ }
+
+ llcp_sock->dev = dev;
+- llcp_sock->local = nfc_llcp_local_get(local);
++ llcp_sock->local = local;
+ llcp_sock->nfc_protocol = llcp_addr.nfc_protocol;
+
+ nfc_llcp_sock_link(&local->raw_sockets, sk);
+@@ -696,22 +696,22 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
+ if (dev->dep_link_up == false) {
+ ret = -ENOLINK;
+ device_unlock(&dev->dev);
+- goto put_dev;
++ goto sock_llcp_put_local;
+ }
+ device_unlock(&dev->dev);
+
+ if (local->rf_mode == NFC_RF_INITIATOR &&
+ addr->target_idx != local->target_idx) {
+ ret = -ENOLINK;
+- goto put_dev;
++ goto sock_llcp_put_local;
+ }
+
+ llcp_sock->dev = dev;
+- llcp_sock->local = nfc_llcp_local_get(local);
++ llcp_sock->local = local;
+ llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
+ if (llcp_sock->ssap == LLCP_SAP_MAX) {
+ ret = -ENOMEM;
+- goto sock_llcp_put_local;
++ goto sock_llcp_nullify;
+ }
+
+ llcp_sock->reserved_ssap = llcp_sock->ssap;
+@@ -757,11 +757,13 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
+ sock_llcp_release:
+ nfc_llcp_put_ssap(local, llcp_sock->ssap);
+
+-sock_llcp_put_local:
+- nfc_llcp_local_put(llcp_sock->local);
++sock_llcp_nullify:
+ llcp_sock->local = NULL;
+ llcp_sock->dev = NULL;
+
++sock_llcp_put_local:
++ nfc_llcp_local_put(local);
++
+ put_dev:
+ nfc_put_device(dev);
+
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index b9264e730fd93..e9ac6a6f934e7 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -1039,11 +1039,14 @@ static int nfc_genl_llc_get_params(struct sk_buff *skb, struct genl_info *info)
+ msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+ if (!msg) {
+ rc = -ENOMEM;
+- goto exit;
++ goto put_local;
+ }
+
+ rc = nfc_genl_send_params(msg, local, info->snd_portid, info->snd_seq);
+
++put_local:
++ nfc_llcp_local_put(local);
++
+ exit:
+ device_unlock(&dev->dev);
+
+@@ -1105,7 +1108,7 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info)
+ if (info->attrs[NFC_ATTR_LLC_PARAM_LTO]) {
+ if (dev->dep_link_up) {
+ rc = -EINPROGRESS;
+- goto exit;
++ goto put_local;
+ }
+
+ local->lto = nla_get_u8(info->attrs[NFC_ATTR_LLC_PARAM_LTO]);
+@@ -1117,6 +1120,9 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info)
+ if (info->attrs[NFC_ATTR_LLC_PARAM_MIUX])
+ local->miux = cpu_to_be16(miux);
+
++put_local:
++ nfc_llcp_local_put(local);
++
+ exit:
+ device_unlock(&dev->dev);
+
+@@ -1172,7 +1178,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
+
+ if (rc != 0) {
+ rc = -EINVAL;
+- goto exit;
++ goto put_local;
+ }
+
+ if (!sdp_attrs[NFC_SDP_ATTR_URI])
+@@ -1191,7 +1197,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
+ sdreq = nfc_llcp_build_sdreq_tlv(tid, uri, uri_len);
+ if (sdreq == NULL) {
+ rc = -ENOMEM;
+- goto exit;
++ goto put_local;
+ }
+
+ tlvs_len += sdreq->tlv_len;
+@@ -1201,10 +1207,14 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
+
+ if (hlist_empty(&sdreq_list)) {
+ rc = -EINVAL;
+- goto exit;
++ goto put_local;
+ }
+
+ rc = nfc_llcp_send_snl_sdreq(local, &sdreq_list, tlvs_len);
++
++put_local:
++ nfc_llcp_local_put(local);
++
+ exit:
+ device_unlock(&dev->dev);
+
+diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
+index de2ec66d7e83a..0b1e6466f4fbf 100644
+--- a/net/nfc/nfc.h
++++ b/net/nfc/nfc.h
+@@ -52,6 +52,7 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len);
+ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len);
+ int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb);
+ struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev);
++int nfc_llcp_local_put(struct nfc_llcp_local *local);
+ int __init nfc_llcp_init(void);
+ void nfc_llcp_exit(void);
+ void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp);
+--
+2.39.2
+
--- /dev/null
+From c2b62f31c17b1fb3d730e624fa8781b3a12f8fd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 15:55:37 +0200
+Subject: net: stmmac: fix double serdes powerdown
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit c4fc88ad2a765224a648db8ab35f125e120fe41b ]
+
+Commit 49725ffc15fc ("net: stmmac: power up/down serdes in
+stmmac_open/release") correctly added a call to the serdes_powerdown()
+callback to stmmac_release() but did not remove the one from
+stmmac_remove() which leads to a doubled call to serdes_powerdown().
+
+This can lead to all kinds of problems: in the case of the qcom ethqos
+driver, it caused an unbalanced regulator disable splat.
+
+Fixes: 49725ffc15fc ("net: stmmac: power up/down serdes in stmmac_open/release")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Acked-by: Junxiao Chang <junxiao.chang@intel.com>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Tested-by: Andrew Halaney <ahalaney@redhat.com>
+Link: https://lore.kernel.org/r/20230621135537.376649-1-brgl@bgdev.pl
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 30ce073055785..a07bcb2f5d2e2 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -7388,12 +7388,6 @@ int stmmac_dvr_remove(struct device *dev)
+ netif_carrier_off(ndev);
+ unregister_netdev(ndev);
+
+- /* Serdes power down needs to happen after VLAN filter
+- * is deleted that is triggered by unregister_netdev().
+- */
+- if (priv->plat->serdes_powerdown)
+- priv->plat->serdes_powerdown(ndev, priv->plat->bsp_priv);
+-
+ #ifdef CONFIG_DEBUG_FS
+ stmmac_exit_fs(ndev);
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 137ab32f7407ff39466b805f1551ad4ff1d83899 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 17:56:53 +0200
+Subject: netfilter: conntrack: dccp: copy entire header to stack buffer, not
+ just basic one
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30 ]
+
+Eric Dumazet says:
+ nf_conntrack_dccp_packet() has an unique:
+
+ dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
+
+ And nothing more is 'pulled' from the packet, depending on the content.
+ dh->dccph_doff, and/or dh->dccph_x ...)
+ So dccp_ack_seq() is happily reading stuff past the _dh buffer.
+
+BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0
+Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371
+[..]
+
+Fix this by increasing the stack buffer to also include room for
+the extra sequence numbers and all the known dccp packet type headers,
+then pull again after the initial validation of the basic header.
+
+While at it, mark packets invalid that lack 48bit sequence bit but
+where RFC says the type MUST use them.
+
+Compile tested only.
+
+v2: first skb_header_pointer() now needs to adjust the size to
+ only pull the generic header. (Eric)
+
+Heads-up: I intend to remove dccp conntrack support later this year.
+
+Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support")
+Reported-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_dccp.c | 52 +++++++++++++++++++++++--
+ 1 file changed, 49 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
+index c1557d47ccd1e..d4fd626d2b8c3 100644
+--- a/net/netfilter/nf_conntrack_proto_dccp.c
++++ b/net/netfilter/nf_conntrack_proto_dccp.c
+@@ -432,9 +432,19 @@ static bool dccp_error(const struct dccp_hdr *dh,
+ struct sk_buff *skb, unsigned int dataoff,
+ const struct nf_hook_state *state)
+ {
++ static const unsigned long require_seq48 = 1 << DCCP_PKT_REQUEST |
++ 1 << DCCP_PKT_RESPONSE |
++ 1 << DCCP_PKT_CLOSEREQ |
++ 1 << DCCP_PKT_CLOSE |
++ 1 << DCCP_PKT_RESET |
++ 1 << DCCP_PKT_SYNC |
++ 1 << DCCP_PKT_SYNCACK;
+ unsigned int dccp_len = skb->len - dataoff;
+ unsigned int cscov;
+ const char *msg;
++ u8 type;
++
++ BUILD_BUG_ON(DCCP_PKT_INVALID >= BITS_PER_LONG);
+
+ if (dh->dccph_doff * 4 < sizeof(struct dccp_hdr) ||
+ dh->dccph_doff * 4 > dccp_len) {
+@@ -459,34 +469,70 @@ static bool dccp_error(const struct dccp_hdr *dh,
+ goto out_invalid;
+ }
+
+- if (dh->dccph_type >= DCCP_PKT_INVALID) {
++ type = dh->dccph_type;
++ if (type >= DCCP_PKT_INVALID) {
+ msg = "nf_ct_dccp: reserved packet type ";
+ goto out_invalid;
+ }
++
++ if (test_bit(type, &require_seq48) && !dh->dccph_x) {
++ msg = "nf_ct_dccp: type lacks 48bit sequence numbers";
++ goto out_invalid;
++ }
++
+ return false;
+ out_invalid:
+ nf_l4proto_log_invalid(skb, state, IPPROTO_DCCP, "%s", msg);
+ return true;
+ }
+
++struct nf_conntrack_dccp_buf {
++ struct dccp_hdr dh; /* generic header part */
++ struct dccp_hdr_ext ext; /* optional depending dh->dccph_x */
++ union { /* depends on header type */
++ struct dccp_hdr_ack_bits ack;
++ struct dccp_hdr_request req;
++ struct dccp_hdr_response response;
++ struct dccp_hdr_reset rst;
++ } u;
++};
++
++static struct dccp_hdr *
++dccp_header_pointer(const struct sk_buff *skb, int offset, const struct dccp_hdr *dh,
++ struct nf_conntrack_dccp_buf *buf)
++{
++ unsigned int hdrlen = __dccp_hdr_len(dh);
++
++ if (hdrlen > sizeof(*buf))
++ return NULL;
++
++ return skb_header_pointer(skb, offset, hdrlen, buf);
++}
++
+ int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb,
+ unsigned int dataoff,
+ enum ip_conntrack_info ctinfo,
+ const struct nf_hook_state *state)
+ {
+ enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+- struct dccp_hdr _dh, *dh;
++ struct nf_conntrack_dccp_buf _dh;
+ u_int8_t type, old_state, new_state;
+ enum ct_dccp_roles role;
+ unsigned int *timeouts;
++ struct dccp_hdr *dh;
+
+- dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
++ dh = skb_header_pointer(skb, dataoff, sizeof(*dh), &_dh.dh);
+ if (!dh)
+ return NF_DROP;
+
+ if (dccp_error(dh, skb, dataoff, state))
+ return -NF_ACCEPT;
+
++ /* pull again, including possible 48 bit sequences and subtype header */
++ dh = dccp_header_pointer(skb, dataoff, dh, &_dh);
++ if (!dh)
++ return NF_DROP;
++
+ type = dh->dccph_type;
+ if (!nf_ct_is_confirmed(ct) && !dccp_new(ct, skb, dh, state))
+ return -NF_ACCEPT;
+--
+2.39.2
+
--- /dev/null
+From 13a7a753fd04fc1388ef807678e337f06f4defe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jun 2023 11:23:46 +0000
+Subject: netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param()
+ return value.
+
+From: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit f188d30087480eab421cd8ca552fb15f55d57f4d ]
+
+ct_sip_parse_numerical_param() returns only 0 or 1 now.
+But process_register_request() and process_register_response() imply
+checking for a negative value if parsing of a numerical header parameter
+failed.
+The invocation in nf_nat_sip() looks correct:
+ if (ct_sip_parse_numerical_param(...) > 0 &&
+ ...) { ... }
+
+Make the return value of the function ct_sip_parse_numerical_param()
+a tristate to fix all the cases
+a) return 1 if value is found; *val is set
+b) return 0 if value is not found; *val is unchanged
+c) return -1 on error; *val is undefined
+
+Found by InfoTeCS on behalf of Linux Verification Center
+(linuxtesting.org) with SVACE.
+
+Fixes: 0f32a40fc91a ("[NETFILTER]: nf_conntrack_sip: create signalling expectations")
+Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Reviewed-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_sip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
+index 77f5e82d8e3fe..d0eac27f6ba03 100644
+--- a/net/netfilter/nf_conntrack_sip.c
++++ b/net/netfilter/nf_conntrack_sip.c
+@@ -611,7 +611,7 @@ int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr,
+ start += strlen(name);
+ *val = simple_strtoul(start, &end, 0);
+ if (start == end)
+- return 0;
++ return -1;
+ if (matchoff && matchlen) {
+ *matchoff = start - dptr;
+ *matchlen = end - start;
+--
+2.39.2
+
--- /dev/null
+From 56bbab32d589c6bfd42253967a4c36b8cac0af82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jun 2023 09:43:13 -0700
+Subject: netlink: Add __sock_i_ino() for __netlink_diag_dump().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 25a9c8a4431c364f97f75558cb346d2ad3f53fbb ]
+
+syzbot reported a warning in __local_bh_enable_ip(). [0]
+
+Commit 8d61f926d420 ("netlink: fix potential deadlock in
+netlink_set_err()") converted read_lock(&nl_table_lock) to
+read_lock_irqsave() in __netlink_diag_dump() to prevent a deadlock.
+
+However, __netlink_diag_dump() calls sock_i_ino() that uses
+read_lock_bh() and read_unlock_bh(). If CONFIG_TRACE_IRQFLAGS=y,
+read_unlock_bh() finally enables IRQ even though it should stay
+disabled until the following read_unlock_irqrestore().
+
+Using read_lock() in sock_i_ino() would trigger a lockdep splat
+in another place that was fixed in commit f064af1e500a ("net: fix
+a lockdep splat"), so let's add __sock_i_ino() that would be safe
+to use under BH disabled.
+
+[0]:
+WARNING: CPU: 0 PID: 5012 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
+Modules linked in:
+CPU: 0 PID: 5012 Comm: syz-executor487 Not tainted 6.4.0-rc7-syzkaller-00202-g6f68fc395f49 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
+RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
+Code: 45 bf 01 00 00 00 e8 91 5b 0a 00 e8 3c 15 3d 00 fb 65 8b 05 ec e9 b5 7e 85 c0 74 58 5b 5d c3 65 8b 05 b2 b6 b4 7e 85 c0 75 a2 <0f> 0b eb 9e e8 89 15 3d 00 eb 9f 48 89 ef e8 6f 49 18 00 eb a8 0f
+RSP: 0018:ffffc90003a1f3d0 EFLAGS: 00010046
+RAX: 0000000000000000 RBX: 0000000000000201 RCX: 1ffffffff1cf5996
+RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff8805c6f3
+RBP: ffffffff8805c6f3 R08: 0000000000000001 R09: ffff8880152b03a3
+R10: ffffed1002a56074 R11: 0000000000000005 R12: 00000000000073e4
+R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000
+FS: 0000555556726300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 000000000045ad50 CR3: 000000007c646000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ sock_i_ino+0x83/0xa0 net/core/sock.c:2559
+ __netlink_diag_dump+0x45c/0x790 net/netlink/diag.c:171
+ netlink_diag_dump+0xd6/0x230 net/netlink/diag.c:207
+ netlink_dump+0x570/0xc50 net/netlink/af_netlink.c:2269
+ __netlink_dump_start+0x64b/0x910 net/netlink/af_netlink.c:2374
+ netlink_dump_start include/linux/netlink.h:329 [inline]
+ netlink_diag_handler_dump+0x1ae/0x250 net/netlink/diag.c:238
+ __sock_diag_cmd net/core/sock_diag.c:238 [inline]
+ sock_diag_rcv_msg+0x31e/0x440 net/core/sock_diag.c:269
+ netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2547
+ sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280
+ netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
+ netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
+ netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1914
+ sock_sendmsg_nosec net/socket.c:724 [inline]
+ sock_sendmsg+0xde/0x190 net/socket.c:747
+ ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
+ ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
+ __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7f5303aaabb9
+Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007ffc7506e548 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5303aaabb9
+RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003
+RBP: 00007f5303a6ed60 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5303a6edf0
+R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+ </TASK>
+
+Fixes: 8d61f926d420 ("netlink: fix potential deadlock in netlink_set_err()")
+Reported-by: syzbot+5da61cf6a9bc1902d422@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=5da61cf6a9bc1902d422
+Suggested-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20230626164313.52528-1-kuniyu@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sock.h | 1 +
+ net/core/sock.c | 17 ++++++++++++++---
+ net/netlink/diag.c | 2 +-
+ 3 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 2f35b82a123f8..1bbdddcf61542 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -2124,6 +2124,7 @@ static inline void sock_graft(struct sock *sk, struct socket *parent)
+ }
+
+ kuid_t sock_i_uid(struct sock *sk);
++unsigned long __sock_i_ino(struct sock *sk);
+ unsigned long sock_i_ino(struct sock *sk);
+
+ static inline kuid_t sock_net_uid(const struct net *net, const struct sock *sk)
+diff --git a/net/core/sock.c b/net/core/sock.c
+index b021cb9c95ef3..0c1baa5517f11 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2542,13 +2542,24 @@ kuid_t sock_i_uid(struct sock *sk)
+ }
+ EXPORT_SYMBOL(sock_i_uid);
+
+-unsigned long sock_i_ino(struct sock *sk)
++unsigned long __sock_i_ino(struct sock *sk)
+ {
+ unsigned long ino;
+
+- read_lock_bh(&sk->sk_callback_lock);
++ read_lock(&sk->sk_callback_lock);
+ ino = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_ino : 0;
+- read_unlock_bh(&sk->sk_callback_lock);
++ read_unlock(&sk->sk_callback_lock);
++ return ino;
++}
++EXPORT_SYMBOL(__sock_i_ino);
++
++unsigned long sock_i_ino(struct sock *sk)
++{
++ unsigned long ino;
++
++ local_bh_disable();
++ ino = __sock_i_ino(sk);
++ local_bh_enable();
+ return ino;
+ }
+ EXPORT_SYMBOL(sock_i_ino);
+diff --git a/net/netlink/diag.c b/net/netlink/diag.c
+index 4143b2ea4195a..e4f21b1067bcc 100644
+--- a/net/netlink/diag.c
++++ b/net/netlink/diag.c
+@@ -168,7 +168,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
+ NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq,
+ NLM_F_MULTI,
+- sock_i_ino(sk)) < 0) {
++ __sock_i_ino(sk)) < 0) {
+ ret = 1;
+ break;
+ }
+--
+2.39.2
+
--- /dev/null
+From 06801f677144b378e0d0da211bd81f43eebf565f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 17:47:20 +0000
+Subject: netlink: do not hard code device address lenth in fdb dumps
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit aa5406950726e336c5c9585b09799a734b6e77bf ]
+
+syzbot reports that some netdev devices do not have a six bytes
+address [1]
+
+Replace ETH_ALEN by dev->addr_len.
+
+[1] (Case of a device where dev->addr_len = 4)
+
+BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
+BUG: KMSAN: kernel-infoleak in copyout+0xb8/0x100 lib/iov_iter.c:169
+instrument_copy_to_user include/linux/instrumented.h:114 [inline]
+copyout+0xb8/0x100 lib/iov_iter.c:169
+_copy_to_iter+0x6d8/0x1d00 lib/iov_iter.c:536
+copy_to_iter include/linux/uio.h:206 [inline]
+simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:513
+__skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419
+skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:527
+skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]
+netlink_recvmsg+0x4ae/0x15a0 net/netlink/af_netlink.c:1970
+sock_recvmsg_nosec net/socket.c:1019 [inline]
+sock_recvmsg net/socket.c:1040 [inline]
+____sys_recvmsg+0x283/0x7f0 net/socket.c:2722
+___sys_recvmsg+0x223/0x840 net/socket.c:2764
+do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858
+__sys_recvmmsg net/socket.c:2937 [inline]
+__do_sys_recvmmsg net/socket.c:2960 [inline]
+__se_sys_recvmmsg net/socket.c:2953 [inline]
+__x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953
+do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Uninit was stored to memory at:
+__nla_put lib/nlattr.c:1009 [inline]
+nla_put+0x1c6/0x230 lib/nlattr.c:1067
+nlmsg_populate_fdb_fill+0x2b8/0x600 net/core/rtnetlink.c:4071
+nlmsg_populate_fdb net/core/rtnetlink.c:4418 [inline]
+ndo_dflt_fdb_dump+0x616/0x840 net/core/rtnetlink.c:4456
+rtnl_fdb_dump+0x14ff/0x1fc0 net/core/rtnetlink.c:4629
+netlink_dump+0x9d1/0x1310 net/netlink/af_netlink.c:2268
+netlink_recvmsg+0xc5c/0x15a0 net/netlink/af_netlink.c:1995
+sock_recvmsg_nosec+0x7a/0x120 net/socket.c:1019
+____sys_recvmsg+0x664/0x7f0 net/socket.c:2720
+___sys_recvmsg+0x223/0x840 net/socket.c:2764
+do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858
+__sys_recvmmsg net/socket.c:2937 [inline]
+__do_sys_recvmmsg net/socket.c:2960 [inline]
+__se_sys_recvmmsg net/socket.c:2953 [inline]
+__x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953
+do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Uninit was created at:
+slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:716
+slab_alloc_node mm/slub.c:3451 [inline]
+__kmem_cache_alloc_node+0x4ff/0x8b0 mm/slub.c:3490
+kmalloc_trace+0x51/0x200 mm/slab_common.c:1057
+kmalloc include/linux/slab.h:559 [inline]
+__hw_addr_create net/core/dev_addr_lists.c:60 [inline]
+__hw_addr_add_ex+0x2e5/0x9e0 net/core/dev_addr_lists.c:118
+__dev_mc_add net/core/dev_addr_lists.c:867 [inline]
+dev_mc_add+0x9a/0x130 net/core/dev_addr_lists.c:885
+igmp6_group_added+0x267/0xbc0 net/ipv6/mcast.c:680
+ipv6_mc_up+0x296/0x3b0 net/ipv6/mcast.c:2754
+ipv6_mc_remap+0x1e/0x30 net/ipv6/mcast.c:2708
+addrconf_type_change net/ipv6/addrconf.c:3731 [inline]
+addrconf_notify+0x4d3/0x1d90 net/ipv6/addrconf.c:3699
+notifier_call_chain kernel/notifier.c:93 [inline]
+raw_notifier_call_chain+0xe4/0x430 kernel/notifier.c:461
+call_netdevice_notifiers_info net/core/dev.c:1935 [inline]
+call_netdevice_notifiers_extack net/core/dev.c:1973 [inline]
+call_netdevice_notifiers+0x1ee/0x2d0 net/core/dev.c:1987
+bond_enslave+0xccd/0x53f0 drivers/net/bonding/bond_main.c:1906
+do_set_master net/core/rtnetlink.c:2626 [inline]
+rtnl_newlink_create net/core/rtnetlink.c:3460 [inline]
+__rtnl_newlink net/core/rtnetlink.c:3660 [inline]
+rtnl_newlink+0x378c/0x40e0 net/core/rtnetlink.c:3673
+rtnetlink_rcv_msg+0x16a6/0x1840 net/core/rtnetlink.c:6395
+netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546
+rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6413
+netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
+netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
+netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1913
+sock_sendmsg_nosec net/socket.c:724 [inline]
+sock_sendmsg net/socket.c:747 [inline]
+____sys_sendmsg+0x999/0xd50 net/socket.c:2503
+___sys_sendmsg+0x28d/0x3c0 net/socket.c:2557
+__sys_sendmsg net/socket.c:2586 [inline]
+__do_sys_sendmsg net/socket.c:2595 [inline]
+__se_sys_sendmsg net/socket.c:2593 [inline]
+__x64_sys_sendmsg+0x304/0x490 net/socket.c:2593
+do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Bytes 2856-2857 of 3500 are uninitialized
+Memory access of size 3500 starts at ffff888018d99104
+Data copied to user address 0000000020000480
+
+Fixes: d83b06036048 ("net: add fdb generic dump routine")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Link: https://lore.kernel.org/r/20230621174720.1845040-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/rtnetlink.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index ef2a07ae5496e..5625ed30a06f3 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -3992,7 +3992,7 @@ static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
+ ndm->ndm_ifindex = dev->ifindex;
+ ndm->ndm_state = ndm_state;
+
+- if (nla_put(skb, NDA_LLADDR, ETH_ALEN, addr))
++ if (nla_put(skb, NDA_LLADDR, dev->addr_len, addr))
+ goto nla_put_failure;
+ if (vid)
+ if (nla_put(skb, NDA_VLAN, sizeof(u16), &vid))
+@@ -4006,10 +4006,10 @@ static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
+ return -EMSGSIZE;
+ }
+
+-static inline size_t rtnl_fdb_nlmsg_size(void)
++static inline size_t rtnl_fdb_nlmsg_size(const struct net_device *dev)
+ {
+ return NLMSG_ALIGN(sizeof(struct ndmsg)) +
+- nla_total_size(ETH_ALEN) + /* NDA_LLADDR */
++ nla_total_size(dev->addr_len) + /* NDA_LLADDR */
+ nla_total_size(sizeof(u16)) + /* NDA_VLAN */
+ 0;
+ }
+@@ -4021,7 +4021,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, u16 vid, int type,
+ struct sk_buff *skb;
+ int err = -ENOBUFS;
+
+- skb = nlmsg_new(rtnl_fdb_nlmsg_size(), GFP_ATOMIC);
++ skb = nlmsg_new(rtnl_fdb_nlmsg_size(dev), GFP_ATOMIC);
+ if (!skb)
+ goto errout;
+
+--
+2.39.2
+
--- /dev/null
+From af3e460c0ea4d27c30c8eb1390529f0559654dc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 15:43:37 +0000
+Subject: netlink: fix potential deadlock in netlink_set_err()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 8d61f926d42045961e6b65191c09e3678d86a9cf ]
+
+syzbot reported a possible deadlock in netlink_set_err() [1]
+
+A similar issue was fixed in commit 1d482e666b8e ("netlink: disable IRQs
+for netlink_lock_table()") in netlink_lock_table()
+
+This patch adds IRQ safety to netlink_set_err() and __netlink_diag_dump()
+which were not covered by cited commit.
+
+[1]
+
+WARNING: possible irq lock inversion dependency detected
+6.4.0-rc6-syzkaller-00240-g4e9f0ec38852 #0 Not tainted
+
+syz-executor.2/23011 just changed the state of lock:
+ffffffff8e1a7a58 (nl_table_lock){.+.?}-{2:2}, at: netlink_set_err+0x2e/0x3a0 net/netlink/af_netlink.c:1612
+but this lock was taken by another, SOFTIRQ-safe lock in the past:
+ (&local->queue_stop_reason_lock){..-.}-{2:2}
+
+and interrupts could create inverse lock ordering between them.
+
+other info that might help us debug this:
+ Possible interrupt unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(nl_table_lock);
+ local_irq_disable();
+ lock(&local->queue_stop_reason_lock);
+ lock(nl_table_lock);
+ <Interrupt>
+ lock(&local->queue_stop_reason_lock);
+
+ *** DEADLOCK ***
+
+Fixes: 1d482e666b8e ("netlink: disable IRQs for netlink_lock_table()")
+Reported-by: syzbot+a7d200a347f912723e5c@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=a7d200a347f912723e5c
+Link: https://lore.kernel.org/netdev/000000000000e38d1605fea5747e@google.com/T/#u
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Johannes Berg <johannes.berg@intel.com>
+Link: https://lore.kernel.org/r/20230621154337.1668594-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlink/af_netlink.c | 5 +++--
+ net/netlink/diag.c | 5 +++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 6d493a0ccf399..ed123cf462afe 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1589,6 +1589,7 @@ static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p)
+ int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
+ {
+ struct netlink_set_err_data info;
++ unsigned long flags;
+ struct sock *sk;
+ int ret = 0;
+
+@@ -1598,12 +1599,12 @@ int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
+ /* sk->sk_err wants a positive error value */
+ info.code = -code;
+
+- read_lock(&nl_table_lock);
++ read_lock_irqsave(&nl_table_lock, flags);
+
+ sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
+ ret += do_one_set_err(sk, &info);
+
+- read_unlock(&nl_table_lock);
++ read_unlock_irqrestore(&nl_table_lock, flags);
+ return ret;
+ }
+ EXPORT_SYMBOL(netlink_set_err);
+diff --git a/net/netlink/diag.c b/net/netlink/diag.c
+index c6255eac305c7..4143b2ea4195a 100644
+--- a/net/netlink/diag.c
++++ b/net/netlink/diag.c
+@@ -94,6 +94,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
+ struct net *net = sock_net(skb->sk);
+ struct netlink_diag_req *req;
+ struct netlink_sock *nlsk;
++ unsigned long flags;
+ struct sock *sk;
+ int num = 2;
+ int ret = 0;
+@@ -152,7 +153,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
+ num++;
+
+ mc_list:
+- read_lock(&nl_table_lock);
++ read_lock_irqsave(&nl_table_lock, flags);
+ sk_for_each_bound(sk, &tbl->mc_list) {
+ if (sk_hashed(sk))
+ continue;
+@@ -173,7 +174,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
+ }
+ num++;
+ }
+- read_unlock(&nl_table_lock);
++ read_unlock_irqrestore(&nl_table_lock, flags);
+
+ done:
+ cb->args[0] = num;
+--
+2.39.2
+
--- /dev/null
+From 7ed64f8f7f593739d4308cff6fa3d191e79e3e91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 May 2023 13:52:04 +0200
+Subject: nfc: llcp: fix possible use of uninitialized variable in
+ nfc_llcp_send_connect()
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 0d9b41daa5907756a31772d8af8ac5ff25cf17c1 ]
+
+If sock->service_name is NULL, the local variable
+service_name_tlv_length will not be assigned by nfc_llcp_build_tlv(),
+later leading to using value frmo the stack. Smatch warning:
+
+ net/nfc/llcp_commands.c:442 nfc_llcp_send_connect() error: uninitialized symbol 'service_name_tlv_length'.
+
+Fixes: de9e5aeb4f40 ("NFC: llcp: Fix usage of llcp_add_tlv()")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/nfc/llcp_commands.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
+index 41e3a20c89355..cdb001de06928 100644
+--- a/net/nfc/llcp_commands.c
++++ b/net/nfc/llcp_commands.c
+@@ -390,7 +390,8 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
+ const u8 *service_name_tlv = NULL;
+ const u8 *miux_tlv = NULL;
+ const u8 *rw_tlv = NULL;
+- u8 service_name_tlv_length, miux_tlv_length, rw_tlv_length, rw;
++ u8 service_name_tlv_length = 0;
++ u8 miux_tlv_length, rw_tlv_length, rw;
+ int err;
+ u16 size = 0;
+ __be16 miux;
+--
+2.39.2
+
--- /dev/null
+From 6c0e33fccf3b1d1041513da4875b68a574372a42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Jun 2023 17:32:25 -0400
+Subject: NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit c907e72f58ed979a24a9fdcadfbc447c51d5e509 ]
+
+When the client received NFS4ERR_BADSESSION, it schedules recovery
+and start the state manager thread which in turn freezes the
+session table and does not allow for any new requests to use the
+no-longer valid session. However, it is possible that before
+the state manager thread runs, a new operation would use the
+released slot that received BADSESSION and was therefore not
+updated its sequence number. Such re-use of the slot can lead
+the application errors.
+
+Fixes: 5c441544f045 ("NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process()")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 70e76359909cc..177cb7b089b9a 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -921,6 +921,7 @@ static int nfs41_sequence_process(struct rpc_task *task,
+ out_noaction:
+ return ret;
+ session_recover:
++ set_bit(NFS4_SLOT_TBL_DRAINING, &session->fc_slot_table.slot_tbl_state);
+ nfs4_schedule_session_recovery(session, status);
+ dprintk("%s ERROR: %d Reset session\n", __func__, status);
+ nfs41_sequence_free_slot(res);
+--
+2.39.2
+
--- /dev/null
+From e196d2c5a07b17fe0e8e0af5b22ca1ef78429668 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 11:19:46 +0000
+Subject: NFSv4.2: fix wrong shrinker_id
+
+From: Qi Zheng <zhengqi.arch@bytedance.com>
+
+[ Upstream commit 7f7ab336898f281e58540ef781a8fb375acc32a9 ]
+
+Currently, the list_lru::shrinker_id corresponding to the nfs4_xattr
+shrinkers is wrong:
+
+>>> prog["nfs4_xattr_cache_lru"].shrinker_id
+(int)0
+>>> prog["nfs4_xattr_entry_lru"].shrinker_id
+(int)0
+>>> prog["nfs4_xattr_large_entry_lru"].shrinker_id
+(int)0
+>>> prog["nfs4_xattr_cache_shrinker"].id
+(int)18
+>>> prog["nfs4_xattr_entry_shrinker"].id
+(int)19
+>>> prog["nfs4_xattr_large_entry_shrinker"].id
+(int)20
+
+This is not what we expect, which will cause these shrinkers
+not to be found in shrink_slab_memcg().
+
+We should assign shrinker::id before calling list_lru_init_memcg(),
+so that the corresponding list_lru::shrinker_id will be assigned
+the correct value like below:
+
+>>> prog["nfs4_xattr_cache_lru"].shrinker_id
+(int)16
+>>> prog["nfs4_xattr_entry_lru"].shrinker_id
+(int)17
+>>> prog["nfs4_xattr_large_entry_lru"].shrinker_id
+(int)18
+>>> prog["nfs4_xattr_cache_shrinker"].id
+(int)16
+>>> prog["nfs4_xattr_entry_shrinker"].id
+(int)17
+>>> prog["nfs4_xattr_large_entry_shrinker"].id
+(int)18
+
+So just do it.
+
+Fixes: 95ad37f90c33 ("NFSv4.2: add client side xattr caching.")
+Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs42xattr.c | 79 +++++++++++++++++++++++++--------------------
+ 1 file changed, 44 insertions(+), 35 deletions(-)
+
+diff --git a/fs/nfs/nfs42xattr.c b/fs/nfs/nfs42xattr.c
+index 76ae118342066..911f634ba3da7 100644
+--- a/fs/nfs/nfs42xattr.c
++++ b/fs/nfs/nfs42xattr.c
+@@ -991,6 +991,29 @@ static void nfs4_xattr_cache_init_once(void *p)
+ INIT_LIST_HEAD(&cache->dispose);
+ }
+
++static int nfs4_xattr_shrinker_init(struct shrinker *shrinker,
++ struct list_lru *lru, const char *name)
++{
++ int ret = 0;
++
++ ret = register_shrinker(shrinker, name);
++ if (ret)
++ return ret;
++
++ ret = list_lru_init_memcg(lru, shrinker);
++ if (ret)
++ unregister_shrinker(shrinker);
++
++ return ret;
++}
++
++static void nfs4_xattr_shrinker_destroy(struct shrinker *shrinker,
++ struct list_lru *lru)
++{
++ unregister_shrinker(shrinker);
++ list_lru_destroy(lru);
++}
++
+ int __init nfs4_xattr_cache_init(void)
+ {
+ int ret = 0;
+@@ -1002,44 +1025,30 @@ int __init nfs4_xattr_cache_init(void)
+ if (nfs4_xattr_cache_cachep == NULL)
+ return -ENOMEM;
+
+- ret = list_lru_init_memcg(&nfs4_xattr_large_entry_lru,
+- &nfs4_xattr_large_entry_shrinker);
+- if (ret)
+- goto out4;
+-
+- ret = list_lru_init_memcg(&nfs4_xattr_entry_lru,
+- &nfs4_xattr_entry_shrinker);
+- if (ret)
+- goto out3;
+-
+- ret = list_lru_init_memcg(&nfs4_xattr_cache_lru,
+- &nfs4_xattr_cache_shrinker);
+- if (ret)
+- goto out2;
+-
+- ret = register_shrinker(&nfs4_xattr_cache_shrinker, "nfs-xattr_cache");
++ ret = nfs4_xattr_shrinker_init(&nfs4_xattr_cache_shrinker,
++ &nfs4_xattr_cache_lru,
++ "nfs-xattr_cache");
+ if (ret)
+ goto out1;
+
+- ret = register_shrinker(&nfs4_xattr_entry_shrinker, "nfs-xattr_entry");
++ ret = nfs4_xattr_shrinker_init(&nfs4_xattr_entry_shrinker,
++ &nfs4_xattr_entry_lru,
++ "nfs-xattr_entry");
+ if (ret)
+- goto out;
++ goto out2;
+
+- ret = register_shrinker(&nfs4_xattr_large_entry_shrinker,
+- "nfs-xattr_large_entry");
++ ret = nfs4_xattr_shrinker_init(&nfs4_xattr_large_entry_shrinker,
++ &nfs4_xattr_large_entry_lru,
++ "nfs-xattr_large_entry");
+ if (!ret)
+ return 0;
+
+- unregister_shrinker(&nfs4_xattr_entry_shrinker);
+-out:
+- unregister_shrinker(&nfs4_xattr_cache_shrinker);
+-out1:
+- list_lru_destroy(&nfs4_xattr_cache_lru);
++ nfs4_xattr_shrinker_destroy(&nfs4_xattr_entry_shrinker,
++ &nfs4_xattr_entry_lru);
+ out2:
+- list_lru_destroy(&nfs4_xattr_entry_lru);
+-out3:
+- list_lru_destroy(&nfs4_xattr_large_entry_lru);
+-out4:
++ nfs4_xattr_shrinker_destroy(&nfs4_xattr_cache_shrinker,
++ &nfs4_xattr_cache_lru);
++out1:
+ kmem_cache_destroy(nfs4_xattr_cache_cachep);
+
+ return ret;
+@@ -1047,11 +1056,11 @@ int __init nfs4_xattr_cache_init(void)
+
+ void nfs4_xattr_cache_exit(void)
+ {
+- unregister_shrinker(&nfs4_xattr_large_entry_shrinker);
+- unregister_shrinker(&nfs4_xattr_entry_shrinker);
+- unregister_shrinker(&nfs4_xattr_cache_shrinker);
+- list_lru_destroy(&nfs4_xattr_large_entry_lru);
+- list_lru_destroy(&nfs4_xattr_entry_lru);
+- list_lru_destroy(&nfs4_xattr_cache_lru);
++ nfs4_xattr_shrinker_destroy(&nfs4_xattr_large_entry_shrinker,
++ &nfs4_xattr_large_entry_lru);
++ nfs4_xattr_shrinker_destroy(&nfs4_xattr_entry_shrinker,
++ &nfs4_xattr_entry_lru);
++ nfs4_xattr_shrinker_destroy(&nfs4_xattr_cache_shrinker,
++ &nfs4_xattr_cache_lru);
+ kmem_cache_destroy(nfs4_xattr_cache_cachep);
+ }
+--
+2.39.2
+
--- /dev/null
+From 80ec0b884de193931cf4c9e1f0aaa7bb715b4de1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Nov 2022 13:24:10 +0200
+Subject: nvme-auth: don't ignore key generation failures when initializing
+ ctrl keys
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 193a8c7e5f1a8481841636cec9c185543ec5c759 ]
+
+nvme_auth_generate_key can fail, don't ignore it upon initialization.
+
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Stable-dep-of: 7ed5cf8e6d9b ("nvme-core: fix dev_pm_qos memleak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/auth.c | 19 +++++++++++++++----
+ drivers/nvme/host/core.c | 6 +++++-
+ drivers/nvme/host/nvme.h | 7 +++++--
+ 3 files changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
+index 1a27d7fb4fa91..9dfd3d0293054 100644
+--- a/drivers/nvme/host/auth.c
++++ b/drivers/nvme/host/auth.c
+@@ -956,15 +956,26 @@ static void nvme_ctrl_auth_work(struct work_struct *work)
+ */
+ }
+
+-void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
++int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
+ {
++ int ret;
++
+ INIT_LIST_HEAD(&ctrl->dhchap_auth_list);
+ INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work);
+ mutex_init(&ctrl->dhchap_auth_mutex);
+ if (!ctrl->opts)
+- return;
+- nvme_auth_generate_key(ctrl->opts->dhchap_secret, &ctrl->host_key);
+- nvme_auth_generate_key(ctrl->opts->dhchap_ctrl_secret, &ctrl->ctrl_key);
++ return 0;
++ ret = nvme_auth_generate_key(ctrl->opts->dhchap_secret,
++ &ctrl->host_key);
++ if (ret)
++ return ret;
++ ret = nvme_auth_generate_key(ctrl->opts->dhchap_ctrl_secret,
++ &ctrl->ctrl_key);
++ if (ret) {
++ nvme_auth_free_key(ctrl->host_key);
++ ctrl->host_key = NULL;
++ }
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(nvme_auth_init_ctrl);
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 2b07a67958b46..09ff0d75aaf38 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -5171,9 +5171,13 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
+
+ nvme_fault_inject_init(&ctrl->fault_inject, dev_name(ctrl->device));
+ nvme_mpath_init_ctrl(ctrl);
+- nvme_auth_init_ctrl(ctrl);
++ ret = nvme_auth_init_ctrl(ctrl);
++ if (ret)
++ goto out_free_cdev;
+
+ return 0;
++out_free_cdev:
++ cdev_device_del(&ctrl->cdev, ctrl->device);
+ out_free_name:
+ nvme_put_ctrl(ctrl);
+ kfree_const(ctrl->device->kobj.name);
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index 5ed771d576c6d..69f9e69208f68 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -1028,13 +1028,16 @@ static inline bool nvme_ctrl_sgl_supported(struct nvme_ctrl *ctrl)
+ }
+
+ #ifdef CONFIG_NVME_AUTH
+-void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl);
++int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl);
+ void nvme_auth_stop(struct nvme_ctrl *ctrl);
+ int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid);
+ int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid);
+ void nvme_auth_free(struct nvme_ctrl *ctrl);
+ #else
+-static inline void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) {};
++static inline int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
++{
++ return 0;
++}
+ static inline void nvme_auth_stop(struct nvme_ctrl *ctrl) {};
+ static inline int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid)
+ {
+--
+2.39.2
+
--- /dev/null
+From 84b34a1452af19b91a032d9d4e996a51a95d2475 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Nov 2022 13:24:17 +0200
+Subject: nvme-auth: no need to reset chap contexts on re-authentication
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit e8a420efb637f52c586596283d6fd96f2a7ecb5c ]
+
+Now that the chap context is reset upon completion, this is no longer
+needed. Also remove nvme_auth_reset as no callers are left.
+
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/auth.c | 13 -------------
+ drivers/nvme/host/core.c | 4 ----
+ drivers/nvme/host/nvme.h | 1 -
+ 3 files changed, 18 deletions(-)
+
+diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
+index 2f823c6b84fd3..1a27d7fb4fa91 100644
+--- a/drivers/nvme/host/auth.c
++++ b/drivers/nvme/host/auth.c
+@@ -920,19 +920,6 @@ int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid)
+ }
+ EXPORT_SYMBOL_GPL(nvme_auth_wait);
+
+-void nvme_auth_reset(struct nvme_ctrl *ctrl)
+-{
+- struct nvme_dhchap_queue_context *chap;
+-
+- mutex_lock(&ctrl->dhchap_auth_mutex);
+- list_for_each_entry(chap, &ctrl->dhchap_auth_list, entry) {
+- mutex_unlock(&ctrl->dhchap_auth_mutex);
+- flush_work(&chap->auth_work);
+- nvme_auth_reset_dhchap(chap);
+- }
+- mutex_unlock(&ctrl->dhchap_auth_mutex);
+-}
+-
+ static void nvme_ctrl_auth_work(struct work_struct *work)
+ {
+ struct nvme_ctrl *ctrl =
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index a7d9b5b42b388..b63511f481a7f 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3832,8 +3832,6 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
+ host_key = ctrl->host_key;
+ ctrl->host_key = key;
+ nvme_auth_free_key(host_key);
+- /* Key has changed; re-authentication with new key */
+- nvme_auth_reset(ctrl);
+ }
+ /* Start re-authentication */
+ dev_info(ctrl->device, "re-authenticating controller\n");
+@@ -3886,8 +3884,6 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
+ ctrl_key = ctrl->ctrl_key;
+ ctrl->ctrl_key = key;
+ nvme_auth_free_key(ctrl_key);
+- /* Key has changed; re-authentication with new key */
+- nvme_auth_reset(ctrl);
+ }
+ /* Start re-authentication */
+ dev_info(ctrl->device, "re-authenticating controller\n");
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index 2aa514c3dfa17..5ed771d576c6d 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -1032,7 +1032,6 @@ void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl);
+ void nvme_auth_stop(struct nvme_ctrl *ctrl);
+ int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid);
+ int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid);
+-void nvme_auth_reset(struct nvme_ctrl *ctrl);
+ void nvme_auth_free(struct nvme_ctrl *ctrl);
+ #else
+ static inline void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) {};
+--
+2.39.2
+
--- /dev/null
+From 1ed286ae7d2f20036c4af08f280ba9d7cc776103 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Nov 2022 13:24:07 +0200
+Subject: nvme-auth: remove symbol export from nvme_auth_reset
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 100b555bc204fc754108351676297805f5affa49 ]
+
+Only the nvme module calls it.
+
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/auth.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
+index e3e801e2b78d5..2f823c6b84fd3 100644
+--- a/drivers/nvme/host/auth.c
++++ b/drivers/nvme/host/auth.c
+@@ -932,7 +932,6 @@ void nvme_auth_reset(struct nvme_ctrl *ctrl)
+ }
+ mutex_unlock(&ctrl->dhchap_auth_mutex);
+ }
+-EXPORT_SYMBOL_GPL(nvme_auth_reset);
+
+ static void nvme_ctrl_auth_work(struct work_struct *work)
+ {
+--
+2.39.2
+
--- /dev/null
+From 7723b221c425cae31f6a2749dddde25d82f43e53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Nov 2022 13:24:05 +0200
+Subject: nvme-auth: rename __nvme_auth_[reset|free] to
+ nvme_auth[reset|free]_dhchap
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 0a7ce375f83f4ade7c2a835444093b6870fb8257 ]
+
+nvme_auth_[reset|free] operate on the controller while
+__nvme_auth_[reset|free] operate on a chap struct (which maps to a queue
+context). Rename it for clarity.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/auth.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
+index c8a6db7c44980..d45333268fcf6 100644
+--- a/drivers/nvme/host/auth.c
++++ b/drivers/nvme/host/auth.c
+@@ -654,7 +654,7 @@ static int nvme_auth_dhchap_exponential(struct nvme_ctrl *ctrl,
+ return 0;
+ }
+
+-static void __nvme_auth_reset(struct nvme_dhchap_queue_context *chap)
++static void nvme_auth_reset_dhchap(struct nvme_dhchap_queue_context *chap)
+ {
+ kfree_sensitive(chap->host_response);
+ chap->host_response = NULL;
+@@ -676,9 +676,9 @@ static void __nvme_auth_reset(struct nvme_dhchap_queue_context *chap)
+ memset(chap->c2, 0, sizeof(chap->c2));
+ }
+
+-static void __nvme_auth_free(struct nvme_dhchap_queue_context *chap)
++static void nvme_auth_free_dhchap(struct nvme_dhchap_queue_context *chap)
+ {
+- __nvme_auth_reset(chap);
++ nvme_auth_reset_dhchap(chap);
+ if (chap->shash_tfm)
+ crypto_free_shash(chap->shash_tfm);
+ if (chap->dh_tfm)
+@@ -868,7 +868,7 @@ int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid)
+ dev_dbg(ctrl->device, "qid %d: re-using context\n", qid);
+ mutex_unlock(&ctrl->dhchap_auth_mutex);
+ flush_work(&chap->auth_work);
+- __nvme_auth_reset(chap);
++ nvme_auth_reset_dhchap(chap);
+ queue_work(nvme_wq, &chap->auth_work);
+ return 0;
+ }
+@@ -928,7 +928,7 @@ void nvme_auth_reset(struct nvme_ctrl *ctrl)
+ list_for_each_entry(chap, &ctrl->dhchap_auth_list, entry) {
+ mutex_unlock(&ctrl->dhchap_auth_mutex);
+ flush_work(&chap->auth_work);
+- __nvme_auth_reset(chap);
++ nvme_auth_reset_dhchap(chap);
+ }
+ mutex_unlock(&ctrl->dhchap_auth_mutex);
+ }
+@@ -1002,7 +1002,7 @@ void nvme_auth_free(struct nvme_ctrl *ctrl)
+ list_for_each_entry_safe(chap, tmp, &ctrl->dhchap_auth_list, entry) {
+ list_del_init(&chap->entry);
+ flush_work(&chap->auth_work);
+- __nvme_auth_free(chap);
++ nvme_auth_free_dhchap(chap);
+ }
+ mutex_unlock(&ctrl->dhchap_auth_mutex);
+ if (ctrl->host_key) {
+--
+2.39.2
+
--- /dev/null
+From b031b14d062a69d0c4126fb3206cf141f153a02b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Nov 2022 13:24:06 +0200
+Subject: nvme-auth: rename authentication work elements
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 0c999e69c40a87285f910c400b550fad866e99d0 ]
+
+Use nvme_ctrl_auth_work and nvme_queue_auth_work for better
+readability.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/auth.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
+index d45333268fcf6..e3e801e2b78d5 100644
+--- a/drivers/nvme/host/auth.c
++++ b/drivers/nvme/host/auth.c
+@@ -691,7 +691,7 @@ static void nvme_auth_free_dhchap(struct nvme_dhchap_queue_context *chap)
+ kfree(chap);
+ }
+
+-static void __nvme_auth_work(struct work_struct *work)
++static void nvme_queue_auth_work(struct work_struct *work)
+ {
+ struct nvme_dhchap_queue_context *chap =
+ container_of(work, struct nvme_dhchap_queue_context, auth_work);
+@@ -893,7 +893,7 @@ int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid)
+ return -ENOMEM;
+ }
+
+- INIT_WORK(&chap->auth_work, __nvme_auth_work);
++ INIT_WORK(&chap->auth_work, nvme_queue_auth_work);
+ list_add(&chap->entry, &ctrl->dhchap_auth_list);
+ mutex_unlock(&ctrl->dhchap_auth_mutex);
+ queue_work(nvme_wq, &chap->auth_work);
+@@ -934,7 +934,7 @@ void nvme_auth_reset(struct nvme_ctrl *ctrl)
+ }
+ EXPORT_SYMBOL_GPL(nvme_auth_reset);
+
+-static void nvme_dhchap_auth_work(struct work_struct *work)
++static void nvme_ctrl_auth_work(struct work_struct *work)
+ {
+ struct nvme_ctrl *ctrl =
+ container_of(work, struct nvme_ctrl, dhchap_auth_work);
+@@ -973,7 +973,7 @@ static void nvme_dhchap_auth_work(struct work_struct *work)
+ void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
+ {
+ INIT_LIST_HEAD(&ctrl->dhchap_auth_list);
+- INIT_WORK(&ctrl->dhchap_auth_work, nvme_dhchap_auth_work);
++ INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work);
+ mutex_init(&ctrl->dhchap_auth_mutex);
+ if (!ctrl->opts)
+ return;
+--
+2.39.2
+
--- /dev/null
+From ea806312217dc01c9b06c3752743b9a8792cae2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 00:31:14 -0700
+Subject: nvme-core: add missing fault-injection cleanup
+
+From: Chaitanya Kulkarni <kch@nvidia.com>
+
+[ Upstream commit 3a12a0b868a512fcada564699d00f5e652c0998c ]
+
+Add missing fault-injection cleanup in nvme_init_ctrl() in the error
+unwind path that also fixes following message for blktests:-
+
+linux-block (for-next) # grep debugfs debugfs-err.log
+[ 147.853464] debugfs: Directory 'nvme1' with parent '/' already present!
+[ 147.853973] nvme1: failed to create debugfs attr
+[ 148.802490] debugfs: Directory 'nvme1' with parent '/' already present!
+[ 148.803244] nvme1: failed to create debugfs attr
+[ 148.877304] debugfs: Directory 'nvme1' with parent '/' already present!
+[ 148.877775] nvme1: failed to create debugfs attr
+[ 149.816652] debugfs: Directory 'nvme1' with parent '/' already present!
+[ 149.818011] nvme1: failed to create debugfs attr
+
+Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
+Tested-by: Yi Zhang <yi.zhang@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Stable-dep-of: 7ed5cf8e6d9b ("nvme-core: fix dev_pm_qos memleak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 09ff0d75aaf38..8414e1a036464 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -5177,6 +5177,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
+
+ return 0;
+ out_free_cdev:
++ nvme_fault_inject_fini(&ctrl->fault_inject);
+ cdev_device_del(&ctrl->cdev, ctrl->device);
+ out_free_name:
+ nvme_put_ctrl(ctrl);
+--
+2.39.2
+
--- /dev/null
+From a7f4beb7f878b5d3e4efdf9220c2ea93fca8b9e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 00:31:15 -0700
+Subject: nvme-core: fix dev_pm_qos memleak
+
+From: Chaitanya Kulkarni <kch@nvidia.com>
+
+[ Upstream commit 7ed5cf8e6d9bfb6a78d0471317edff14f0f2b4dd ]
+
+Call dev_pm_qos_hide_latency_tolerance() in the error unwind patch to
+avoid following kmemleak:-
+
+blktests (master) # kmemleak-clear; ./check nvme/044;
+blktests (master) # kmemleak-scan ; kmemleak-show
+nvme/044 (Test bi-directional authentication) [passed]
+ runtime 2.111s ... 2.124s
+unreferenced object 0xffff888110c46240 (size 96):
+ comm "nvme", pid 33461, jiffies 4345365353 (age 75.586s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<0000000069ac2cec>] kmalloc_trace+0x25/0x90
+ [<000000006acc66d5>] dev_pm_qos_update_user_latency_tolerance+0x6f/0x100
+ [<00000000cc376ea7>] nvme_init_ctrl+0x38e/0x410 [nvme_core]
+ [<000000007df61b4b>] 0xffffffffc05e88b3
+ [<00000000d152b985>] 0xffffffffc05744cb
+ [<00000000f04a4041>] vfs_write+0xc5/0x3c0
+ [<00000000f9491baf>] ksys_write+0x5f/0xe0
+ [<000000001c46513d>] do_syscall_64+0x3b/0x90
+ [<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+
+Link: https://lore.kernel.org/linux-nvme/CAHj4cs-nDaKzMx2txO4dbE+Mz9ePwLtU0e3egz+StmzOUgWUrA@mail.gmail.com/
+Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
+Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
+Tested-by: Yi Zhang <yi.zhang@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 8414e1a036464..560ce2f05a96d 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -5178,6 +5178,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
+ return 0;
+ out_free_cdev:
+ nvme_fault_inject_fini(&ctrl->fault_inject);
++ dev_pm_qos_hide_latency_tolerance(ctrl->device);
+ cdev_device_del(&ctrl->cdev, ctrl->device);
+ out_free_name:
+ nvme_put_ctrl(ctrl);
+--
+2.39.2
+
--- /dev/null
+From 516bf6424106f02351c6f78b0edf5b9de2dd4c97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 00:31:13 -0700
+Subject: nvme-core: fix memory leak in dhchap_ctrl_secret
+
+From: Chaitanya Kulkarni <kch@nvidia.com>
+
+[ Upstream commit 99c2dcc8ffc24e210a3aa05c204d92f3ef460b05 ]
+
+Free dhchap_secret in nvme_ctrl_dhchap_ctrl_secret_store() before we
+return when nvme_auth_generate_key() returns error.
+
+Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
+Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 3956164272253..2b07a67958b46 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3880,14 +3880,17 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
+ int ret;
+
+ ret = nvme_auth_generate_key(dhchap_secret, &key);
+- if (ret)
++ if (ret) {
++ kfree(dhchap_secret);
+ return ret;
++ }
+ kfree(opts->dhchap_ctrl_secret);
+ opts->dhchap_ctrl_secret = dhchap_secret;
+ ctrl_key = ctrl->ctrl_key;
+ ctrl->ctrl_key = key;
+ nvme_auth_free_key(ctrl_key);
+- }
++ } else
++ kfree(dhchap_secret);
+ /* Start re-authentication */
+ dev_info(ctrl->device, "re-authenticating controller\n");
+ queue_work(nvme_wq, &ctrl->dhchap_auth_work);
+--
+2.39.2
+
--- /dev/null
+From a91b43cd5d0403e9fa080b236f1d4f60a3f80a6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 00:31:12 -0700
+Subject: nvme-core: fix memory leak in dhchap_secret_store
+
+From: Chaitanya Kulkarni <kch@nvidia.com>
+
+[ Upstream commit a836ca33c5b07d34dd5347af9f64d25651d12674 ]
+
+Free dhchap_secret in nvme_ctrl_dhchap_secret_store() before we return
+fix following kmemleack:-
+
+unreferenced object 0xffff8886376ea800 (size 64):
+ comm "check", pid 22048, jiffies 4344316705 (age 92.199s)
+ hex dump (first 32 bytes):
+ 44 48 48 43 2d 31 3a 30 30 3a 6e 78 72 35 4b 67 DHHC-1:00:nxr5Kg
+ 75 58 34 75 6f 41 78 73 4a 61 34 63 2f 68 75 4c uX4uoAxsJa4c/huL
+ backtrace:
+ [<0000000030ce5d4b>] __kmalloc+0x4b/0x130
+ [<000000009be1cdc1>] nvme_ctrl_dhchap_secret_store+0x8f/0x160 [nvme_core]
+ [<00000000ac06c96a>] kernfs_fop_write_iter+0x12b/0x1c0
+ [<00000000437e7ced>] vfs_write+0x2ba/0x3c0
+ [<00000000f9491baf>] ksys_write+0x5f/0xe0
+ [<000000001c46513d>] do_syscall_64+0x3b/0x90
+ [<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+unreferenced object 0xffff8886376eaf00 (size 64):
+ comm "check", pid 22048, jiffies 4344316736 (age 92.168s)
+ hex dump (first 32 bytes):
+ 44 48 48 43 2d 31 3a 30 30 3a 6e 78 72 35 4b 67 DHHC-1:00:nxr5Kg
+ 75 58 34 75 6f 41 78 73 4a 61 34 63 2f 68 75 4c uX4uoAxsJa4c/huL
+ backtrace:
+ [<0000000030ce5d4b>] __kmalloc+0x4b/0x130
+ [<000000009be1cdc1>] nvme_ctrl_dhchap_secret_store+0x8f/0x160 [nvme_core]
+ [<00000000ac06c96a>] kernfs_fop_write_iter+0x12b/0x1c0
+ [<00000000437e7ced>] vfs_write+0x2ba/0x3c0
+ [<00000000f9491baf>] ksys_write+0x5f/0xe0
+ [<000000001c46513d>] do_syscall_64+0x3b/0x90
+ [<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+
+Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
+Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
+Tested-by: Yi Zhang <yi.zhang@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index b63511f481a7f..3956164272253 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3825,14 +3825,17 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
+ int ret;
+
+ ret = nvme_auth_generate_key(dhchap_secret, &key);
+- if (ret)
++ if (ret) {
++ kfree(dhchap_secret);
+ return ret;
++ }
+ kfree(opts->dhchap_secret);
+ opts->dhchap_secret = dhchap_secret;
+ host_key = ctrl->host_key;
+ ctrl->host_key = key;
+ nvme_auth_free_key(host_key);
+- }
++ } else
++ kfree(dhchap_secret);
+ /* Start re-authentication */
+ dev_info(ctrl->device, "re-authenticating controller\n");
+ queue_work(nvme_wq, &ctrl->dhchap_auth_work);
+--
+2.39.2
+
--- /dev/null
+From 21f73dfa2db4bc8bd0e2c905e6d25a126ed61506 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jun 2023 23:55:10 +0100
+Subject: ocfs2: Fix use of slab data with sendpage
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 86d7bd6e66e9925f0f04a7bcf3c92c05fdfefb5a ]
+
+ocfs2 uses kzalloc() to allocate buffers for o2net_hand, o2net_keep_req and
+o2net_keep_resp and then passes these to sendpage. This isn't really
+allowed as the lifetime of slab objects is not controlled by page ref -
+though in this case it will probably work. sendmsg() with MSG_SPLICE_PAGES
+will, however, print a warning and give an error.
+
+Fix it to use folio_alloc() instead to allocate a buffer for the handshake
+message, keepalive request and reply messages.
+
+Fixes: 98211489d414 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Mark Fasheh <mark@fasheh.com>
+cc: Kurt Hackel <kurt.hackel@oracle.com>
+cc: Joel Becker <jlbec@evilplan.org>
+cc: Joseph Qi <joseph.qi@linux.alibaba.com>
+cc: ocfs2-devel@oss.oracle.com
+Link: https://lore.kernel.org/r/20230623225513.2732256-14-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/cluster/tcp.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
+index 785cabd71d670..4e083e25d0e7d 100644
+--- a/fs/ocfs2/cluster/tcp.c
++++ b/fs/ocfs2/cluster/tcp.c
+@@ -2083,18 +2083,24 @@ void o2net_stop_listening(struct o2nm_node *node)
+
+ int o2net_init(void)
+ {
++ struct folio *folio;
++ void *p;
+ unsigned long i;
+
+ o2quo_init();
+-
+ o2net_debugfs_init();
+
+- o2net_hand = kzalloc(sizeof(struct o2net_handshake), GFP_KERNEL);
+- o2net_keep_req = kzalloc(sizeof(struct o2net_msg), GFP_KERNEL);
+- o2net_keep_resp = kzalloc(sizeof(struct o2net_msg), GFP_KERNEL);
+- if (!o2net_hand || !o2net_keep_req || !o2net_keep_resp)
++ folio = folio_alloc(GFP_KERNEL | __GFP_ZERO, 0);
++ if (!folio)
+ goto out;
+
++ p = folio_address(folio);
++ o2net_hand = p;
++ p += sizeof(struct o2net_handshake);
++ o2net_keep_req = p;
++ p += sizeof(struct o2net_msg);
++ o2net_keep_resp = p;
++
+ o2net_hand->protocol_version = cpu_to_be64(O2NET_PROTOCOL_VERSION);
+ o2net_hand->connector_id = cpu_to_be64(1);
+
+@@ -2120,9 +2126,6 @@ int o2net_init(void)
+ return 0;
+
+ out:
+- kfree(o2net_hand);
+- kfree(o2net_keep_req);
+- kfree(o2net_keep_resp);
+ o2net_debugfs_exit();
+ o2quo_exit();
+ return -ENOMEM;
+@@ -2131,8 +2134,6 @@ int o2net_init(void)
+ void o2net_exit(void)
+ {
+ o2quo_exit();
+- kfree(o2net_hand);
+- kfree(o2net_keep_req);
+- kfree(o2net_keep_resp);
+ o2net_debugfs_exit();
++ folio_put(virt_to_folio(o2net_hand));
+ }
+--
+2.39.2
+
--- /dev/null
+From 8799048dc96af937b7e3018aa174f6c27bdd0b51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 11:29:59 +0300
+Subject: ovl: update of dentry revalidate flags after copy up
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit b07d5cc93e1b28df47a72c519d09d0a836043613 ]
+
+After copy up, we may need to update d_flags if upper dentry is on a
+remote fs and lower dentries are not.
+
+Add helpers to allow incremental update of the revalidate flags.
+
+Fixes: bccece1ead36 ("ovl: allow remote upper")
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/copy_up.c | 2 ++
+ fs/overlayfs/dir.c | 3 +--
+ fs/overlayfs/export.c | 3 +--
+ fs/overlayfs/namei.c | 3 +--
+ fs/overlayfs/overlayfs.h | 6 ++++--
+ fs/overlayfs/super.c | 2 +-
+ fs/overlayfs/util.c | 24 ++++++++++++++++++++----
+ 7 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 91a95bfad0d1c..edc1ebff33f5a 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -538,6 +538,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c)
+ /* Restore timestamps on parent (best effort) */
+ ovl_set_timestamps(ofs, upperdir, &c->pstat);
+ ovl_dentry_set_upper_alias(c->dentry);
++ ovl_dentry_update_reval(c->dentry, upper);
+ }
+ }
+ inode_unlock(udir);
+@@ -857,6 +858,7 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
+ inode_unlock(udir);
+
+ ovl_dentry_set_upper_alias(c->dentry);
++ ovl_dentry_update_reval(c->dentry, ovl_dentry_upper(c->dentry));
+ }
+
+ out:
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index c3032cef391ef..5339ff08bd0f4 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -269,8 +269,7 @@ static int ovl_instantiate(struct dentry *dentry, struct inode *inode,
+
+ ovl_dir_modified(dentry->d_parent, false);
+ ovl_dentry_set_upper_alias(dentry);
+- ovl_dentry_update_reval(dentry, newdentry,
+- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);
++ ovl_dentry_init_reval(dentry, newdentry);
+
+ if (!hardlink) {
+ /*
+diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c
+index ac9c3ad04016e..e55363d343dc6 100644
+--- a/fs/overlayfs/export.c
++++ b/fs/overlayfs/export.c
+@@ -326,8 +326,7 @@ static struct dentry *ovl_obtain_alias(struct super_block *sb,
+ if (upper_alias)
+ ovl_dentry_set_upper_alias(dentry);
+
+- ovl_dentry_update_reval(dentry, upper,
+- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);
++ ovl_dentry_init_reval(dentry, upper);
+
+ return d_instantiate_anon(dentry, inode);
+
+diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
+index 0fd1d5fdfc728..655d08d6f3f17 100644
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -1116,8 +1116,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
+ ovl_set_flag(OVL_UPPERDATA, inode);
+ }
+
+- ovl_dentry_update_reval(dentry, upperdentry,
+- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);
++ ovl_dentry_init_reval(dentry, upperdentry);
+
+ revert_creds(old_cred);
+ if (origin_path) {
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index e74a610a117ec..052226aa7de09 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -360,8 +360,10 @@ bool ovl_index_all(struct super_block *sb);
+ bool ovl_verify_lower(struct super_block *sb);
+ struct ovl_entry *ovl_alloc_entry(unsigned int numlower);
+ bool ovl_dentry_remote(struct dentry *dentry);
+-void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *upperdentry,
+- unsigned int mask);
++void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *realdentry);
++void ovl_dentry_init_reval(struct dentry *dentry, struct dentry *upperdentry);
++void ovl_dentry_init_flags(struct dentry *dentry, struct dentry *upperdentry,
++ unsigned int mask);
+ bool ovl_dentry_weird(struct dentry *dentry);
+ enum ovl_path_type ovl_path_type(struct dentry *dentry);
+ void ovl_path_upper(struct dentry *dentry, struct path *path);
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 3d14a3f1465d1..51eec4a8e82b2 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -1980,7 +1980,7 @@ static struct dentry *ovl_get_root(struct super_block *sb,
+ ovl_dentry_set_flag(OVL_E_CONNECTED, root);
+ ovl_set_upperdata(d_inode(root));
+ ovl_inode_init(d_inode(root), &oip, ino, fsid);
+- ovl_dentry_update_reval(root, upperdentry, DCACHE_OP_WEAK_REVALIDATE);
++ ovl_dentry_init_flags(root, upperdentry, DCACHE_OP_WEAK_REVALIDATE);
+
+ return root;
+ }
+diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
+index 81a57a8d80d9a..850e8d1bf8296 100644
+--- a/fs/overlayfs/util.c
++++ b/fs/overlayfs/util.c
+@@ -94,14 +94,30 @@ struct ovl_entry *ovl_alloc_entry(unsigned int numlower)
+ return oe;
+ }
+
++#define OVL_D_REVALIDATE (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE)
++
+ bool ovl_dentry_remote(struct dentry *dentry)
+ {
+- return dentry->d_flags &
+- (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);
++ return dentry->d_flags & OVL_D_REVALIDATE;
++}
++
++void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *realdentry)
++{
++ if (!ovl_dentry_remote(realdentry))
++ return;
++
++ spin_lock(&dentry->d_lock);
++ dentry->d_flags |= realdentry->d_flags & OVL_D_REVALIDATE;
++ spin_unlock(&dentry->d_lock);
++}
++
++void ovl_dentry_init_reval(struct dentry *dentry, struct dentry *upperdentry)
++{
++ return ovl_dentry_init_flags(dentry, upperdentry, OVL_D_REVALIDATE);
+ }
+
+-void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *upperdentry,
+- unsigned int mask)
++void ovl_dentry_init_flags(struct dentry *dentry, struct dentry *upperdentry,
++ unsigned int mask)
+ {
+ struct ovl_entry *oe = OVL_E(dentry);
+ unsigned int i, flags = 0;
+--
+2.39.2
+
--- /dev/null
+From 06433eb4181aa5fce24fb9a5baa1bc0df11bcf11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 18:27:44 +0800
+Subject: PCI: Add pci_clear_master() stub for non-CONFIG_PCI
+
+From: Sui Jingfeng <suijingfeng@loongson.cn>
+
+[ Upstream commit 2aa5ac633259843f656eb6ecff4cf01e8e810c5e ]
+
+Add a pci_clear_master() stub when CONFIG_PCI is not set so drivers that
+support both PCI and platform devices don't need #ifdefs or extra Kconfig
+symbols for the PCI parts.
+
+[bhelgaas: commit log]
+Fixes: 6a479079c072 ("PCI: Add pci_clear_master() as opposite of pci_set_master()")
+Link: https://lore.kernel.org/r/20230531102744.2354313-1-suijingfeng@loongson.cn
+Signed-off-by: Sui Jingfeng <suijingfeng@loongson.cn>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pci.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index d20695184e0b9..9f617ffdb863f 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1809,6 +1809,7 @@ static inline int pci_dev_present(const struct pci_device_id *ids)
+ #define pci_dev_put(dev) do { } while (0)
+
+ static inline void pci_set_master(struct pci_dev *dev) { }
++static inline void pci_clear_master(struct pci_dev *dev) { }
+ static inline int pci_enable_device(struct pci_dev *dev) { return -EIO; }
+ static inline void pci_disable_device(struct pci_dev *dev) { }
+ static inline int pcim_enable_device(struct pci_dev *pdev) { return -EIO; }
+--
+2.39.2
+
--- /dev/null
+From b732c107b42619455e4bf0b61eec1dbe2b964b59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 May 2023 11:40:57 +0800
+Subject: PCI/ASPM: Disable ASPM on MFD function removal to avoid
+ use-after-free
+
+From: Ding Hui <dinghui@sangfor.com.cn>
+
+[ Upstream commit 456d8aa37d0f56fc9e985e812496e861dcd6f2f2 ]
+
+Struct pcie_link_state->downstream is a pointer to the pci_dev of function
+0. Previously we retained that pointer when removing function 0, and
+subsequent ASPM policy changes dereferenced it, resulting in a
+use-after-free warning from KASAN, e.g.:
+
+ # echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove
+ # echo powersave > /sys/module/pcie_aspm/parameters/policy
+
+ BUG: KASAN: slab-use-after-free in pcie_config_aspm_link+0x42d/0x500
+ Call Trace:
+ kasan_report+0xae/0xe0
+ pcie_config_aspm_link+0x42d/0x500
+ pcie_aspm_set_policy+0x8e/0x1a0
+ param_attr_store+0x162/0x2c0
+ module_attr_store+0x3e/0x80
+
+PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM
+Control value in all functions of multi-function devices.
+
+Disable ASPM and free the pcie_link_state when any child function is
+removed so we can discard the dangling pcie_link_state->downstream pointer
+and maintain the same ASPM Control configuration for all functions.
+
+[bhelgaas: commit log and comment]
+Debugged-by: Zongquan Qin <qinzongquan@sangfor.com.cn>
+Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
+Fixes: b5a0a9b59c81 ("PCI/ASPM: Read and set up L1 substate capabilities")
+Link: https://lore.kernel.org/r/20230507034057.20970-1-dinghui@sangfor.com.cn
+Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aspm.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 4b4184563a927..74b8183c305df 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -1010,21 +1010,24 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
+
+ down_read(&pci_bus_sem);
+ mutex_lock(&aspm_lock);
+- /*
+- * All PCIe functions are in one slot, remove one function will remove
+- * the whole slot, so just wait until we are the last function left.
+- */
+- if (!list_empty(&parent->subordinate->devices))
+- goto out;
+
+ link = parent->link_state;
+ root = link->root;
+ parent_link = link->parent;
+
+- /* All functions are removed, so just disable ASPM for the link */
++ /*
++ * link->downstream is a pointer to the pci_dev of function 0. If
++ * we remove that function, the pci_dev is about to be deallocated,
++ * so we can't use link->downstream again. Free the link state to
++ * avoid this.
++ *
++ * If we're removing a non-0 function, it's possible we could
++ * retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends
++ * programming the same ASPM Control value for all functions of
++ * multi-function devices, so disable ASPM for all of them.
++ */
+ pcie_config_aspm_link(link, 0);
+ list_del(&link->sibling);
+- /* Clock PM is for endpoint device */
+ free_link_state(link);
+
+ /* Recheck latencies and configure upstream links */
+@@ -1032,7 +1035,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
+ pcie_update_aspm_capable(root);
+ pcie_config_aspm_path(parent_link);
+ }
+-out:
++
+ mutex_unlock(&aspm_lock);
+ up_read(&pci_bus_sem);
+ }
+--
+2.39.2
+
--- /dev/null
+From e9853bb636341df0522995e1c70819a3727d8284 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 12:38:00 +0530
+Subject: PCI: cadence: Fix Gen2 Link Retraining process
+
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+
+[ Upstream commit 0e12f830236928b6fadf40d917a7527f0a048d2f ]
+
+The Link Retraining process is initiated to account for the Gen2 defect in
+the Cadence PCIe controller in J721E SoC. The errata corresponding to this
+is i2085, documented at:
+https://www.ti.com/lit/er/sprz455c/sprz455c.pdf
+
+The existing workaround implemented for the errata waits for the Data Link
+initialization to complete and assumes that the link retraining process
+at the Physical Layer has completed. However, it is possible that the
+Physical Layer training might be ongoing as indicated by the
+PCI_EXP_LNKSTA_LT bit in the PCI_EXP_LNKSTA register.
+
+Fix the existing workaround, to ensure that the Physical Layer training
+has also completed, in addition to the Data Link initialization.
+
+Link: https://lore.kernel.org/r/20230315070800.1615527-1-s-vadapalli@ti.com
+Fixes: 4740b969aaf5 ("PCI: cadence: Retrain Link to work around Gen2 training defect")
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../controller/cadence/pcie-cadence-host.c | 27 +++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index 940c7dd701d68..5b14f7ee3c798 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -12,6 +12,8 @@
+
+ #include "pcie-cadence.h"
+
++#define LINK_RETRAIN_TIMEOUT HZ
++
+ static u64 bar_max_size[] = {
+ [RP_BAR0] = _ULL(128 * SZ_2G),
+ [RP_BAR1] = SZ_2G,
+@@ -77,6 +79,27 @@ static struct pci_ops cdns_pcie_host_ops = {
+ .write = pci_generic_config_write,
+ };
+
++static int cdns_pcie_host_training_complete(struct cdns_pcie *pcie)
++{
++ u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
++ unsigned long end_jiffies;
++ u16 lnk_stat;
++
++ /* Wait for link training to complete. Exit after timeout. */
++ end_jiffies = jiffies + LINK_RETRAIN_TIMEOUT;
++ do {
++ lnk_stat = cdns_pcie_rp_readw(pcie, pcie_cap_off + PCI_EXP_LNKSTA);
++ if (!(lnk_stat & PCI_EXP_LNKSTA_LT))
++ break;
++ usleep_range(0, 1000);
++ } while (time_before(jiffies, end_jiffies));
++
++ if (!(lnk_stat & PCI_EXP_LNKSTA_LT))
++ return 0;
++
++ return -ETIMEDOUT;
++}
++
+ static int cdns_pcie_host_wait_for_link(struct cdns_pcie *pcie)
+ {
+ struct device *dev = pcie->dev;
+@@ -118,6 +141,10 @@ static int cdns_pcie_retrain(struct cdns_pcie *pcie)
+ cdns_pcie_rp_writew(pcie, pcie_cap_off + PCI_EXP_LNKCTL,
+ lnk_ctl);
+
++ ret = cdns_pcie_host_training_complete(pcie);
++ if (ret)
++ return ret;
++
+ ret = cdns_pcie_host_wait_for_link(pcie);
+ }
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From 6c4b1f8e548f994f4503c701a1ecf50299c43d34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 19:38:32 +0900
+Subject: PCI: endpoint: Fix a Kconfig prompt of vNTB driver
+
+From: Shunsuke Mie <mie@igel.co.jp>
+
+[ Upstream commit 37587673cda963ec950e4983db5023802f9b5ff2 ]
+
+vNTB driver and NTB driver have same Kconfig prompt. Changed to make it
+distinguishable.
+
+Link: https://lore.kernel.org/r/20230202103832.2038286-1-mie@igel.co.jp
+Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP")
+Signed-off-by: Shunsuke Mie <mie@igel.co.jp>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/endpoint/functions/Kconfig b/drivers/pci/endpoint/functions/Kconfig
+index 9fd5608868718..8efb6a869e7ce 100644
+--- a/drivers/pci/endpoint/functions/Kconfig
++++ b/drivers/pci/endpoint/functions/Kconfig
+@@ -27,7 +27,7 @@ config PCI_EPF_NTB
+ If in doubt, say "N" to disable Endpoint NTB driver.
+
+ config PCI_EPF_VNTB
+- tristate "PCI Endpoint NTB driver"
++ tristate "PCI Endpoint Virtual NTB driver"
+ depends on PCI_ENDPOINT
+ depends on NTB
+ select CONFIGFS_FS
+--
+2.39.2
+
--- /dev/null
+From dbd6d99d576c2985f19481cc5beb8415de4ac128 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Aug 2022 11:50:06 +0900
+Subject: PCI: endpoint: Fix Kconfig indent style
+
+From: Shunsuke Mie <mie@igel.co.jp>
+
+[ Upstream commit 2759ddf7535d63381f9b9b1412e4c46e13ed773a ]
+
+Change to follow the Kconfig style guide. This patch fixes to use tab
+rather than space to indent, while help text is indented an additional
+two spaces.
+
+Link: https://lore.kernel.org/r/20220815025006.48167-1-mie@igel.co.jp
+Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP")
+Signed-off-by: Shunsuke Mie <mie@igel.co.jp>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Stable-dep-of: 37587673cda9 ("PCI: endpoint: Fix a Kconfig prompt of vNTB driver")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/Kconfig | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/endpoint/functions/Kconfig b/drivers/pci/endpoint/functions/Kconfig
+index 295a033ee9a27..9fd5608868718 100644
+--- a/drivers/pci/endpoint/functions/Kconfig
++++ b/drivers/pci/endpoint/functions/Kconfig
+@@ -27,13 +27,13 @@ config PCI_EPF_NTB
+ If in doubt, say "N" to disable Endpoint NTB driver.
+
+ config PCI_EPF_VNTB
+- tristate "PCI Endpoint NTB driver"
+- depends on PCI_ENDPOINT
+- depends on NTB
+- select CONFIGFS_FS
+- help
+- Select this configuration option to enable the Non-Transparent
+- Bridge (NTB) driver for PCIe Endpoint. NTB driver implements NTB
+- between PCI Root Port and PCIe Endpoint.
++ tristate "PCI Endpoint NTB driver"
++ depends on PCI_ENDPOINT
++ depends on NTB
++ select CONFIGFS_FS
++ help
++ Select this configuration option to enable the Non-Transparent
++ Bridge (NTB) driver for PCIe Endpoint. NTB driver implements NTB
++ between PCI Root Port and PCIe Endpoint.
+
+- If in doubt, say "N" to disable Endpoint NTB driver.
++ If in doubt, say "N" to disable Endpoint NTB driver.
+--
+2.39.2
+
--- /dev/null
+From 71ff456d75d2639b827e3777365dcd6703cb2db7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 15:34:47 +0900
+Subject: PCI: endpoint: functions/pci-epf-test: Fix dma_chan direction
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 880d51c729a3fa944794feb19f605eefe55916fc ]
+
+In pci_epf_test_init_dma_chan() epf_test->dma_chan_rx is assigned from
+dma_request_channel() with DMA_DEV_TO_MEM as filter.dma_mask.
+
+However, in pci_epf_test_data_transfer() if the dir is DMA_DEV_TO_MEM,
+epf->dma_chan_rx should be used but instead we are using
+epf_test->dma_chan_tx.
+
+Fix it.
+
+Link: https://lore.kernel.org/r/20230412063447.2841177-1-yoshihiro.shimoda.uh@renesas.com
+Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities")
+Tested-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
+index 55283d2379a6a..f0c4d0f77453a 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-test.c
++++ b/drivers/pci/endpoint/functions/pci-epf-test.c
+@@ -112,7 +112,7 @@ static int pci_epf_test_data_transfer(struct pci_epf_test *epf_test,
+ size_t len, dma_addr_t dma_remote,
+ enum dma_transfer_direction dir)
+ {
+- struct dma_chan *chan = (dir == DMA_DEV_TO_MEM) ?
++ struct dma_chan *chan = (dir == DMA_MEM_TO_DEV) ?
+ epf_test->dma_chan_tx : epf_test->dma_chan_rx;
+ dma_addr_t dma_local = (dir == DMA_MEM_TO_DEV) ? dma_src : dma_dst;
+ enum dma_ctrl_flags flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT;
+--
+2.39.2
+
--- /dev/null
+From d7d2a2b884d6cec8faef4b54fe64b23b079b01c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 12:36:41 +0800
+Subject: PCI: ftpci100: Release the clock resources
+
+From: Junyan Ye <yejunyan@hust.edu.cn>
+
+[ Upstream commit c60738de85f40b0b9f5cb23c21f9246e5a47908c ]
+
+Smatch reported:
+1. drivers/pci/controller/pci-ftpci100.c:526 faraday_pci_probe() warn:
+'clk' from clk_prepare_enable() not released on lines: 442,451,462,478,512,517.
+2. drivers/pci/controller/pci-ftpci100.c:526 faraday_pci_probe() warn:
+'p->bus_clk' from clk_prepare_enable() not released on lines: 451,462,478,512,517.
+
+The clock resource is obtained by devm_clk_get(), and then
+clk_prepare_enable() makes the clock resource ready for use. After that,
+clk_disable_unprepare() should be called to release the clock resource
+when it is no longer needed. However, while doing some error handling
+in faraday_pci_probe(), clk_disable_unprepare() is not called to release
+clk and p->bus_clk before returning. These return lines are exactly 442,
+451, 462, 478, 512, 517.
+
+Fix this warning by replacing devm_clk_get() with devm_clk_get_enabled(),
+which is equivalent to devm_clk_get() + clk_prepare_enable(). And with
+devm_clk_get_enabled(), the clock will automatically be disabled,
+unprepared and freed when the device is unbound from the bus.
+
+Link: https://lore.kernel.org/r/20230508043641.23807-1-yejunyan@hust.edu.cn
+Fixes: b3c433efb8a3 ("PCI: faraday: Fix wrong pointer passed to PTR_ERR()")
+Fixes: 2eeb02b28579 ("PCI: faraday: Add clock handling")
+Fixes: 783a862563f7 ("PCI: faraday: Use pci_parse_request_of_pci_ranges()")
+Fixes: d3c68e0a7e34 ("PCI: faraday: Add Faraday Technology FTPCI100 PCI Host Bridge driver")
+Fixes: f1e8bd21e39e ("PCI: faraday: Convert IRQ masking to raw PCI config accessors")
+Signed-off-by: Junyan Ye <yejunyan@hust.edu.cn>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-ftpci100.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-ftpci100.c b/drivers/pci/controller/pci-ftpci100.c
+index 0cfd9d5a497c9..f7e61e169d838 100644
+--- a/drivers/pci/controller/pci-ftpci100.c
++++ b/drivers/pci/controller/pci-ftpci100.c
+@@ -429,22 +429,12 @@ static int faraday_pci_probe(struct platform_device *pdev)
+ p->dev = dev;
+
+ /* Retrieve and enable optional clocks */
+- clk = devm_clk_get(dev, "PCLK");
++ clk = devm_clk_get_enabled(dev, "PCLK");
+ if (IS_ERR(clk))
+ return PTR_ERR(clk);
+- ret = clk_prepare_enable(clk);
+- if (ret) {
+- dev_err(dev, "could not prepare PCLK\n");
+- return ret;
+- }
+- p->bus_clk = devm_clk_get(dev, "PCICLK");
++ p->bus_clk = devm_clk_get_enabled(dev, "PCICLK");
+ if (IS_ERR(p->bus_clk))
+ return PTR_ERR(p->bus_clk);
+- ret = clk_prepare_enable(p->bus_clk);
+- if (ret) {
+- dev_err(dev, "could not prepare PCICLK\n");
+- return ret;
+- }
+
+ p->base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(p->base))
+--
+2.39.2
+
--- /dev/null
+From a25de0ac4f3dc7900132200fa176805e74fb04ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 10:15:18 +0800
+Subject: PCI: pciehp: Cancel bringup sequence if card is not present
+
+From: Rongguang Wei <weirongguang@kylinos.cn>
+
+[ Upstream commit e8afd0d9fccc27c8ad263db5cf5952cfcf72d6fe ]
+
+If a PCIe hotplug slot has an Attention Button, the normal hot-add flow is:
+
+ - Slot is empty and slot power is off
+ - User inserts card in slot and presses Attention Button
+ - OS blinks Power Indicator for 5 seconds
+ - After 5 seconds, OS turns on Power Indicator, turns on slot power, and
+ enumerates the device
+
+Previously, if a user pressed the Attention Button on an *empty* slot,
+pciehp logged the following messages and blinked the Power Indicator
+until a second button press:
+
+ [0.000] pciehp: Button press: will power on in 5 sec
+ [0.001] # Power Indicator starts blinking
+ [5.001] # 5 second timeout; slot is empty, so we should cancel the
+ request to power on and turn off Power Indicator
+
+ [7.000] # Power Indicator still blinking
+ [8.000] # possible card insertion
+ [9.000] pciehp: Button press: canceling request to power on
+
+The first button press incorrectly left the slot in BLINKINGON_STATE, so
+the second was interpreted as a "cancel power on" event regardless of
+whether a card was present.
+
+If the slot is empty, turn off the Power Indicator and return from
+BLINKINGON_STATE to OFF_STATE after 5 seconds, effectively canceling the
+request to power on. Putting the slot in OFF_STATE also means the second
+button press will correctly request a slot power on if the slot is
+occupied.
+
+[bhelgaas: commit log]
+Link: https://lore.kernel.org/r/20230512021518.336460-1-clementwei90@163.com
+Fixes: d331710ea78f ("PCI: pciehp: Become resilient to missed events")
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Rongguang Wei <weirongguang@kylinos.cn>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/hotplug/pciehp_ctrl.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
+index 529c348084401..32baba1b7f131 100644
+--- a/drivers/pci/hotplug/pciehp_ctrl.c
++++ b/drivers/pci/hotplug/pciehp_ctrl.c
+@@ -256,6 +256,14 @@ void pciehp_handle_presence_or_link_change(struct controller *ctrl, u32 events)
+ present = pciehp_card_present(ctrl);
+ link_active = pciehp_check_link_active(ctrl);
+ if (present <= 0 && link_active <= 0) {
++ if (ctrl->state == BLINKINGON_STATE) {
++ ctrl->state = OFF_STATE;
++ cancel_delayed_work(&ctrl->button_work);
++ pciehp_set_indicators(ctrl, PCI_EXP_SLTCTL_PWR_IND_OFF,
++ INDICATOR_NOOP);
++ ctrl_info(ctrl, "Slot(%s): Card not present\n",
++ slot_name(ctrl));
++ }
+ mutex_unlock(&ctrl->state_lock);
+ return;
+ }
+--
+2.39.2
+
--- /dev/null
+From d66399529e60a2928b360e32e63f0a721150de08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jun 2023 20:34:02 +0530
+Subject: PCI: qcom: Disable write access to read only registers for IP v2.9.0
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 200b8f85f2021362adcc8efb575652a2aa44c099 ]
+
+In the post init sequence of v2.9.0, write access to read only registers
+are not disabled after updating the registers. Fix it by disabling the
+access after register update.
+
+While at it, let's also add a newline after existing dw_pcie_dbi_ro_wr_en()
+guard function to align with rest of the driver.
+
+Link: https://lore.kernel.org/r/20230619150408.8468-4-manivannan.sadhasivam@linaro.org
+Fixes: 0cf7c2efe8ac ("PCI: qcom: Add IPQ60xx support")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 77f4dc244b3f7..49905b2a99607 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -1403,6 +1403,7 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie)
+ writel(0, pcie->parf + PARF_Q2A_FLUSH);
+
+ dw_pcie_dbi_ro_wr_en(pci);
++
+ writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP);
+
+ val = readl(pci->dbi_base + offset + PCI_EXP_LNKCAP);
+@@ -1412,6 +1413,8 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie)
+ writel(PCI_EXP_DEVCTL2_COMP_TMOUT_DIS, pci->dbi_base + offset +
+ PCI_EXP_DEVCTL2);
+
++ dw_pcie_dbi_ro_wr_dis(pci);
++
+ for (i = 0; i < 256; i++)
+ writel(0, pcie->parf + PARF_BDF_TO_SID_TABLE_N + (4 * i));
+
+--
+2.39.2
+
--- /dev/null
+From 5814c1b67d411695463ec2eff151caee8a0a10e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 13:41:00 +0530
+Subject: PCI: qcom: Remove PCIE20_ prefix from register definitions
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 39171b33f6523f28c1c1256427e5f50c74b69639 ]
+
+The PCIE part is redundant and 20 doesn't represent anything across the
+SoCs supported now. So let's get rid of the prefix.
+
+This involves adding the IP version suffix to one definition of
+PARF_SLV_ADDR_SPACE_SIZE that defines offset specific to that version.
+The other definition is generic for the rest of the versions.
+
+Also, the register PCIE20_LNK_CONTROL2_LINK_STATUS2 is not used anywhere,
+hence removed.
+
+Link: https://lore.kernel.org/r/20230316081117.14288-3-manivannan.sadhasivam@linaro.org
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Stable-dep-of: 60f0072d7fb7 ("PCI: qcom: Use DWC helpers for modifying the read-only DBI registers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 184 ++++++++++++-------------
+ 1 file changed, 91 insertions(+), 93 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index dbe6df0cb6118..b587957211c3f 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -31,7 +31,7 @@
+ #include "../../pci.h"
+ #include "pcie-designware.h"
+
+-#define PCIE20_PARF_SYS_CTRL 0x00
++#define PARF_SYS_CTRL 0x00
+ #define MST_WAKEUP_EN BIT(13)
+ #define SLV_WAKEUP_EN BIT(12)
+ #define MSTR_ACLK_CGC_DIS BIT(10)
+@@ -41,39 +41,39 @@
+ #define L23_CLK_RMV_DIS BIT(2)
+ #define L1_CLK_RMV_DIS BIT(1)
+
+-#define PCIE20_PARF_PM_CTRL 0x20
++#define PARF_PM_CTRL 0x20
+ #define REQ_NOT_ENTR_L1 BIT(5)
+
+-#define PCIE20_PARF_PHY_CTRL 0x40
++#define PARF_PHY_CTRL 0x40
+ #define PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK GENMASK(20, 16)
+ #define PHY_CTRL_PHY_TX0_TERM_OFFSET(x) ((x) << 16)
+
+-#define PCIE20_PARF_PHY_REFCLK 0x4C
++#define PARF_PHY_REFCLK 0x4C
+ #define PHY_REFCLK_SSP_EN BIT(16)
+ #define PHY_REFCLK_USE_PAD BIT(12)
+
+-#define PCIE20_PARF_DBI_BASE_ADDR 0x168
+-#define PCIE20_PARF_SLV_ADDR_SPACE_SIZE 0x16C
+-#define PCIE20_PARF_MHI_CLOCK_RESET_CTRL 0x174
++#define PARF_DBI_BASE_ADDR 0x168
++#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP rev 2.3.3 */
++#define PARF_MHI_CLOCK_RESET_CTRL 0x174
+ #define AHB_CLK_EN BIT(0)
+ #define MSTR_AXI_CLK_EN BIT(1)
+ #define BYPASS BIT(4)
+
+-#define PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT 0x178
+-#define PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8
+-#define PCIE20_PARF_LTSSM 0x1B0
+-#define PCIE20_PARF_SID_OFFSET 0x234
+-#define PCIE20_PARF_BDF_TRANSLATE_CFG 0x24C
+-#define PCIE20_PARF_DEVICE_TYPE 0x1000
+-#define PCIE20_PARF_BDF_TO_SID_TABLE_N 0x2000
++#define PARF_AXI_MSTR_WR_ADDR_HALT 0x178
++#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8
++#define PARF_LTSSM 0x1B0
++#define PARF_SID_OFFSET 0x234
++#define PARF_BDF_TRANSLATE_CFG 0x24C
++#define PARF_DEVICE_TYPE 0x1000
++#define PARF_BDF_TO_SID_TABLE_N 0x2000
+
+-#define PCIE20_ELBI_SYS_CTRL 0x04
+-#define PCIE20_ELBI_SYS_CTRL_LT_ENABLE BIT(0)
++#define ELBI_SYS_CTRL 0x04
++#define ELBI_SYS_CTRL_LT_ENABLE BIT(0)
+
+-#define PCIE20_AXI_MSTR_RESP_COMP_CTRL0 0x818
++#define AXI_MSTR_RESP_COMP_CTRL0 0x818
+ #define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_2K 0x4
+ #define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_4K 0x5
+-#define PCIE20_AXI_MSTR_RESP_COMP_CTRL1 0x81c
++#define AXI_MSTR_RESP_COMP_CTRL1 0x81c
+ #define CFG_BRIDGE_SB_INIT BIT(0)
+
+ #define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, \
+@@ -91,30 +91,28 @@
+ PCIE_CAP_SLOT_POWER_LIMIT_VAL | \
+ PCIE_CAP_SLOT_POWER_LIMIT_SCALE)
+
+-#define PCIE20_PARF_Q2A_FLUSH 0x1AC
++#define PARF_Q2A_FLUSH 0x1AC
+
+-#define PCIE20_MISC_CONTROL_1_REG 0x8BC
++#define MISC_CONTROL_1_REG 0x8BC
+ #define DBI_RO_WR_EN 1
+
+ #define PERST_DELAY_US 1000
+ /* PARF registers */
+-#define PCIE20_PARF_PCS_DEEMPH 0x34
++#define PARF_PCS_DEEMPH 0x34
+ #define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16)
+ #define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8)
+ #define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0)
+
+-#define PCIE20_PARF_PCS_SWING 0x38
++#define PARF_PCS_SWING 0x38
+ #define PCS_SWING_TX_SWING_FULL(x) ((x) << 8)
+ #define PCS_SWING_TX_SWING_LOW(x) ((x) << 0)
+
+-#define PCIE20_PARF_CONFIG_BITS 0x50
++#define PARF_CONFIG_BITS 0x50
+ #define PHY_RX0_EQ(x) ((x) << 24)
+
+-#define PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE 0x358
++#define PARF_SLV_ADDR_SPACE_SIZE 0x358
+ #define SLV_ADDR_SPACE_SZ 0x10000000
+
+-#define PCIE20_LNK_CONTROL2_LINK_STATUS2 0xa0
+-
+ #define DEVICE_TYPE_RC 0x4
+
+ #define QCOM_PCIE_2_1_0_MAX_SUPPLY 3
+@@ -258,9 +256,9 @@ static void qcom_pcie_2_1_0_ltssm_enable(struct qcom_pcie *pcie)
+ u32 val;
+
+ /* enable link training */
+- val = readl(pcie->elbi + PCIE20_ELBI_SYS_CTRL);
+- val |= PCIE20_ELBI_SYS_CTRL_LT_ENABLE;
+- writel(val, pcie->elbi + PCIE20_ELBI_SYS_CTRL);
++ val = readl(pcie->elbi + ELBI_SYS_CTRL);
++ val |= ELBI_SYS_CTRL_LT_ENABLE;
++ writel(val, pcie->elbi + ELBI_SYS_CTRL);
+ }
+
+ static int qcom_pcie_get_resources_2_1_0(struct qcom_pcie *pcie)
+@@ -330,7 +328,7 @@ static void qcom_pcie_deinit_2_1_0(struct qcom_pcie *pcie)
+ reset_control_assert(res->ext_reset);
+ reset_control_assert(res->phy_reset);
+
+- writel(1, pcie->parf + PCIE20_PARF_PHY_CTRL);
++ writel(1, pcie->parf + PARF_PHY_CTRL);
+
+ regulator_bulk_disable(ARRAY_SIZE(res->supplies), res->supplies);
+ }
+@@ -420,9 +418,9 @@ static int qcom_pcie_post_init_2_1_0(struct qcom_pcie *pcie)
+ int ret;
+
+ /* enable PCIe clocks and resets */
+- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
++ val = readl(pcie->parf + PARF_PHY_CTRL);
+ val &= ~BIT(0);
+- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
++ writel(val, pcie->parf + PARF_PHY_CTRL);
+
+ ret = clk_bulk_prepare_enable(ARRAY_SIZE(res->clks), res->clks);
+ if (ret)
+@@ -433,37 +431,37 @@ static int qcom_pcie_post_init_2_1_0(struct qcom_pcie *pcie)
+ writel(PCS_DEEMPH_TX_DEEMPH_GEN1(24) |
+ PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(24) |
+ PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(34),
+- pcie->parf + PCIE20_PARF_PCS_DEEMPH);
++ pcie->parf + PARF_PCS_DEEMPH);
+ writel(PCS_SWING_TX_SWING_FULL(120) |
+ PCS_SWING_TX_SWING_LOW(120),
+- pcie->parf + PCIE20_PARF_PCS_SWING);
+- writel(PHY_RX0_EQ(4), pcie->parf + PCIE20_PARF_CONFIG_BITS);
++ pcie->parf + PARF_PCS_SWING);
++ writel(PHY_RX0_EQ(4), pcie->parf + PARF_CONFIG_BITS);
+ }
+
+ if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) {
+ /* set TX termination offset */
+- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
++ val = readl(pcie->parf + PARF_PHY_CTRL);
+ val &= ~PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK;
+ val |= PHY_CTRL_PHY_TX0_TERM_OFFSET(7);
+- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
++ writel(val, pcie->parf + PARF_PHY_CTRL);
+ }
+
+ /* enable external reference clock */
+- val = readl(pcie->parf + PCIE20_PARF_PHY_REFCLK);
++ val = readl(pcie->parf + PARF_PHY_REFCLK);
+ /* USE_PAD is required only for ipq806x */
+ if (!of_device_is_compatible(node, "qcom,pcie-apq8064"))
+ val &= ~PHY_REFCLK_USE_PAD;
+ val |= PHY_REFCLK_SSP_EN;
+- writel(val, pcie->parf + PCIE20_PARF_PHY_REFCLK);
++ writel(val, pcie->parf + PARF_PHY_REFCLK);
+
+ /* wait for clock acquisition */
+ usleep_range(1000, 1500);
+
+ /* Set the Max TLP size to 2K, instead of using default of 4K */
+ writel(CFG_REMOTE_RD_REQ_BRIDGE_SIZE_2K,
+- pci->dbi_base + PCIE20_AXI_MSTR_RESP_COMP_CTRL0);
++ pci->dbi_base + AXI_MSTR_RESP_COMP_CTRL0);
+ writel(CFG_BRIDGE_SB_INIT,
+- pci->dbi_base + PCIE20_AXI_MSTR_RESP_COMP_CTRL1);
++ pci->dbi_base + AXI_MSTR_RESP_COMP_CTRL1);
+
+ return 0;
+ }
+@@ -571,13 +569,13 @@ static int qcom_pcie_init_1_0_0(struct qcom_pcie *pcie)
+ static int qcom_pcie_post_init_1_0_0(struct qcom_pcie *pcie)
+ {
+ /* change DBI base address */
+- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
+
+ if (IS_ENABLED(CONFIG_PCI_MSI)) {
+- u32 val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT);
++ u32 val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT);
+
+ val |= BIT(31);
+- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT);
++ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT);
+ }
+
+ return 0;
+@@ -588,9 +586,9 @@ static void qcom_pcie_2_3_2_ltssm_enable(struct qcom_pcie *pcie)
+ u32 val;
+
+ /* enable link training */
+- val = readl(pcie->parf + PCIE20_PARF_LTSSM);
++ val = readl(pcie->parf + PARF_LTSSM);
+ val |= BIT(8);
+- writel(val, pcie->parf + PCIE20_PARF_LTSSM);
++ writel(val, pcie->parf + PARF_LTSSM);
+ }
+
+ static int qcom_pcie_get_resources_2_3_2(struct qcom_pcie *pcie)
+@@ -695,25 +693,25 @@ static int qcom_pcie_post_init_2_3_2(struct qcom_pcie *pcie)
+ u32 val;
+
+ /* enable PCIe clocks and resets */
+- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
++ val = readl(pcie->parf + PARF_PHY_CTRL);
+ val &= ~BIT(0);
+- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
++ writel(val, pcie->parf + PARF_PHY_CTRL);
+
+ /* change DBI base address */
+- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
+
+ /* MAC PHY_POWERDOWN MUX DISABLE */
+- val = readl(pcie->parf + PCIE20_PARF_SYS_CTRL);
++ val = readl(pcie->parf + PARF_SYS_CTRL);
+ val &= ~BIT(29);
+- writel(val, pcie->parf + PCIE20_PARF_SYS_CTRL);
++ writel(val, pcie->parf + PARF_SYS_CTRL);
+
+- val = readl(pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
++ val = readl(pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
+ val |= BIT(4);
+- writel(val, pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
++ writel(val, pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
+
+- val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
++ val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+ val |= BIT(31);
+- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
++ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+
+ return 0;
+ }
+@@ -974,25 +972,25 @@ static int qcom_pcie_post_init_2_4_0(struct qcom_pcie *pcie)
+ u32 val;
+
+ /* enable PCIe clocks and resets */
+- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
++ val = readl(pcie->parf + PARF_PHY_CTRL);
+ val &= ~BIT(0);
+- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
++ writel(val, pcie->parf + PARF_PHY_CTRL);
+
+ /* change DBI base address */
+- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
+
+ /* MAC PHY_POWERDOWN MUX DISABLE */
+- val = readl(pcie->parf + PCIE20_PARF_SYS_CTRL);
++ val = readl(pcie->parf + PARF_SYS_CTRL);
+ val &= ~BIT(29);
+- writel(val, pcie->parf + PCIE20_PARF_SYS_CTRL);
++ writel(val, pcie->parf + PARF_SYS_CTRL);
+
+- val = readl(pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
++ val = readl(pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
+ val |= BIT(4);
+- writel(val, pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
++ writel(val, pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
+
+- val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
++ val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+ val |= BIT(31);
+- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
++ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+
+ return 0;
+ }
+@@ -1137,22 +1135,22 @@ static int qcom_pcie_post_init_2_3_3(struct qcom_pcie *pcie)
+ u32 val;
+
+ writel(SLV_ADDR_SPACE_SZ,
+- pcie->parf + PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE);
++ pcie->parf + PARF_SLV_ADDR_SPACE_SIZE_2_3_3);
+
+- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
++ val = readl(pcie->parf + PARF_PHY_CTRL);
+ val &= ~BIT(0);
+- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
++ writel(val, pcie->parf + PARF_PHY_CTRL);
+
+- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
+
+ writel(MST_WAKEUP_EN | SLV_WAKEUP_EN | MSTR_ACLK_CGC_DIS
+ | SLV_ACLK_CGC_DIS | CORE_CLK_CGC_DIS |
+ AUX_PWR_DET | L23_CLK_RMV_DIS | L1_CLK_RMV_DIS,
+- pcie->parf + PCIE20_PARF_SYS_CTRL);
+- writel(0, pcie->parf + PCIE20_PARF_Q2A_FLUSH);
++ pcie->parf + PARF_SYS_CTRL);
++ writel(0, pcie->parf + PARF_Q2A_FLUSH);
+
+ writel(PCI_COMMAND_MASTER, pci->dbi_base + PCI_COMMAND);
+- writel(DBI_RO_WR_EN, pci->dbi_base + PCIE20_MISC_CONTROL_1_REG);
++ writel(DBI_RO_WR_EN, pci->dbi_base + MISC_CONTROL_1_REG);
+ writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP);
+
+ val = readl(pci->dbi_base + offset + PCI_EXP_LNKCAP);
+@@ -1252,33 +1250,33 @@ static int qcom_pcie_init_2_7_0(struct qcom_pcie *pcie)
+ usleep_range(1000, 1500);
+
+ /* configure PCIe to RC mode */
+- writel(DEVICE_TYPE_RC, pcie->parf + PCIE20_PARF_DEVICE_TYPE);
++ writel(DEVICE_TYPE_RC, pcie->parf + PARF_DEVICE_TYPE);
+
+ /* enable PCIe clocks and resets */
+- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
++ val = readl(pcie->parf + PARF_PHY_CTRL);
+ val &= ~BIT(0);
+- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
++ writel(val, pcie->parf + PARF_PHY_CTRL);
+
+ /* change DBI base address */
+- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
+
+ /* MAC PHY_POWERDOWN MUX DISABLE */
+- val = readl(pcie->parf + PCIE20_PARF_SYS_CTRL);
++ val = readl(pcie->parf + PARF_SYS_CTRL);
+ val &= ~BIT(29);
+- writel(val, pcie->parf + PCIE20_PARF_SYS_CTRL);
++ writel(val, pcie->parf + PARF_SYS_CTRL);
+
+- val = readl(pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
++ val = readl(pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
+ val |= BIT(4);
+- writel(val, pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
++ writel(val, pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
+
+ /* Enable L1 and L1SS */
+- val = readl(pcie->parf + PCIE20_PARF_PM_CTRL);
++ val = readl(pcie->parf + PARF_PM_CTRL);
+ val &= ~REQ_NOT_ENTR_L1;
+- writel(val, pcie->parf + PCIE20_PARF_PM_CTRL);
++ writel(val, pcie->parf + PARF_PM_CTRL);
+
+- val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
++ val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+ val |= BIT(31);
+- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
++ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+
+ return 0;
+ err_disable_clocks:
+@@ -1366,17 +1364,17 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie)
+ int i;
+
+ writel(SLV_ADDR_SPACE_SZ,
+- pcie->parf + PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE);
++ pcie->parf + PARF_SLV_ADDR_SPACE_SIZE);
+
+- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
++ val = readl(pcie->parf + PARF_PHY_CTRL);
+ val &= ~BIT(0);
+- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
++ writel(val, pcie->parf + PARF_PHY_CTRL);
+
+- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
+
+- writel(DEVICE_TYPE_RC, pcie->parf + PCIE20_PARF_DEVICE_TYPE);
++ writel(DEVICE_TYPE_RC, pcie->parf + PARF_DEVICE_TYPE);
+ writel(BYPASS | MSTR_AXI_CLK_EN | AHB_CLK_EN,
+- pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
++ pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
+ writel(GEN3_RELATED_OFF_RXEQ_RGRDLESS_RXTS |
+ GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL,
+ pci->dbi_base + GEN3_RELATED_OFF);
+@@ -1384,9 +1382,9 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie)
+ writel(MST_WAKEUP_EN | SLV_WAKEUP_EN | MSTR_ACLK_CGC_DIS |
+ SLV_ACLK_CGC_DIS | CORE_CLK_CGC_DIS |
+ AUX_PWR_DET | L23_CLK_RMV_DIS | L1_CLK_RMV_DIS,
+- pcie->parf + PCIE20_PARF_SYS_CTRL);
++ pcie->parf + PARF_SYS_CTRL);
+
+- writel(0, pcie->parf + PCIE20_PARF_Q2A_FLUSH);
++ writel(0, pcie->parf + PARF_Q2A_FLUSH);
+
+ dw_pcie_dbi_ro_wr_en(pci);
+ writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP);
+@@ -1399,7 +1397,7 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie)
+ PCI_EXP_DEVCTL2);
+
+ for (i = 0; i < 256; i++)
+- writel(0, pcie->parf + PCIE20_PARF_BDF_TO_SID_TABLE_N + (4 * i));
++ writel(0, pcie->parf + PARF_BDF_TO_SID_TABLE_N + (4 * i));
+
+ return 0;
+ }
+@@ -1421,7 +1419,7 @@ static int qcom_pcie_config_sid_sm8250(struct qcom_pcie *pcie)
+ u32 smmu_sid;
+ u32 smmu_sid_len;
+ } *map;
+- void __iomem *bdf_to_sid_base = pcie->parf + PCIE20_PARF_BDF_TO_SID_TABLE_N;
++ void __iomem *bdf_to_sid_base = pcie->parf + PARF_BDF_TO_SID_TABLE_N;
+ struct device *dev = pcie->pci->dev;
+ u8 qcom_pcie_crc8_table[CRC8_TABLE_SIZE];
+ int i, nr_map, size = 0;
+--
+2.39.2
+
--- /dev/null
+From 138ee40773d23a1227aeb487e9d1f0daeee3d236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 13:41:01 +0530
+Subject: PCI: qcom: Sort and group registers and bitfield definitions
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 769e49d87b15c302c9aadd87c7d114cfe7052320 ]
+
+Sorting the registers and their bit definitions will make it easier to add
+more definitions in the future and it also helps in maintenance.
+
+While at it, let's also group the registers and bit definitions separately
+as done in the pcie-qcom-ep driver.
+
+Link: https://lore.kernel.org/r/20230316081117.14288-4-manivannan.sadhasivam@linaro.org
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Stable-dep-of: 60f0072d7fb7 ("PCI: qcom: Use DWC helpers for modifying the read-only DBI registers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 108 ++++++++++++++-----------
+ 1 file changed, 63 insertions(+), 45 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index b587957211c3f..1c8200656aef9 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -31,7 +31,36 @@
+ #include "../../pci.h"
+ #include "pcie-designware.h"
+
++/* PARF registers */
+ #define PARF_SYS_CTRL 0x00
++#define PARF_PM_CTRL 0x20
++#define PARF_PCS_DEEMPH 0x34
++#define PARF_PCS_SWING 0x38
++#define PARF_PHY_CTRL 0x40
++#define PARF_PHY_REFCLK 0x4C
++#define PARF_CONFIG_BITS 0x50
++#define PARF_DBI_BASE_ADDR 0x168
++#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP ver 2.3.3 */
++#define PARF_MHI_CLOCK_RESET_CTRL 0x174
++#define PARF_AXI_MSTR_WR_ADDR_HALT 0x178
++#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8
++#define PARF_Q2A_FLUSH 0x1AC
++#define PARF_LTSSM 0x1B0
++#define PARF_SID_OFFSET 0x234
++#define PARF_BDF_TRANSLATE_CFG 0x24C
++#define PARF_SLV_ADDR_SPACE_SIZE 0x358
++#define PARF_DEVICE_TYPE 0x1000
++#define PARF_BDF_TO_SID_TABLE_N 0x2000
++
++/* ELBI registers */
++#define ELBI_SYS_CTRL 0x04
++
++/* DBI registers */
++#define AXI_MSTR_RESP_COMP_CTRL0 0x818
++#define AXI_MSTR_RESP_COMP_CTRL1 0x81c
++#define MISC_CONTROL_1_REG 0x8BC
++
++/* PARF_SYS_CTRL register fields */
+ #define MST_WAKEUP_EN BIT(13)
+ #define SLV_WAKEUP_EN BIT(12)
+ #define MSTR_ACLK_CGC_DIS BIT(10)
+@@ -41,45 +70,56 @@
+ #define L23_CLK_RMV_DIS BIT(2)
+ #define L1_CLK_RMV_DIS BIT(1)
+
+-#define PARF_PM_CTRL 0x20
++/* PARF_PM_CTRL register fields */
+ #define REQ_NOT_ENTR_L1 BIT(5)
+
+-#define PARF_PHY_CTRL 0x40
++/* PARF_PCS_DEEMPH register fields */
++#define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16)
++#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8)
++#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0)
++
++/* PARF_PCS_SWING register fields */
++#define PCS_SWING_TX_SWING_FULL(x) ((x) << 8)
++#define PCS_SWING_TX_SWING_LOW(x) ((x) << 0)
++
++/* PARF_PHY_CTRL register fields */
+ #define PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK GENMASK(20, 16)
+ #define PHY_CTRL_PHY_TX0_TERM_OFFSET(x) ((x) << 16)
+
+-#define PARF_PHY_REFCLK 0x4C
++/* PARF_PHY_REFCLK register fields */
+ #define PHY_REFCLK_SSP_EN BIT(16)
+ #define PHY_REFCLK_USE_PAD BIT(12)
+
+-#define PARF_DBI_BASE_ADDR 0x168
+-#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP rev 2.3.3 */
+-#define PARF_MHI_CLOCK_RESET_CTRL 0x174
++/* PARF_CONFIG_BITS register fields */
++#define PHY_RX0_EQ(x) ((x) << 24)
++
++/* PARF_SLV_ADDR_SPACE_SIZE register value */
++#define SLV_ADDR_SPACE_SZ 0x10000000
++
++/* PARF_MHI_CLOCK_RESET_CTRL register fields */
+ #define AHB_CLK_EN BIT(0)
+ #define MSTR_AXI_CLK_EN BIT(1)
+ #define BYPASS BIT(4)
+
+-#define PARF_AXI_MSTR_WR_ADDR_HALT 0x178
+-#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8
+-#define PARF_LTSSM 0x1B0
+-#define PARF_SID_OFFSET 0x234
+-#define PARF_BDF_TRANSLATE_CFG 0x24C
+-#define PARF_DEVICE_TYPE 0x1000
+-#define PARF_BDF_TO_SID_TABLE_N 0x2000
++/* PARF_DEVICE_TYPE register fields */
++#define DEVICE_TYPE_RC 0x4
+
+-#define ELBI_SYS_CTRL 0x04
++/* ELBI_SYS_CTRL register fields */
+ #define ELBI_SYS_CTRL_LT_ENABLE BIT(0)
+
+-#define AXI_MSTR_RESP_COMP_CTRL0 0x818
++/* AXI_MSTR_RESP_COMP_CTRL0 register fields */
+ #define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_2K 0x4
+ #define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_4K 0x5
+-#define AXI_MSTR_RESP_COMP_CTRL1 0x81c
++
++/* AXI_MSTR_RESP_COMP_CTRL1 register fields */
+ #define CFG_BRIDGE_SB_INIT BIT(0)
+
+-#define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, \
+- 250)
+-#define PCIE_CAP_SLOT_POWER_LIMIT_SCALE FIELD_PREP(PCI_EXP_SLTCAP_SPLS, \
+- 1)
++/* MISC_CONTROL_1_REG register fields */
++#define DBI_RO_WR_EN 1
++
++/* PCI_EXP_SLTCAP register fields */
++#define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, 250)
++#define PCIE_CAP_SLOT_POWER_LIMIT_SCALE FIELD_PREP(PCI_EXP_SLTCAP_SPLS, 1)
+ #define PCIE_CAP_SLOT_VAL (PCI_EXP_SLTCAP_ABP | \
+ PCI_EXP_SLTCAP_PCP | \
+ PCI_EXP_SLTCAP_MRLSP | \
+@@ -91,34 +131,12 @@
+ PCIE_CAP_SLOT_POWER_LIMIT_VAL | \
+ PCIE_CAP_SLOT_POWER_LIMIT_SCALE)
+
+-#define PARF_Q2A_FLUSH 0x1AC
+-
+-#define MISC_CONTROL_1_REG 0x8BC
+-#define DBI_RO_WR_EN 1
+-
+ #define PERST_DELAY_US 1000
+-/* PARF registers */
+-#define PARF_PCS_DEEMPH 0x34
+-#define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16)
+-#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8)
+-#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0)
+-
+-#define PARF_PCS_SWING 0x38
+-#define PCS_SWING_TX_SWING_FULL(x) ((x) << 8)
+-#define PCS_SWING_TX_SWING_LOW(x) ((x) << 0)
+-
+-#define PARF_CONFIG_BITS 0x50
+-#define PHY_RX0_EQ(x) ((x) << 24)
+-
+-#define PARF_SLV_ADDR_SPACE_SIZE 0x358
+-#define SLV_ADDR_SPACE_SZ 0x10000000
+-
+-#define DEVICE_TYPE_RC 0x4
+
+-#define QCOM_PCIE_2_1_0_MAX_SUPPLY 3
+-#define QCOM_PCIE_2_1_0_MAX_CLOCKS 5
++#define QCOM_PCIE_2_1_0_MAX_SUPPLY 3
++#define QCOM_PCIE_2_1_0_MAX_CLOCKS 5
+
+-#define QCOM_PCIE_CRC8_POLYNOMIAL (BIT(2) | BIT(1) | BIT(0))
++#define QCOM_PCIE_CRC8_POLYNOMIAL (BIT(2) | BIT(1) | BIT(0))
+
+ struct qcom_pcie_resources_2_1_0 {
+ struct clk_bulk_data clks[QCOM_PCIE_2_1_0_MAX_CLOCKS];
+--
+2.39.2
+
--- /dev/null
+From d7f298f6536154fd1f73bafec9c1aee7bc40b478 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jun 2023 20:34:01 +0530
+Subject: PCI: qcom: Use DWC helpers for modifying the read-only DBI registers
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 60f0072d7fb7996b9a524ef0d152e21205473192 ]
+
+DWC core already exposes dw_pcie_dbi_ro_wr_{en/dis} helper APIs for
+enabling and disabling the write access to read only DBI registers. So
+let's use them instead of doing it manually.
+
+Also, the existing code doesn't disable the write access when it's done.
+This is also fixed now.
+
+Link: https://lore.kernel.org/r/20230619150408.8468-3-manivannan.sadhasivam@linaro.org
+Fixes: 5d76117f070d ("PCI: qcom: Add support for IPQ8074 PCIe controller")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index e65f4bf50f928..77f4dc244b3f7 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -58,7 +58,6 @@
+ /* DBI registers */
+ #define AXI_MSTR_RESP_COMP_CTRL0 0x818
+ #define AXI_MSTR_RESP_COMP_CTRL1 0x81c
+-#define MISC_CONTROL_1_REG 0x8bc
+
+ /* PARF_SYS_CTRL register fields */
+ #define MST_WAKEUP_EN BIT(13)
+@@ -114,9 +113,6 @@
+ /* AXI_MSTR_RESP_COMP_CTRL1 register fields */
+ #define CFG_BRIDGE_SB_INIT BIT(0)
+
+-/* MISC_CONTROL_1_REG register fields */
+-#define DBI_RO_WR_EN 1
+-
+ /* PCI_EXP_SLTCAP register fields */
+ #define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, 250)
+ #define PCIE_CAP_SLOT_POWER_LIMIT_SCALE FIELD_PREP(PCI_EXP_SLTCAP_SPLS, 1)
+@@ -1168,7 +1164,9 @@ static int qcom_pcie_post_init_2_3_3(struct qcom_pcie *pcie)
+ writel(0, pcie->parf + PARF_Q2A_FLUSH);
+
+ writel(PCI_COMMAND_MASTER, pci->dbi_base + PCI_COMMAND);
+- writel(DBI_RO_WR_EN, pci->dbi_base + MISC_CONTROL_1_REG);
++
++ dw_pcie_dbi_ro_wr_en(pci);
++
+ writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP);
+
+ val = readl(pci->dbi_base + offset + PCI_EXP_LNKCAP);
+--
+2.39.2
+
--- /dev/null
+From e13a26d0f745afc49a4e0195362ec1f50f01c4c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 13:41:04 +0530
+Subject: PCI: qcom: Use lower case for hex
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 94ebd232dbc84dfdfbf0c406137a8b2aa8b37a01 ]
+
+To maintain uniformity, let's use lower case for representing hexadecimal
+numbers.
+
+Link: https://lore.kernel.org/r/20230316081117.14288-7-manivannan.sadhasivam@linaro.org
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Stable-dep-of: 60f0072d7fb7 ("PCI: qcom: Use DWC helpers for modifying the read-only DBI registers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 1c8200656aef9..e65f4bf50f928 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -37,17 +37,17 @@
+ #define PARF_PCS_DEEMPH 0x34
+ #define PARF_PCS_SWING 0x38
+ #define PARF_PHY_CTRL 0x40
+-#define PARF_PHY_REFCLK 0x4C
++#define PARF_PHY_REFCLK 0x4c
+ #define PARF_CONFIG_BITS 0x50
+ #define PARF_DBI_BASE_ADDR 0x168
+-#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP ver 2.3.3 */
++#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16c /* Register offset specific to IP ver 2.3.3 */
+ #define PARF_MHI_CLOCK_RESET_CTRL 0x174
+ #define PARF_AXI_MSTR_WR_ADDR_HALT 0x178
+-#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8
+-#define PARF_Q2A_FLUSH 0x1AC
+-#define PARF_LTSSM 0x1B0
++#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1a8
++#define PARF_Q2A_FLUSH 0x1ac
++#define PARF_LTSSM 0x1b0
+ #define PARF_SID_OFFSET 0x234
+-#define PARF_BDF_TRANSLATE_CFG 0x24C
++#define PARF_BDF_TRANSLATE_CFG 0x24c
+ #define PARF_SLV_ADDR_SPACE_SIZE 0x358
+ #define PARF_DEVICE_TYPE 0x1000
+ #define PARF_BDF_TO_SID_TABLE_N 0x2000
+@@ -58,7 +58,7 @@
+ /* DBI registers */
+ #define AXI_MSTR_RESP_COMP_CTRL0 0x818
+ #define AXI_MSTR_RESP_COMP_CTRL1 0x81c
+-#define MISC_CONTROL_1_REG 0x8BC
++#define MISC_CONTROL_1_REG 0x8bc
+
+ /* PARF_SYS_CTRL register fields */
+ #define MST_WAKEUP_EN BIT(13)
+--
+2.39.2
+
--- /dev/null
+From 5c6558c14834683fb942d24036c94ce7554c99d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 17:43:31 +0800
+Subject: PCI: vmd: Fix uninitialized variable usage in vmd_enable_domain()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xinghui Li <korantli@tencent.com>
+
+[ Upstream commit 0c0206dc4f5ba2d18b15e24d2047487d6f73916b ]
+
+The ret variable in the vmd_enable_domain() function was used
+uninitialized when printing a warning message upon failure of
+the pci_reset_bus() function.
+
+Thus, fix the issue by assigning ret with the value returned from
+pci_reset_bus() before referencing it in the warning message.
+
+This was detected by Smatch:
+
+ drivers/pci/controller/vmd.c:931 vmd_enable_domain() error: uninitialized symbol 'ret'.
+
+[kwilczynski: drop the second patch from the series, add missing reported
+by tag, commit log]
+Fixes: 0a584655ef89 ("PCI: vmd: Fix secondary bus reset for Intel bridges")
+Link: https://lore.kernel.org/all/202305270219.B96IiIfv-lkp@intel.com
+Link: https://lore.kernel.org/linux-pci/20230420094332.1507900-2-korantwork@gmail.com
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Xinghui Li <korantli@tencent.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Nirmal Patel <nirmal.patel@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/vmd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index 50a187a29a1d8..d1eb17e3f1474 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -872,7 +872,8 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+ if (!list_empty(&child->devices)) {
+ dev = list_first_entry(&child->devices,
+ struct pci_dev, bus_list);
+- if (pci_reset_bus(dev))
++ ret = pci_reset_bus(dev);
++ if (ret)
+ pci_warn(dev, "can't reset device: %d\n", ret);
+
+ break;
+--
+2.39.2
+
--- /dev/null
+From eebe94c6b2eb93e56a6df928e8b5d2a4b4628435 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 13:28:11 -0700
+Subject: PCI: vmd: Reset VMD config register between soft reboots
+
+From: Nirmal Patel <nirmal.patel@linux.intel.com>
+
+[ Upstream commit b61cf04c49c3dfa70a0d6725d3eb40bf9b35cf71 ]
+
+VMD driver can disable or enable MSI remapping by changing
+VMCONFIG_MSI_REMAP register. This register needs to be set to the
+default value during soft reboots. Drives failed to enumerate
+when Windows boots after performing a soft reboot from Linux.
+Windows doesn't support MSI remapping disable feature and stale
+register value hinders Windows VMD driver initialization process.
+Adding vmd_shutdown function to make sure to set the VMCONFIG
+register to the default value.
+
+Link: https://lore.kernel.org/r/20230224202811.644370-1-nirmal.patel@linux.intel.com
+Fixes: ee81ee84f873 ("PCI: vmd: Disable MSI-X remapping when possible")
+Signed-off-by: Nirmal Patel <nirmal.patel@linux.intel.com>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Reviewed-by: Jon Derrick <jonathan.derrick@linux.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/vmd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index 769eedeb8802a..50a187a29a1d8 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -979,6 +979,13 @@ static void vmd_remove(struct pci_dev *dev)
+ ida_simple_remove(&vmd_instance_ida, vmd->instance);
+ }
+
++static void vmd_shutdown(struct pci_dev *dev)
++{
++ struct vmd_dev *vmd = pci_get_drvdata(dev);
++
++ vmd_remove_irq_domain(vmd);
++}
++
+ #ifdef CONFIG_PM_SLEEP
+ static int vmd_suspend(struct device *dev)
+ {
+@@ -1056,6 +1063,7 @@ static struct pci_driver vmd_drv = {
+ .id_table = vmd_ids,
+ .probe = vmd_probe,
+ .remove = vmd_remove,
++ .shutdown = vmd_shutdown,
+ .driver = {
+ .pm = &vmd_dev_pm_ops,
+ },
+--
+2.39.2
+
--- /dev/null
+From 1ab3f0019077b5d1e2d5e2633be644b2cb86e839 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 May 2023 17:44:32 +0100
+Subject: perf/arm-cmn: Fix DTC reset
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 71746c995cac92fcf6a65661b51211cf2009d7f0 ]
+
+It turns out that my naive DTC reset logic fails to work as intended,
+since, after checking with the hardware designers, the PMU actually
+needs to be fully enabled in order to correctly clear any pending
+overflows. Therefore, invert the sequence to start with turning on both
+enables so that we can reliably get the DTCs into a known state, then
+moving to our normal counters-stopped state from there. Since all the
+DTM counters have already been unpaired during the initial discovery
+pass, we just need to additionally reset the cycle counters to ensure
+that no other unexpected overflows occur during this period.
+
+Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver")
+Reported-by: Geoff Blake <blakgeof@amazon.com>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/0ea4559261ea394f827c9aee5168c77a60aaee03.1684946389.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index ff86075edca48..90008e24d1cc7 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -1898,9 +1898,10 @@ static int arm_cmn_init_dtc(struct arm_cmn *cmn, struct arm_cmn_node *dn, int id
+ if (dtc->irq < 0)
+ return dtc->irq;
+
+- writel_relaxed(0, dtc->base + CMN_DT_PMCR);
++ writel_relaxed(CMN_DT_DTC_CTL_DT_EN, dtc->base + CMN_DT_DTC_CTL);
++ writel_relaxed(CMN_DT_PMCR_PMU_EN | CMN_DT_PMCR_OVFL_INTR_EN, dtc->base + CMN_DT_PMCR);
++ writeq_relaxed(0, dtc->base + CMN_DT_PMCCNTR);
+ writel_relaxed(0x1ff, dtc->base + CMN_DT_PMOVSR_CLR);
+- writel_relaxed(CMN_DT_PMCR_OVFL_INTR_EN, dtc->base + CMN_DT_PMCR);
+
+ return 0;
+ }
+@@ -1960,7 +1961,7 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn)
+ dn->type = CMN_TYPE_CCLA;
+ }
+
+- writel_relaxed(CMN_DT_DTC_CTL_DT_EN, cmn->dtc[0].base + CMN_DT_DTC_CTL);
++ arm_cmn_set_state(cmn, CMN_STATE_DISABLED);
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From b045daf2a886c217f5edf9f7f74e947883ad93e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 15:38:25 -0300
+Subject: perf bench: Add missing setlocale() call to allow usage of %'d style
+ formatting
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 16203e9cd01896b4244100a8e3fb9f6e612ab2b1 ]
+
+Without this we were not getting the thousands separator for big
+numbers.
+
+Noticed while developing 'perf bench uprobe', but the use of %' predates
+that, for instance 'perf bench syscall' uses it.
+
+Before:
+
+ # perf bench uprobe all
+ # Running uprobe/baseline benchmark...
+ # Executed 1000 usleep(1000) calls
+ Total time: 1054082243ns
+
+ 1054082.243000 nsecs/op
+
+ #
+
+After:
+
+ # perf bench uprobe all
+ # Running uprobe/baseline benchmark...
+ # Executed 1,000 usleep(1000) calls
+ Total time: 1,053,715,144ns
+
+ 1,053,715.144000 nsecs/op
+
+ #
+
+Fixes: c2a08203052f8975 ("perf bench: Add basic syscall benchmark")
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Andre Fredette <anfredet@redhat.com>
+Cc: Clark Williams <williams@redhat.com>
+Cc: Dave Tucker <datucker@redhat.com>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Derek Barbosa <debarbos@redhat.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
+Link: https://lore.kernel.org/lkml/ZH3lcepZ4tBYr1jv@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-bench.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/builtin-bench.c b/tools/perf/builtin-bench.c
+index 334ab897aae3b..a5c2a6938b4e4 100644
+--- a/tools/perf/builtin-bench.c
++++ b/tools/perf/builtin-bench.c
+@@ -21,6 +21,7 @@
+ #include "builtin.h"
+ #include "bench/bench.h"
+
++#include <locale.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -256,6 +257,7 @@ int cmd_bench(int argc, const char **argv)
+
+ /* Unbuffered output */
+ setvbuf(stdout, NULL, _IONBF, 0);
++ setlocale(LC_ALL, "");
+
+ if (argc < 2) {
+ /* No collection specified. */
+--
+2.39.2
+
--- /dev/null
+From bd9edc4521d6556d019c333d22705fc010973887 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jun 2023 16:41:01 -0700
+Subject: perf dwarf-aux: Fix off-by-one in die_get_varname()
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 3abfcfd847717d232e36963f31a361747c388fe7 ]
+
+The die_get_varname() returns "(unknown_type)" string if it failed to
+find a type for the variable. But it had a space before the opening
+parenthesis and it made the closing parenthesis cut off due to the
+off-by-one in the string length (14).
+
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Fixes: 88fd633cdfa19060 ("perf probe: No need to use formatting strbuf method")
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230612234102.3909116-1-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dwarf-aux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 623527edeac1e..b125eaadcec4d 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -1081,7 +1081,7 @@ int die_get_varname(Dwarf_Die *vr_die, struct strbuf *buf)
+ ret = die_get_typename(vr_die, buf);
+ if (ret < 0) {
+ pr_debug("Failed to get type, make it unknown.\n");
+- ret = strbuf_add(buf, " (unknown_type)", 14);
++ ret = strbuf_add(buf, "(unknown_type)", 14);
+ }
+
+ return ret < 0 ? ret : strbuf_addf(buf, "\t%s", dwarf_diename(vr_die));
+--
+2.39.2
+
--- /dev/null
+From ce11cae1cef6869c3076673d6f2c8019a9f2e7e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 16:30:01 +0530
+Subject: perf/ibs: Fix interface via core pmu events
+
+From: Ravi Bangoria <ravi.bangoria@amd.com>
+
+[ Upstream commit 2fad201fe38ff9a692acedb1990ece2c52a29f95 ]
+
+Although, IBS pmus can be invoked via their own interface, indirect
+IBS invocation via core pmu events is also supported with fixed set
+of events: cpu-cycles:p, r076:p (same as cpu-cycles:p) and r0C1:p
+(micro-ops) for user convenience.
+
+This indirect IBS invocation is broken since commit 66d258c5b048
+("perf/core: Optimize perf_init_event()"), which added RAW pmu under
+'pmu_idr' list and thus if event_init() fails with RAW pmu, it started
+returning error instead of trying other pmus.
+
+Forward precise events from core pmu to IBS by overwriting 'type' and
+'config' in the kernel copy of perf_event_attr. Overwriting will cause
+perf_init_event() to retry with updated 'type' and 'config', which will
+automatically forward event to IBS pmu.
+
+Without patch:
+ $ sudo ./perf record -C 0 -e r076:p -- sleep 1
+ Error:
+ The r076:p event is not supported.
+
+With patch:
+ $ sudo ./perf record -C 0 -e r076:p -- sleep 1
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.341 MB perf.data (37 samples) ]
+
+Fixes: 66d258c5b048 ("perf/core: Optimize perf_init_event()")
+Reported-by: Stephane Eranian <eranian@google.com>
+Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20230504110003.2548-3-ravi.bangoria@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/amd/core.c | 2 +-
+ arch/x86/events/amd/ibs.c | 53 +++++++++++++++----------------
+ arch/x86/include/asm/perf_event.h | 2 ++
+ 3 files changed, 29 insertions(+), 28 deletions(-)
+
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index 8ca5e827f30b2..6672a3f05fc68 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -374,7 +374,7 @@ static int amd_pmu_hw_config(struct perf_event *event)
+
+ /* pass precise event sampling to ibs: */
+ if (event->attr.precise_ip && get_ibs_caps())
+- return -ENOENT;
++ return forward_event_to_ibs(event);
+
+ if (has_branch_stack(event) && !x86_pmu.lbr_nr)
+ return -EOPNOTSUPP;
+diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
+index 4cb710efbdd9a..37cbbc5c659a5 100644
+--- a/arch/x86/events/amd/ibs.c
++++ b/arch/x86/events/amd/ibs.c
+@@ -190,7 +190,7 @@ static struct perf_ibs *get_ibs_pmu(int type)
+ }
+
+ /*
+- * Use IBS for precise event sampling:
++ * core pmu config -> IBS config
+ *
+ * perf record -a -e cpu-cycles:p ... # use ibs op counting cycle count
+ * perf record -a -e r076:p ... # same as -e cpu-cycles:p
+@@ -199,25 +199,9 @@ static struct perf_ibs *get_ibs_pmu(int type)
+ * IbsOpCntCtl (bit 19) of IBS Execution Control Register (IbsOpCtl,
+ * MSRC001_1033) is used to select either cycle or micro-ops counting
+ * mode.
+- *
+- * The rip of IBS samples has skid 0. Thus, IBS supports precise
+- * levels 1 and 2 and the PERF_EFLAGS_EXACT is set. In rare cases the
+- * rip is invalid when IBS was not able to record the rip correctly.
+- * We clear PERF_EFLAGS_EXACT and take the rip from pt_regs then.
+- *
+ */
+-static int perf_ibs_precise_event(struct perf_event *event, u64 *config)
++static int core_pmu_ibs_config(struct perf_event *event, u64 *config)
+ {
+- switch (event->attr.precise_ip) {
+- case 0:
+- return -ENOENT;
+- case 1:
+- case 2:
+- break;
+- default:
+- return -EOPNOTSUPP;
+- }
+-
+ switch (event->attr.type) {
+ case PERF_TYPE_HARDWARE:
+ switch (event->attr.config) {
+@@ -243,22 +227,37 @@ static int perf_ibs_precise_event(struct perf_event *event, u64 *config)
+ return -EOPNOTSUPP;
+ }
+
++/*
++ * The rip of IBS samples has skid 0. Thus, IBS supports precise
++ * levels 1 and 2 and the PERF_EFLAGS_EXACT is set. In rare cases the
++ * rip is invalid when IBS was not able to record the rip correctly.
++ * We clear PERF_EFLAGS_EXACT and take the rip from pt_regs then.
++ */
++int forward_event_to_ibs(struct perf_event *event)
++{
++ u64 config = 0;
++
++ if (!event->attr.precise_ip || event->attr.precise_ip > 2)
++ return -EOPNOTSUPP;
++
++ if (!core_pmu_ibs_config(event, &config)) {
++ event->attr.type = perf_ibs_op.pmu.type;
++ event->attr.config = config;
++ }
++ return -ENOENT;
++}
++
+ static int perf_ibs_init(struct perf_event *event)
+ {
+ struct hw_perf_event *hwc = &event->hw;
+ struct perf_ibs *perf_ibs;
+ u64 max_cnt, config;
+- int ret;
+
+ perf_ibs = get_ibs_pmu(event->attr.type);
+- if (perf_ibs) {
+- config = event->attr.config;
+- } else {
+- perf_ibs = &perf_ibs_op;
+- ret = perf_ibs_precise_event(event, &config);
+- if (ret)
+- return ret;
+- }
++ if (!perf_ibs)
++ return -ENOENT;
++
++ config = event->attr.config;
+
+ if (event->pmu != &perf_ibs->pmu)
+ return -ENOENT;
+diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
+index 5d0f6891ae611..4d810b9478a43 100644
+--- a/arch/x86/include/asm/perf_event.h
++++ b/arch/x86/include/asm/perf_event.h
+@@ -467,8 +467,10 @@ struct pebs_xmm {
+
+ #ifdef CONFIG_X86_LOCAL_APIC
+ extern u32 get_ibs_caps(void);
++extern int forward_event_to_ibs(struct perf_event *event);
+ #else
+ static inline u32 get_ibs_caps(void) { return 0; }
++static inline int forward_event_to_ibs(struct perf_event *event) { return -ENOENT; }
+ #endif
+
+ #ifdef CONFIG_PERF_EVENTS
+--
+2.39.2
+
--- /dev/null
+From 79587d9cffb4e7a6ae7c1aadcf483b66455760f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 16:11:10 -0300
+Subject: perf script: Fix allocation of evsel->priv related to per-event dump
+ files
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 36d3e4138e1b6cc9ab179f3f397b5548f8b1eaae ]
+
+When printing output we may want to generate per event files, where the
+--per-event-dump option should be used, creating perf.data.EVENT.dump
+files instead of printing to stdout.
+
+The callback thar processes event thus expects that evsel->priv->fp
+should point to either the per-event FILE descriptor or to stdout.
+
+The a3af66f51bd0bca7 ("perf script: Fix crash because of missing
+evsel->priv") changeset fixed a case where evsel->priv wasn't setup,
+thus set to NULL, causing a segfault when trying to access
+evsel->priv->fp.
+
+But it did it for the non --per-event-dump case by allocating a 'struct
+perf_evsel_script' just to set its ->fp to stdout.
+
+Since evsel->priv is only freed when --per-event-dump is used, we ended
+up with a memory leak, detected using ASAN.
+
+Fix it by using the same method as perf_script__setup_per_event_dump(),
+and reuse that static 'struct perf_evsel_script'.
+
+Also check if evsel_script__new() failed.
+
+Fixes: a3af66f51bd0bca7 ("perf script: Fix crash because of missing evsel->priv")
+Reported-by: Ian Rogers <irogers@google.com>
+Tested-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Link: https://lore.kernel.org/lkml/ZH+F0wGAWV14zvMP@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-script.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
+index 7ca238277d835..a794a3d2e47b7 100644
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -2390,6 +2390,9 @@ static int process_sample_event(struct perf_tool *tool,
+ return ret;
+ }
+
++// Used when scr->per_event_dump is not set
++static struct evsel_script es_stdout;
++
+ static int process_attr(struct perf_tool *tool, union perf_event *event,
+ struct evlist **pevlist)
+ {
+@@ -2398,7 +2401,6 @@ static int process_attr(struct perf_tool *tool, union perf_event *event,
+ struct evsel *evsel, *pos;
+ u64 sample_type;
+ int err;
+- static struct evsel_script *es;
+
+ err = perf_event__process_attr(tool, event, pevlist);
+ if (err)
+@@ -2408,14 +2410,13 @@ static int process_attr(struct perf_tool *tool, union perf_event *event,
+ evsel = evlist__last(*pevlist);
+
+ if (!evsel->priv) {
+- if (scr->per_event_dump) {
++ if (scr->per_event_dump) {
+ evsel->priv = evsel_script__new(evsel, scr->session->data);
+- } else {
+- es = zalloc(sizeof(*es));
+- if (!es)
++ if (!evsel->priv)
+ return -ENOMEM;
+- es->fp = stdout;
+- evsel->priv = es;
++ } else { // Replicate what is done in perf_script__setup_per_event_dump()
++ es_stdout.fp = stdout;
++ evsel->priv = &es_stdout;
+ }
+ }
+
+@@ -2721,7 +2722,6 @@ static int perf_script__fopen_per_event_dump(struct perf_script *script)
+ static int perf_script__setup_per_event_dump(struct perf_script *script)
+ {
+ struct evsel *evsel;
+- static struct evsel_script es_stdout;
+
+ if (script->per_event_dump)
+ return perf_script__fopen_per_event_dump(script);
+--
+2.39.2
+
--- /dev/null
+From 6298c4349f822819a6b2cff7f96ae68a0354a99d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jun 2023 15:25:04 +0530
+Subject: perf tool x86: Consolidate is_amd check into single function
+
+From: Ravi Bangoria <ravi.bangoria@amd.com>
+
+[ Upstream commit 0cd1ca4650c9cf5f318110f67d39cbebae3693b3 ]
+
+There are multiple places where x86 specific code determines AMD vs
+Intel arch and acts based on that. Consolidate those checks into a
+single function.
+
+Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: Ananth Narayan <ananth.narayan@amd.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sandipan Das <sandipan.das@amd.com>
+Cc: Santosh Shukla <santosh.shukla@amd.com>
+Link: https://lore.kernel.org/r/20230613095506.547-3-ravi.bangoria@amd.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Stable-dep-of: 99d4850062a8 ("perf tool x86: Fix perf_env memory leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/arch/x86/util/Build | 1 +
+ tools/perf/arch/x86/util/env.c | 19 +++++++++++++++++++
+ tools/perf/arch/x86/util/env.h | 7 +++++++
+ tools/perf/arch/x86/util/evsel.c | 16 ++--------------
+ tools/perf/arch/x86/util/mem-events.c | 19 ++-----------------
+ 5 files changed, 31 insertions(+), 31 deletions(-)
+ create mode 100644 tools/perf/arch/x86/util/env.c
+ create mode 100644 tools/perf/arch/x86/util/env.h
+
+diff --git a/tools/perf/arch/x86/util/Build b/tools/perf/arch/x86/util/Build
+index dbeb04cb336e0..93c3ee5f95430 100644
+--- a/tools/perf/arch/x86/util/Build
++++ b/tools/perf/arch/x86/util/Build
+@@ -10,6 +10,7 @@ perf-y += evlist.o
+ perf-y += mem-events.o
+ perf-y += evsel.o
+ perf-y += iostat.o
++perf-y += env.o
+
+ perf-$(CONFIG_DWARF) += dwarf-regs.o
+ perf-$(CONFIG_BPF_PROLOGUE) += dwarf-regs.o
+diff --git a/tools/perf/arch/x86/util/env.c b/tools/perf/arch/x86/util/env.c
+new file mode 100644
+index 0000000000000..33b87f8ac1cc1
+--- /dev/null
++++ b/tools/perf/arch/x86/util/env.c
+@@ -0,0 +1,19 @@
++// SPDX-License-Identifier: GPL-2.0
++#include "linux/string.h"
++#include "util/env.h"
++#include "env.h"
++
++bool x86__is_amd_cpu(void)
++{
++ struct perf_env env = { .total_mem = 0, };
++ static int is_amd; /* 0: Uninitialized, 1: Yes, -1: No */
++
++ if (is_amd)
++ goto ret;
++
++ perf_env__cpuid(&env);
++ is_amd = env.cpuid && strstarts(env.cpuid, "AuthenticAMD") ? 1 : -1;
++
++ret:
++ return is_amd >= 1 ? true : false;
++}
+diff --git a/tools/perf/arch/x86/util/env.h b/tools/perf/arch/x86/util/env.h
+new file mode 100644
+index 0000000000000..d78f080b6b3f8
+--- /dev/null
++++ b/tools/perf/arch/x86/util/env.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _X86_ENV_H
++#define _X86_ENV_H
++
++bool x86__is_amd_cpu(void);
++
++#endif /* _X86_ENV_H */
+diff --git a/tools/perf/arch/x86/util/evsel.c b/tools/perf/arch/x86/util/evsel.c
+index ea3972d785d10..d72390cdf391d 100644
+--- a/tools/perf/arch/x86/util/evsel.c
++++ b/tools/perf/arch/x86/util/evsel.c
+@@ -7,6 +7,7 @@
+ #include "linux/string.h"
+ #include "evsel.h"
+ #include "util/debug.h"
++#include "env.h"
+
+ #define IBS_FETCH_L3MISSONLY (1ULL << 59)
+ #define IBS_OP_L3MISSONLY (1ULL << 16)
+@@ -97,23 +98,10 @@ void arch__post_evsel_config(struct evsel *evsel, struct perf_event_attr *attr)
+ {
+ struct perf_pmu *evsel_pmu, *ibs_fetch_pmu, *ibs_op_pmu;
+ static int warned_once;
+- /* 0: Uninitialized, 1: Yes, -1: No */
+- static int is_amd;
+
+- if (warned_once || is_amd == -1)
++ if (warned_once || !x86__is_amd_cpu())
+ return;
+
+- if (!is_amd) {
+- struct perf_env *env = evsel__env(evsel);
+-
+- if (!perf_env__cpuid(env) || !env->cpuid ||
+- !strstarts(env->cpuid, "AuthenticAMD")) {
+- is_amd = -1;
+- return;
+- }
+- is_amd = 1;
+- }
+-
+ evsel_pmu = evsel__find_pmu(evsel);
+ if (!evsel_pmu)
+ return;
+diff --git a/tools/perf/arch/x86/util/mem-events.c b/tools/perf/arch/x86/util/mem-events.c
+index f683ac702247c..efc0fae9ed0a7 100644
+--- a/tools/perf/arch/x86/util/mem-events.c
++++ b/tools/perf/arch/x86/util/mem-events.c
+@@ -4,6 +4,7 @@
+ #include "map_symbol.h"
+ #include "mem-events.h"
+ #include "linux/string.h"
++#include "env.h"
+
+ static char mem_loads_name[100];
+ static bool mem_loads_name__init;
+@@ -26,28 +27,12 @@ static struct perf_mem_event perf_mem_events_amd[PERF_MEM_EVENTS__MAX] = {
+ E("mem-ldst", "ibs_op//", "ibs_op"),
+ };
+
+-static int perf_mem_is_amd_cpu(void)
+-{
+- struct perf_env env = { .total_mem = 0, };
+-
+- perf_env__cpuid(&env);
+- if (env.cpuid && strstarts(env.cpuid, "AuthenticAMD"))
+- return 1;
+- return -1;
+-}
+-
+ struct perf_mem_event *perf_mem_events__ptr(int i)
+ {
+- /* 0: Uninitialized, 1: Yes, -1: No */
+- static int is_amd;
+-
+ if (i >= PERF_MEM_EVENTS__MAX)
+ return NULL;
+
+- if (!is_amd)
+- is_amd = perf_mem_is_amd_cpu();
+-
+- if (is_amd == 1)
++ if (x86__is_amd_cpu())
+ return &perf_mem_events_amd[i];
+
+ return &perf_mem_events_intel[i];
+--
+2.39.2
+
--- /dev/null
+From 8595990458f218317eca9268a0936ddcaa3bb012 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jun 2023 16:54:16 -0700
+Subject: perf tool x86: Fix perf_env memory leak
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 99d4850062a84564f36923764bb93935ef2ed108 ]
+
+Found by leak sanitizer:
+```
+==1632594==ERROR: LeakSanitizer: detected memory leaks
+
+Direct leak of 21 byte(s) in 1 object(s) allocated from:
+ #0 0x7f2953a7077b in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:439
+ #1 0x556701d6fbbf in perf_env__read_cpuid util/env.c:369
+ #2 0x556701d70589 in perf_env__cpuid util/env.c:465
+ #3 0x55670204bba2 in x86__is_amd_cpu arch/x86/util/env.c:14
+ #4 0x5567020487a2 in arch__post_evsel_config arch/x86/util/evsel.c:83
+ #5 0x556701d8f78b in evsel__config util/evsel.c:1366
+ #6 0x556701ef5872 in evlist__config util/record.c:108
+ #7 0x556701cd6bcd in test__PERF_RECORD tests/perf-record.c:112
+ #8 0x556701cacd07 in run_test tests/builtin-test.c:236
+ #9 0x556701cacfac in test_and_print tests/builtin-test.c:265
+ #10 0x556701cadddb in __cmd_test tests/builtin-test.c:402
+ #11 0x556701caf2aa in cmd_test tests/builtin-test.c:559
+ #12 0x556701d3b557 in run_builtin tools/perf/perf.c:323
+ #13 0x556701d3bac8 in handle_internal_command tools/perf/perf.c:377
+ #14 0x556701d3be90 in run_argv tools/perf/perf.c:421
+ #15 0x556701d3c3f8 in main tools/perf/perf.c:537
+ #16 0x7f2952a46189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
+
+SUMMARY: AddressSanitizer: 21 byte(s) leaked in 1 allocation(s).
+```
+
+Fixes: f7b58cbdb3ff36eb ("perf mem/c2c: Add load store event mappings for AMD")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Ravi Bangoria <ravi.bangoria@amd.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Link: https://lore.kernel.org/r/20230613235416.1650755-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/arch/x86/util/env.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/arch/x86/util/env.c b/tools/perf/arch/x86/util/env.c
+index 33b87f8ac1cc1..3e537ffb1353a 100644
+--- a/tools/perf/arch/x86/util/env.c
++++ b/tools/perf/arch/x86/util/env.c
+@@ -13,7 +13,7 @@ bool x86__is_amd_cpu(void)
+
+ perf_env__cpuid(&env);
+ is_amd = env.cpuid && strstarts(env.cpuid, "AuthenticAMD") ? 1 : -1;
+-
++ perf_env__exit(&env);
+ ret:
+ return is_amd >= 1 ? true : false;
+ }
+--
+2.39.2
+
--- /dev/null
+From 491fe189006dadbfd02f6ca96798b4d7f5d7dcb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 13:53:33 +0300
+Subject: pinctrl: at91-pio4: check return value of devm_kasprintf()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit f6fd5d4ff8ca0b24cee1af4130bcb1fa96b61aa0 ]
+
+devm_kasprintf() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller")
+Depends-on: 1c4e5c470a56 ("pinctrl: at91: use devm_kasprintf() to avoid potential leaks")
+Depends-on: 5a8f9cf269e8 ("pinctrl: at91-pio4: use proper format specifier for unsigned int")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20230615105333.585304-4-claudiu.beznea@microchip.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91-pio4.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index 0b7cc6f063e00..f71c6457e3509 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -1122,6 +1122,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
+ /* Pin naming convention: P(bank_name)(bank_pin_number). */
+ pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d",
+ bank + 'A', line);
++ if (!pin_desc[i].name)
++ return -ENOMEM;
+
+ group->name = group_names[i] = pin_desc[i].name;
+ group->pin = pin_desc[i].number;
+--
+2.39.2
+
--- /dev/null
+From 19ebd7ba46792c44d49228a0b6a157237ac17a28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 23:43:41 +0200
+Subject: pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit cdf7e616120065007687fe1df0412154f259daec ]
+
+gpiochip_add_pin_range() can fail, so better return its error code than
+a hard coded '0'.
+
+Fixes: d2b67744fd99 ("pinctrl: bcm2835: implement hook for missing gpio-ranges")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/98c3b5890bb72415145c9fe4e1d974711edae376.1681681402.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+index 0f1ab0829ffe6..fe8da3ccb0b5a 100644
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -376,10 +376,8 @@ static int bcm2835_of_gpio_ranges_fallback(struct gpio_chip *gc,
+ if (!pctldev)
+ return 0;
+
+- gpiochip_add_pin_range(gc, pinctrl_dev_get_devname(pctldev), 0, 0,
+- gc->ngpio);
+-
+- return 0;
++ return gpiochip_add_pin_range(gc, pinctrl_dev_get_devname(pctldev), 0, 0,
++ gc->ngpio);
+ }
+
+ static const struct gpio_chip bcm2835_gpio_chip = {
+--
+2.39.2
+
--- /dev/null
+From 690d4b25b2f96060fae903264708fcbbfb9d95ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jun 2023 17:37:34 +0300
+Subject: pinctrl: cherryview: Return correct value if pin in push-pull mode
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 5835196a17be5cfdcad0b617f90cf4abe16951a4 ]
+
+Currently the getter returns ENOTSUPP on pin configured in
+the push-pull mode. Fix this by adding the missed switch case.
+
+Fixes: ccdf81d08dbe ("pinctrl: cherryview: add option to set open-drain pin config")
+Fixes: 6e08d6bbebeb ("pinctrl: Add Intel Cherryview/Braswell pin controller support")
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-cherryview.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index 5c4fd16e5b010..0d6b5fab2f7e4 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -947,11 +947,6 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned int pin,
+
+ break;
+
+- case PIN_CONFIG_DRIVE_OPEN_DRAIN:
+- if (!(ctrl1 & CHV_PADCTRL1_ODEN))
+- return -EINVAL;
+- break;
+-
+ case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: {
+ u32 cfg;
+
+@@ -961,6 +956,16 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned int pin,
+ return -EINVAL;
+
+ break;
++
++ case PIN_CONFIG_DRIVE_PUSH_PULL:
++ if (ctrl1 & CHV_PADCTRL1_ODEN)
++ return -EINVAL;
++ break;
++
++ case PIN_CONFIG_DRIVE_OPEN_DRAIN:
++ if (!(ctrl1 & CHV_PADCTRL1_ODEN))
++ return -EINVAL;
++ break;
+ }
+
+ default:
+--
+2.39.2
+
--- /dev/null
+From 507e99cd0b76193ad38e44b485b44bac8e9be79b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 13:53:32 +0300
+Subject: pinctrl: microchip-sgpio: check return value of devm_kasprintf()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 310cd4c206cd04696ccbfd1927b5ab6973e8cc8e ]
+
+devm_kasprintf() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: 7e5ea974e61c ("pinctrl: pinctrl-microchip-sgpio: Add pinctrl driver for Microsemi Serial GPIO")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20230615105333.585304-3-claudiu.beznea@microchip.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-microchip-sgpio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pinctrl/pinctrl-microchip-sgpio.c b/drivers/pinctrl/pinctrl-microchip-sgpio.c
+index af27b72c89586..96a20ce94f5e9 100644
+--- a/drivers/pinctrl/pinctrl-microchip-sgpio.c
++++ b/drivers/pinctrl/pinctrl-microchip-sgpio.c
+@@ -816,6 +816,9 @@ static int microchip_sgpio_register_bank(struct device *dev,
+ pctl_desc->name = devm_kasprintf(dev, GFP_KERNEL, "%s-%sput",
+ dev_name(dev),
+ bank->is_input ? "in" : "out");
++ if (!pctl_desc->name)
++ return -ENOMEM;
++
+ pctl_desc->pctlops = &sgpio_pctl_ops;
+ pctl_desc->pmxops = &sgpio_pmx_ops;
+ pctl_desc->confops = &sgpio_confops;
+--
+2.39.2
+
--- /dev/null
+From b64b104469463ab4faf3bdb73a9615821d3d85b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jun 2023 17:58:29 +0800
+Subject: pinctrl: npcm7xx: Add missing check for ioremap
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit ad64639417161e90b30dda00486570eb150aeee5 ]
+
+Add check for ioremap() and return the error if it fails in order to
+guarantee the success of ioremap().
+
+Fixes: 3b588e43ee5c ("pinctrl: nuvoton: add NPCM7xx pinctrl and GPIO driver")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20230607095829.1345-1-jiasheng@iscas.ac.cn
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
+index 1c4e89b046de1..ac4c69132fa03 100644
+--- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
++++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
+@@ -1878,6 +1878,8 @@ static int npcm7xx_gpio_of(struct npcm7xx_pinctrl *pctrl)
+ }
+
+ pctrl->gpio_bank[id].base = ioremap(res.start, resource_size(&res));
++ if (!pctrl->gpio_bank[id].base)
++ return -EINVAL;
+
+ ret = bgpio_init(&pctrl->gpio_bank[id].gc, dev, 4,
+ pctrl->gpio_bank[id].base + NPCM7XX_GP_N_DIN,
+--
+2.39.2
+
--- /dev/null
+From c5b9c7a05e6c4c6bdac4c2f219a4c92c1283e7ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 May 2023 20:34:37 +0800
+Subject: pinctrl: sunplus: Add check for kmalloc
+
+From: Wells Lu <wellslutw@gmail.com>
+
+[ Upstream commit a5961bed5429cf1134d7f539b4ed60317012f84d ]
+
+Fix Smatch static checker warning:
+potential null dereference 'configs'. (kmalloc returns null)
+
+Fixes: aa74c44be19c ("pinctrl: Add driver for Sunplus SP7021")
+Signed-off-by: Wells Lu <wellslutw@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/1685277277-12209-1-git-send-email-wellslutw@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sunplus/sppctl.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/sunplus/sppctl.c b/drivers/pinctrl/sunplus/sppctl.c
+index 2b3335ab56c66..0449595b943cf 100644
+--- a/drivers/pinctrl/sunplus/sppctl.c
++++ b/drivers/pinctrl/sunplus/sppctl.c
+@@ -838,11 +838,6 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
+ int i, size = 0;
+
+ list = of_get_property(np_config, "sunplus,pins", &size);
+-
+- if (nmG <= 0)
+- nmG = 0;
+-
+- parent = of_get_parent(np_config);
+ *num_maps = size / sizeof(*list);
+
+ /*
+@@ -870,10 +865,14 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
+ }
+ }
+
++ if (nmG <= 0)
++ nmG = 0;
++
+ *map = kcalloc(*num_maps + nmG, sizeof(**map), GFP_KERNEL);
+- if (*map == NULL)
++ if (!(*map))
+ return -ENOMEM;
+
++ parent = of_get_parent(np_config);
+ for (i = 0; i < (*num_maps); i++) {
+ dt_pin = be32_to_cpu(list[i]);
+ pin_num = FIELD_GET(GENMASK(31, 24), dt_pin);
+@@ -887,6 +886,8 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
+ (*map)[i].data.configs.num_configs = 1;
+ (*map)[i].data.configs.group_or_pin = pin_get_name(pctldev, pin_num);
+ configs = kmalloc(sizeof(*configs), GFP_KERNEL);
++ if (!configs)
++ goto sppctl_map_err;
+ *configs = FIELD_GET(GENMASK(7, 0), dt_pin);
+ (*map)[i].data.configs.configs = configs;
+
+@@ -900,6 +901,8 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
+ (*map)[i].data.configs.num_configs = 1;
+ (*map)[i].data.configs.group_or_pin = pin_get_name(pctldev, pin_num);
+ configs = kmalloc(sizeof(*configs), GFP_KERNEL);
++ if (!configs)
++ goto sppctl_map_err;
+ *configs = SPPCTL_IOP_CONFIGS;
+ (*map)[i].data.configs.configs = configs;
+
+@@ -969,6 +972,15 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
+ of_node_put(parent);
+ dev_dbg(pctldev->dev, "%d pins mapped\n", *num_maps);
+ return 0;
++
++sppctl_map_err:
++ for (i = 0; i < (*num_maps); i++)
++ if (((*map)[i].type == PIN_MAP_TYPE_CONFIGS_PIN) &&
++ (*map)[i].data.configs.configs)
++ kfree((*map)[i].data.configs.configs);
++ kfree(*map);
++ of_node_put(parent);
++ return -ENOMEM;
+ }
+
+ static const struct pinctrl_ops sppctl_pctl_ops = {
+--
+2.39.2
+
--- /dev/null
+From 1bab5342f61f9fa25e600d633e3dab8514c58205 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 May 2023 20:34:37 +0800
+Subject: pinctrl:sunplus: Add check for kmalloc
+
+From: Wells Lu <wellslutw@gmail.com>
+
+[ Upstream commit 73f8ce7f961afcb3be49352efeb7c26cc1c00cc4 ]
+
+Fix Smatch static checker warning:
+potential null dereference 'configs'. (kmalloc returns null)
+
+Changes in v2:
+1. Add free allocated memory before returned -ENOMEM.
+2. Add call of_node_put() before returned -ENOMEM.
+
+Fixes: aa74c44be19c ("pinctrl: Add driver for Sunplus SP7021")
+Signed-off-by: Wells Lu <wellslutw@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/1685277277-12209-1-git-send-email-wellslutw@gmail.com
+[Rebased on the patch from Lu Hongfei]
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sunplus/sppctl.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/sunplus/sppctl.c b/drivers/pinctrl/sunplus/sppctl.c
+index 0449595b943cf..6b24fa0e63c0f 100644
+--- a/drivers/pinctrl/sunplus/sppctl.c
++++ b/drivers/pinctrl/sunplus/sppctl.c
+@@ -975,8 +975,7 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
+
+ sppctl_map_err:
+ for (i = 0; i < (*num_maps); i++)
+- if (((*map)[i].type == PIN_MAP_TYPE_CONFIGS_PIN) &&
+- (*map)[i].data.configs.configs)
++ if ((*map)[i].type == PIN_MAP_TYPE_CONFIGS_PIN)
+ kfree((*map)[i].data.configs.configs);
+ kfree(*map);
+ of_node_put(parent);
+--
+2.39.2
+
--- /dev/null
+From 9b1c8e877e552181d40f754053a01aa516a158e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jun 2023 11:43:10 +0300
+Subject: platform/x86/dell/dell-rbtn: Fix resources leaking on error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Wilczynski <michal.wilczynski@intel.com>
+
+[ Upstream commit 966cca72ab20289083521a385fa56035d85a222d ]
+
+Currently rbtn_add() in case of failure is leaking resources. Fix this
+by adding a proper rollback. Move devm_kzalloc() before rbtn_acquire(),
+so it doesn't require rollback in case of failure. While at it, remove
+unnecessary assignment of NULL to device->driver_data and unnecessary
+whitespace, plus add a break for the default case in a switch.
+
+Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Suggested-by: Pali Rohár <pali@kernel.org>
+Fixes: 817a5cdb40c8 ("dell-rbtn: Dell Airplane Mode Switch driver")
+Signed-off-by: Michal Wilczynski <michal.wilczynski@intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Rafael J. Wysocki <rafael@kernel.org>
+Reviewed-by: Pali Rohár <pali@kernel.org>
+Link: https://lore.kernel.org/r/20230613084310.2775896-1-michal.wilczynski@intel.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell/dell-rbtn.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/platform/x86/dell/dell-rbtn.c b/drivers/platform/x86/dell/dell-rbtn.c
+index aa0e6c9074942..c8fcb537fd65d 100644
+--- a/drivers/platform/x86/dell/dell-rbtn.c
++++ b/drivers/platform/x86/dell/dell-rbtn.c
+@@ -395,16 +395,16 @@ static int rbtn_add(struct acpi_device *device)
+ return -EINVAL;
+ }
+
++ rbtn_data = devm_kzalloc(&device->dev, sizeof(*rbtn_data), GFP_KERNEL);
++ if (!rbtn_data)
++ return -ENOMEM;
++
+ ret = rbtn_acquire(device, true);
+ if (ret < 0) {
+ dev_err(&device->dev, "Cannot enable device\n");
+ return ret;
+ }
+
+- rbtn_data = devm_kzalloc(&device->dev, sizeof(*rbtn_data), GFP_KERNEL);
+- if (!rbtn_data)
+- return -ENOMEM;
+-
+ rbtn_data->type = type;
+ device->driver_data = rbtn_data;
+
+@@ -420,10 +420,12 @@ static int rbtn_add(struct acpi_device *device)
+ break;
+ default:
+ ret = -EINVAL;
++ break;
+ }
++ if (ret)
++ rbtn_acquire(device, false);
+
+ return ret;
+-
+ }
+
+ static void rbtn_remove(struct acpi_device *device)
+@@ -442,7 +444,6 @@ static void rbtn_remove(struct acpi_device *device)
+ }
+
+ rbtn_acquire(device, false);
+- device->driver_data = NULL;
+ }
+
+ static void rbtn_notify(struct acpi_device *device, u32 event)
+--
+2.39.2
+
--- /dev/null
+From cfd81409c8430d96e9597c2f5390135c51b36530 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Apr 2023 18:57:50 +0200
+Subject: platform/x86: lenovo-yogabook: Fix work race on remove()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 9148cd2eb4450a8e9c49c8a14201fb82f651128f ]
+
+When yogabook_wmi_remove() runs yogabook_wmi_work might still be running
+and using the devices which yogabook_wmi_remove() puts.
+
+To avoid this move to explicitly cancelling the work rather then using
+devm_work_autocancel().
+
+This requires also making the yogabook_backside_hall_irq handler non
+devm managed, so that it cannot re-queue the work while
+yogabook_wmi_remove() runs.
+
+Fixes: c0549b72d99d ("platform/x86: lenovo-yogabook-wmi: Add driver for Lenovo Yoga Book")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230430165807.472798-3-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/lenovo-yogabook-wmi.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/platform/x86/lenovo-yogabook-wmi.c b/drivers/platform/x86/lenovo-yogabook-wmi.c
+index 5f4bd1eec38a9..3a6de4ab74a41 100644
+--- a/drivers/platform/x86/lenovo-yogabook-wmi.c
++++ b/drivers/platform/x86/lenovo-yogabook-wmi.c
+@@ -2,7 +2,6 @@
+ /* WMI driver for Lenovo Yoga Book YB1-X90* / -X91* tablets */
+
+ #include <linux/acpi.h>
+-#include <linux/devm-helpers.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/gpio/machine.h>
+ #include <linux/interrupt.h>
+@@ -248,10 +247,7 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context)
+ data->brightness = YB_KBD_BL_DEFAULT;
+ set_bit(YB_KBD_IS_ON, &data->flags);
+ set_bit(YB_DIGITIZER_IS_ON, &data->flags);
+-
+- r = devm_work_autocancel(&wdev->dev, &data->work, yogabook_wmi_work);
+- if (r)
+- return r;
++ INIT_WORK(&data->work, yogabook_wmi_work);
+
+ data->kbd_adev = acpi_dev_get_first_match_dev("GDIX1001", NULL, -1);
+ if (!data->kbd_adev) {
+@@ -299,10 +295,9 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context)
+ }
+ data->backside_hall_irq = r;
+
+- r = devm_request_irq(&wdev->dev, data->backside_hall_irq,
+- yogabook_backside_hall_irq,
+- IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
+- "backside_hall_sw", data);
++ r = request_irq(data->backside_hall_irq, yogabook_backside_hall_irq,
++ IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
++ "backside_hall_sw", data);
+ if (r) {
+ dev_err_probe(&wdev->dev, r, "Requesting backside_hall_sw IRQ\n");
+ goto error_put_devs;
+@@ -318,11 +313,14 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context)
+ r = devm_led_classdev_register(&wdev->dev, &data->kbd_bl_led);
+ if (r < 0) {
+ dev_err_probe(&wdev->dev, r, "Registering backlight LED device\n");
+- goto error_put_devs;
++ goto error_free_irq;
+ }
+
+ return 0;
+
++error_free_irq:
++ free_irq(data->backside_hall_irq, data);
++ cancel_work_sync(&data->work);
+ error_put_devs:
+ put_device(data->dig_dev);
+ put_device(data->kbd_dev);
+@@ -335,6 +333,8 @@ static void yogabook_wmi_remove(struct wmi_device *wdev)
+ {
+ struct yogabook_wmi *data = dev_get_drvdata(&wdev->dev);
+
++ free_irq(data->backside_hall_irq, data);
++ cancel_work_sync(&data->work);
+ put_device(data->dig_dev);
+ put_device(data->kbd_dev);
+ acpi_dev_put(data->dig_adev);
+--
+2.39.2
+
--- /dev/null
+From 8f6f3fbddc7b099053d0b1a6465c0dc873d50908 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Apr 2023 18:57:51 +0200
+Subject: platform/x86: lenovo-yogabook: Reprobe devices on remove()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 711bcc0cb34e96a60e88d7b0260862781de3e530 ]
+
+Ensure that both the keyboard touchscreen and the digitizer have their
+driver bound after remove(). Without this modprobing lenovo-yogabook-wmi
+after a rmmod fails because lenovo-yogabook-wmi defers probing until
+both devices have their driver bound.
+
+Fixes: c0549b72d99d ("platform/x86: lenovo-yogabook-wmi: Add driver for Lenovo Yoga Book")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230430165807.472798-4-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/lenovo-yogabook-wmi.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/platform/x86/lenovo-yogabook-wmi.c b/drivers/platform/x86/lenovo-yogabook-wmi.c
+index 3a6de4ab74a41..5948ffa74acd5 100644
+--- a/drivers/platform/x86/lenovo-yogabook-wmi.c
++++ b/drivers/platform/x86/lenovo-yogabook-wmi.c
+@@ -332,9 +332,20 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context)
+ static void yogabook_wmi_remove(struct wmi_device *wdev)
+ {
+ struct yogabook_wmi *data = dev_get_drvdata(&wdev->dev);
++ int r = 0;
+
+ free_irq(data->backside_hall_irq, data);
+ cancel_work_sync(&data->work);
++
++ if (!test_bit(YB_KBD_IS_ON, &data->flags))
++ r |= device_reprobe(data->kbd_dev);
++
++ if (!test_bit(YB_DIGITIZER_IS_ON, &data->flags))
++ r |= device_reprobe(data->dig_dev);
++
++ if (r)
++ dev_warn(&wdev->dev, "Reprobe of devices failed\n");
++
+ put_device(data->dig_dev);
+ put_device(data->kbd_dev);
+ acpi_dev_put(data->dig_adev);
+--
+2.39.2
+
--- /dev/null
+From a1881f5c2d3df3a52ae14d7712338ca247a26602 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Apr 2023 18:57:52 +0200
+Subject: platform/x86: lenovo-yogabook: Set default keyboard backligh
+ brightness on probe()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 9e6380d6573181c555ca1b5019b08d19a9ee581c ]
+
+Set default keyboard backlight brightness on probe(), this fixes
+the backlight being off after a rmmod + modprobe.
+
+Fixes: c0549b72d99d ("platform/x86: lenovo-yogabook-wmi: Add driver for Lenovo Yoga Book")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230430165807.472798-5-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/lenovo-yogabook-wmi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/platform/x86/lenovo-yogabook-wmi.c b/drivers/platform/x86/lenovo-yogabook-wmi.c
+index 5948ffa74acd5..d57fcc8388519 100644
+--- a/drivers/platform/x86/lenovo-yogabook-wmi.c
++++ b/drivers/platform/x86/lenovo-yogabook-wmi.c
+@@ -295,6 +295,9 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context)
+ }
+ data->backside_hall_irq = r;
+
++ /* Set default brightness before enabling the IRQ */
++ yogabook_wmi_set_kbd_backlight(data->wdev, YB_KBD_BL_DEFAULT);
++
+ r = request_irq(data->backside_hall_irq, yogabook_backside_hall_irq,
+ IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
+ "backside_hall_sw", data);
+--
+2.39.2
+
--- /dev/null
+From db47337a8f043bedef4022bc095cb172cf67d47f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 16:05:50 -0400
+Subject: platform/x86: think-lmi: Correct NVME password handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 4cebb42412248d28df6de01420cfac5654428d41 ]
+
+NVME passwords identifier have been standardised across the Lenovo
+systems and now use udrp and adrp (user and admin level) instead of
+unvp and mnvp.
+
+This should apparently be backwards compatible.
+
+Fixes: 640a5fa50a42 ("platform/x86: think-lmi: Opcode support")
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230601200552.4396-6-mpearson-lenovo@squebb.ca
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/think-lmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
+index 3a511c0f13e45..3cbb92b6c5215 100644
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -461,9 +461,9 @@ static ssize_t new_password_store(struct kobject *kobj,
+ sprintf(pwd_type, "mhdp%d", setting->index);
+ } else if (setting == tlmi_priv.pwd_nvme) {
+ if (setting->level == TLMI_LEVEL_USER)
+- sprintf(pwd_type, "unvp%d", setting->index);
++ sprintf(pwd_type, "udrp%d", setting->index);
+ else
+- sprintf(pwd_type, "mnvp%d", setting->index);
++ sprintf(pwd_type, "adrp%d", setting->index);
+ } else {
+ sprintf(pwd_type, "%s", setting->pwd_type);
+ }
+--
+2.39.2
+
--- /dev/null
+From 4309f5df54e3af3fdf0937a2b67b8c2a6abdd55d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 16:05:47 -0400
+Subject: platform/x86: think-lmi: Correct System password interface
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 97eef5983372d7aee6549d644d788fd0c10d2b6e ]
+
+The system password identification was incorrect. This means that if
+the password was enabled it wouldn't be detected correctly; and setting
+it would not work.
+Also updated code to use TLMI_SMP_PWD instead of TLMI_SYS_PWD to be in
+sync with Lenovo documentation.
+
+Fixes: 640a5fa50a42 ("platform/x86: think-lmi: Opcode support")
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230601200552.4396-3-mpearson-lenovo@squebb.ca
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/think-lmi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
+index 4e6040c0a2201..3a511c0f13e45 100644
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -172,7 +172,7 @@ MODULE_PARM_DESC(debug_support, "Enable debug command support");
+ #define TLMI_POP_PWD (1 << 0)
+ #define TLMI_PAP_PWD (1 << 1)
+ #define TLMI_HDD_PWD (1 << 2)
+-#define TLMI_SYS_PWD (1 << 3)
++#define TLMI_SMP_PWD (1 << 6) /* System Management */
+ #define TLMI_CERT (1 << 7)
+
+ #define to_tlmi_pwd_setting(kobj) container_of(kobj, struct tlmi_pwd_setting, kobj)
+@@ -1522,11 +1522,11 @@ static int tlmi_analyze(void)
+ tlmi_priv.pwd_power->valid = true;
+
+ if (tlmi_priv.opcode_support) {
+- tlmi_priv.pwd_system = tlmi_create_auth("sys", "system");
++ tlmi_priv.pwd_system = tlmi_create_auth("smp", "system");
+ if (!tlmi_priv.pwd_system)
+ goto fail_clear_attr;
+
+- if (tlmi_priv.pwdcfg.core.password_state & TLMI_SYS_PWD)
++ if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD)
+ tlmi_priv.pwd_system->valid = true;
+
+ tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd");
+--
+2.39.2
+
--- /dev/null
+From 7c4e5ffd0759e1b42ca8c4f63b5494b1505a3222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 16:05:45 -0400
+Subject: platform/x86: think-lmi: mutex protection around multiple WMI calls
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit c41e0121a1221894a1a9c4666156db9e1def4d6c ]
+
+When an attribute is being changed if the Admin account is enabled, or if
+a password is being updated then multiple WMI calls are needed.
+Add mutex protection to ensure no race conditions are introduced.
+
+Fixes: b49f72e7f96d ("platform/x86: think-lmi: Certificate authentication support")
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230601200552.4396-1-mpearson-lenovo@squebb.ca
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/think-lmi.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
+index 336b9029d1515..4e6040c0a2201 100644
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -14,6 +14,7 @@
+ #include <linux/acpi.h>
+ #include <linux/errno.h>
+ #include <linux/fs.h>
++#include <linux/mutex.h>
+ #include <linux/string.h>
+ #include <linux/types.h>
+ #include <linux/dmi.h>
+@@ -195,6 +196,7 @@ static const char * const level_options[] = {
+ };
+ static struct think_lmi tlmi_priv;
+ static struct class *fw_attr_class;
++static DEFINE_MUTEX(tlmi_mutex);
+
+ /* ------ Utility functions ------------*/
+ /* Strip out CR if one is present */
+@@ -437,6 +439,9 @@ static ssize_t new_password_store(struct kobject *kobj,
+ /* Strip out CR if one is present, setting password won't work if it is present */
+ strip_cr(new_pwd);
+
++ /* Use lock in case multiple WMI operations needed */
++ mutex_lock(&tlmi_mutex);
++
+ pwdlen = strlen(new_pwd);
+ /* pwdlen == 0 is allowed to clear the password */
+ if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) {
+@@ -493,6 +498,7 @@ static ssize_t new_password_store(struct kobject *kobj,
+ kfree(auth_str);
+ }
+ out:
++ mutex_unlock(&tlmi_mutex);
+ kfree(new_pwd);
+ return ret ?: count;
+ }
+@@ -982,6 +988,9 @@ static ssize_t current_value_store(struct kobject *kobj,
+ /* Strip out CR if one is present */
+ strip_cr(new_setting);
+
++ /* Use lock in case multiple WMI operations needed */
++ mutex_lock(&tlmi_mutex);
++
+ /* Check if certificate authentication is enabled and active */
+ if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) {
+ if (!tlmi_priv.pwd_admin->signature || !tlmi_priv.pwd_admin->save_signature) {
+@@ -1040,6 +1049,7 @@ static ssize_t current_value_store(struct kobject *kobj,
+ kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
+ }
+ out:
++ mutex_unlock(&tlmi_mutex);
+ kfree(auth_str);
+ kfree(set_str);
+ kfree(new_setting);
+--
+2.39.2
+
--- /dev/null
+From d3c39f5be3d9ea820fed76cb862f4fcd26f3c448 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 11:18:04 -0400
+Subject: platform/x86: thinkpad_acpi: Fix lkp-tests warnings for platform
+ profiles
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit f999e23ce66c1555d7b653fba171a88ecee53704 ]
+
+Fix issues identified in dytc_profile_refresh identified by lkp-tests.
+drivers/platform/x86/thinkpad_acpi.c:10538
+ dytc_profile_refresh() error: uninitialized symbol 'funcmode'.
+drivers/platform/x86/thinkpad_acpi.c:10531
+ dytc_profile_refresh() error: uninitialized symbol 'output'.
+drivers/platform/x86/thinkpad_acpi.c:10537
+ dytc_profile_refresh() error: uninitialized symbol 'output'.
+
+These issues should not lead to real problems in the field as the refresh
+function should only be called if MMC or PSC mode enabled. But good to fix.
+
+Thanks to Dan Carpenter and the lkp-tests project for flagging these.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Closes: https://lore.kernel.org/r/202306011202.1hbgLRD4-lkp@intel.com/
+Fixes: 1bc5d819f0b9 ("platform/x86: thinkpad_acpi: Fix profile modes on Intel platforms")
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://lore.kernel.org/r/20230606151804.8819-1-mpearson-lenovo@squebb.ca
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 5b2c8dd2861b7..e7ece2738de94 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -10528,8 +10528,8 @@ static int dytc_profile_set(struct platform_profile_handler *pprof,
+ static void dytc_profile_refresh(void)
+ {
+ enum platform_profile_option profile;
+- int output, err = 0;
+- int perfmode, funcmode;
++ int output = 0, err = 0;
++ int perfmode, funcmode = 0;
+
+ mutex_lock(&dytc_mutex);
+ if (dytc_capabilities & BIT(DYTC_FC_MMC)) {
+@@ -10542,6 +10542,8 @@ static void dytc_profile_refresh(void)
+ err = dytc_command(DYTC_CMD_GET, &output);
+ /* Check if we are PSC mode, or have AMT enabled */
+ funcmode = (output >> DYTC_GET_FUNCTION_BIT) & 0xF;
++ } else { /* Unknown profile mode */
++ err = -ENODEV;
+ }
+ mutex_unlock(&dytc_mutex);
+ if (err)
+--
+2.39.2
+
--- /dev/null
+From 6b35663bca50f7cf75527bce3c2b98a4ce0ba1ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 06:07:43 -0700
+Subject: PM: domains: fix integer overflow issues in genpd_parse_state()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit e5d1c8722083f0332dcd3c85fa1273d85fb6bed8 ]
+
+Currently, while calculating residency and latency values, right
+operands may overflow if resulting values are big enough.
+
+To prevent this, albeit unlikely case, play it safe and convert
+right operands to left ones' type s64.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 30f604283e05 ("PM / Domains: Allow domain power states to be read from DT")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/domain.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index b411201f75bfb..b33fc322e0928 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -2923,10 +2923,10 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state,
+
+ err = of_property_read_u32(state_node, "min-residency-us", &residency);
+ if (!err)
+- genpd_state->residency_ns = 1000 * residency;
++ genpd_state->residency_ns = 1000LL * residency;
+
+- genpd_state->power_on_latency_ns = 1000 * exit_latency;
+- genpd_state->power_off_latency_ns = 1000 * entry_latency;
++ genpd_state->power_on_latency_ns = 1000LL * exit_latency;
++ genpd_state->power_off_latency_ns = 1000LL * entry_latency;
+ genpd_state->fwnode = &state_node->fwnode;
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From df0457f3c7f97694a995e734d682785b6b8d3df4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 11:55:36 +0200
+Subject: PM: domains: Move the verification of in-params from
+ genpd_add_device()
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 4384a70c8813e8573d1841fd94eee873f80a7e1a ]
+
+Commit f38d1a6d0025 ("PM: domains: Allocate governor data dynamically
+based on a genpd governor") started to use the in-parameters in
+genpd_add_device(), without first doing a verification of them.
+
+This isn't really a big problem, as most callers do a verification already.
+
+Therefore, let's drop the verification from genpd_add_device() and make
+sure all the callers take care of it instead.
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Fixes: f38d1a6d0025 ("PM: domains: Allocate governor data dynamically based on a genpd governor")
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/domain.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index b33fc322e0928..56ceba4698024 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -1624,9 +1624,6 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
+
+ dev_dbg(dev, "%s()\n", __func__);
+
+- if (IS_ERR_OR_NULL(genpd) || IS_ERR_OR_NULL(dev))
+- return -EINVAL;
+-
+ gpd_data = genpd_alloc_dev_data(dev, gd);
+ if (IS_ERR(gpd_data))
+ return PTR_ERR(gpd_data);
+@@ -1668,6 +1665,9 @@ int pm_genpd_add_device(struct generic_pm_domain *genpd, struct device *dev)
+ {
+ int ret;
+
++ if (!genpd || !dev)
++ return -EINVAL;
++
+ mutex_lock(&gpd_list_lock);
+ ret = genpd_add_device(genpd, dev, dev);
+ mutex_unlock(&gpd_list_lock);
+@@ -2514,6 +2514,9 @@ int of_genpd_add_device(struct of_phandle_args *genpdspec, struct device *dev)
+ struct generic_pm_domain *genpd;
+ int ret;
+
++ if (!dev)
++ return -EINVAL;
++
+ mutex_lock(&gpd_list_lock);
+
+ genpd = genpd_get_from_provider(genpdspec);
+--
+2.39.2
+
--- /dev/null
+From 41e228a03f6ba30cc96842e308f3f33441d5fd0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 22:16:34 +0200
+Subject: posix-timers: Prevent RT livelock in itimer_delete()
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 9d9e522010eb5685d8b53e8a24320653d9d4cbbf ]
+
+itimer_delete() has a retry loop when the timer is concurrently expired. On
+non-RT kernels this just spin-waits until the timer callback has completed,
+except for posix CPU timers which have HAVE_POSIX_CPU_TIMERS_TASK_WORK
+enabled.
+
+In that case and on RT kernels the existing task could live lock when
+preempting the task which does the timer delivery.
+
+Replace spin_unlock() with an invocation of timer_wait_running() to handle
+it the same way as the other retry loops in the posix timer code.
+
+Fixes: ec8f954a40da ("posix-timers: Use a callback for cancel synchronization on PREEMPT_RT")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Link: https://lore.kernel.org/r/87v8g7c50d.ffs@tglx
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/posix-timers.c | 43 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 35 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
+index 808a247205a9a..ed3c4a9543982 100644
+--- a/kernel/time/posix-timers.c
++++ b/kernel/time/posix-timers.c
+@@ -1037,27 +1037,52 @@ SYSCALL_DEFINE1(timer_delete, timer_t, timer_id)
+ }
+
+ /*
+- * return timer owned by the process, used by exit_itimers
++ * Delete a timer if it is armed, remove it from the hash and schedule it
++ * for RCU freeing.
+ */
+ static void itimer_delete(struct k_itimer *timer)
+ {
+-retry_delete:
+- spin_lock_irq(&timer->it_lock);
++ unsigned long flags;
++
++ /*
++ * irqsave is required to make timer_wait_running() work.
++ */
++ spin_lock_irqsave(&timer->it_lock, flags);
+
++retry_delete:
++ /*
++ * Even if the timer is not longer accessible from other tasks
++ * it still might be armed and queued in the underlying timer
++ * mechanism. Worse, that timer mechanism might run the expiry
++ * function concurrently.
++ */
+ if (timer_delete_hook(timer) == TIMER_RETRY) {
+- spin_unlock_irq(&timer->it_lock);
++ /*
++ * Timer is expired concurrently, prevent livelocks
++ * and pointless spinning on RT.
++ *
++ * timer_wait_running() drops timer::it_lock, which opens
++ * the possibility for another task to delete the timer.
++ *
++ * That's not possible here because this is invoked from
++ * do_exit() only for the last thread of the thread group.
++ * So no other task can access and delete that timer.
++ */
++ if (WARN_ON_ONCE(timer_wait_running(timer, &flags) != timer))
++ return;
++
+ goto retry_delete;
+ }
+ list_del(&timer->list);
+
+- spin_unlock_irq(&timer->it_lock);
++ spin_unlock_irqrestore(&timer->it_lock, flags);
+ release_posix_timer(timer, IT_ID_SET);
+ }
+
+ /*
+- * This is called by do_exit or de_thread, only when nobody else can
+- * modify the signal->posix_timers list. Yet we need sighand->siglock
+- * to prevent the race with /proc/pid/timers.
++ * Invoked from do_exit() when the last thread of a thread group exits.
++ * At that point no other task can access the timers of the dying
++ * task anymore.
+ */
+ void exit_itimers(struct task_struct *tsk)
+ {
+@@ -1067,10 +1092,12 @@ void exit_itimers(struct task_struct *tsk)
+ if (list_empty(&tsk->signal->posix_timers))
+ return;
+
++ /* Protect against concurrent read via /proc/$PID/timers */
+ spin_lock_irq(&tsk->sighand->siglock);
+ list_replace_init(&tsk->signal->posix_timers, &timers);
+ spin_unlock_irq(&tsk->sighand->siglock);
+
++ /* The timers are not longer accessible via tsk::signal */
+ while (!list_empty(&timers)) {
+ tmr = list_first_entry(&timers, struct k_itimer, list);
+ itimer_delete(tmr);
+--
+2.39.2
+
--- /dev/null
+From 1b2dd04440d1d4f553bacaf5b7cc796f78faec19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 22:00:00 +0800
+Subject: powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+[ Upstream commit 4658fe81b3f8afe8adf37734ec5fe595d90415c6 ]
+
+After commit 3382388d7148 ("intel_rapl: abstract RAPL common code"),
+accessing to IOSF_MBI interface is done in the RAPL common code.
+
+Thus it is the CONFIG_INTEL_RAPL_CORE that has dependency of
+CONFIG_IOSF_MBI, while CONFIG_INTEL_RAPL_MSR does not.
+
+This problem was not exposed previously because all the previous RAPL
+common code users, aka, the RAPL MSR and MMIO I/F drivers, have
+CONFIG_IOSF_MBI selected.
+
+Fix the CONFIG_IOSF_MBI dependency in RAPL code. This also fixes a build
+time failure when the RAPL TPMI I/F driver is introduced without
+selecting CONFIG_IOSF_MBI.
+
+x86_64-linux-ld: vmlinux.o: in function `set_floor_freq_atom':
+intel_rapl_common.c:(.text+0x2dac9b8): undefined reference to `iosf_mbi_write'
+x86_64-linux-ld: intel_rapl_common.c:(.text+0x2daca66): undefined reference to `iosf_mbi_read'
+
+Reference to iosf_mbi.h is also removed from the RAPL MSR I/F driver.
+
+Fixes: 3382388d7148 ("intel_rapl: abstract RAPL common code")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/all/20230601213246.3271412-1-arnd@kernel.org
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/powercap/Kconfig | 4 +++-
+ drivers/powercap/intel_rapl_msr.c | 1 -
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/powercap/Kconfig b/drivers/powercap/Kconfig
+index 515e3ceb3393a..863e240b37e01 100644
+--- a/drivers/powercap/Kconfig
++++ b/drivers/powercap/Kconfig
+@@ -18,10 +18,12 @@ if POWERCAP
+ # Client driver configurations go here.
+ config INTEL_RAPL_CORE
+ tristate
++ depends on PCI
++ select IOSF_MBI
+
+ config INTEL_RAPL
+ tristate "Intel RAPL Support via MSR Interface"
+- depends on X86 && IOSF_MBI
++ depends on X86 && PCI
+ select INTEL_RAPL_CORE
+ help
+ This enables support for the Intel Running Average Power Limit (RAPL)
+diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c
+index bc6adda588835..65adb4cbaaf8e 100644
+--- a/drivers/powercap/intel_rapl_msr.c
++++ b/drivers/powercap/intel_rapl_msr.c
+@@ -22,7 +22,6 @@
+ #include <linux/processor.h>
+ #include <linux/platform_device.h>
+
+-#include <asm/iosf_mbi.h>
+ #include <asm/cpu_device_id.h>
+ #include <asm/intel-family.h>
+
+--
+2.39.2
+
--- /dev/null
+From 0d429e143982340d48aed2902d74462ea072e730 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jun 2023 20:10:24 +1000
+Subject: powerpc/64s: Fix VAS mm use after free
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit b4bda59b47879cce38a6ec5a01cd3cac702b5331 ]
+
+The refcount on mm is dropped before the coprocessor is detached.
+
+Reported-by: Sachin Sant <sachinp@linux.ibm.com>
+Fixes: 7bc6f71bdff5f ("powerpc/vas: Define and use common vas_window struct")
+Fixes: b22f2d88e435c ("powerpc/pseries/vas: Integrate API with open/close windows")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Tested-by: Sachin Sant <sachinp@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230607101024.14559-1-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/vas-window.c | 2 +-
+ arch/powerpc/platforms/pseries/vas.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/platforms/powernv/vas-window.c b/arch/powerpc/platforms/powernv/vas-window.c
+index 0072682531d80..b664838008c12 100644
+--- a/arch/powerpc/platforms/powernv/vas-window.c
++++ b/arch/powerpc/platforms/powernv/vas-window.c
+@@ -1310,8 +1310,8 @@ int vas_win_close(struct vas_window *vwin)
+ /* if send window, drop reference to matching receive window */
+ if (window->tx_win) {
+ if (window->user_win) {
+- put_vas_user_win_ref(&vwin->task_ref);
+ mm_context_remove_vas_window(vwin->task_ref.mm);
++ put_vas_user_win_ref(&vwin->task_ref);
+ }
+ put_rx_win(window->rxwin);
+ }
+diff --git a/arch/powerpc/platforms/pseries/vas.c b/arch/powerpc/platforms/pseries/vas.c
+index 94c023bb13e05..880b962afc057 100644
+--- a/arch/powerpc/platforms/pseries/vas.c
++++ b/arch/powerpc/platforms/pseries/vas.c
+@@ -507,8 +507,8 @@ static int vas_deallocate_window(struct vas_window *vwin)
+ vascaps[win->win_type].nr_open_windows--;
+ mutex_unlock(&vas_pseries_mutex);
+
+- put_vas_user_win_ref(&vwin->task_ref);
+ mm_context_remove_vas_window(vwin->task_ref.mm);
++ put_vas_user_win_ref(&vwin->task_ref);
+
+ kfree(win);
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 0a4775b74ddb5ac35de9940d12e6b6c21038027d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jun 2023 16:38:13 +0530
+Subject: powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit 0da90af431abc3f497a38ec9ef6e43b0d0dabe80 ]
+
+On memory unplug reduce DirectMap page count correctly.
+root@ubuntu-guest:# grep Direct /proc/meminfo
+DirectMap4k: 0 kB
+DirectMap64k: 0 kB
+DirectMap2M: 115343360 kB
+DirectMap1G: 0 kB
+
+Before fix:
+root@ubuntu-guest:# ndctl disable-namespace all
+disabled 1 namespace
+root@ubuntu-guest:# grep Direct /proc/meminfo
+DirectMap4k: 0 kB
+DirectMap64k: 0 kB
+DirectMap2M: 115343360 kB
+DirectMap1G: 0 kB
+
+After fix:
+root@ubuntu-guest:# ndctl disable-namespace all
+disabled 1 namespace
+root@ubuntu-guest:# grep Direct /proc/meminfo
+DirectMap4k: 0 kB
+DirectMap64k: 0 kB
+DirectMap2M: 104857600 kB
+DirectMap1G: 0 kB
+
+Fixes: a2dc009afa9a ("powerpc/mm/book3s/radix: Add mapping statistics")
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Tested-by: Sachin Sant <sachinp@linux.ibm.com <mailto:sachinp@linux.ibm.com>>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230616110826.344417-4-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/book3s64/radix_pgtable.c | 34 +++++++++++++++---------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c
+index 2297aa764ecdb..e8db8c8efe359 100644
+--- a/arch/powerpc/mm/book3s64/radix_pgtable.c
++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c
+@@ -745,9 +745,9 @@ static void free_pud_table(pud_t *pud_start, p4d_t *p4d)
+ }
+
+ static void remove_pte_table(pte_t *pte_start, unsigned long addr,
+- unsigned long end)
++ unsigned long end, bool direct)
+ {
+- unsigned long next;
++ unsigned long next, pages = 0;
+ pte_t *pte;
+
+ pte = pte_start + pte_index(addr);
+@@ -769,13 +769,16 @@ static void remove_pte_table(pte_t *pte_start, unsigned long addr,
+ }
+
+ pte_clear(&init_mm, addr, pte);
++ pages++;
+ }
++ if (direct)
++ update_page_count(mmu_virtual_psize, -pages);
+ }
+
+ static void __meminit remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
+- unsigned long end)
++ unsigned long end, bool direct)
+ {
+- unsigned long next;
++ unsigned long next, pages = 0;
+ pte_t *pte_base;
+ pmd_t *pmd;
+
+@@ -793,19 +796,22 @@ static void __meminit remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
+ continue;
+ }
+ pte_clear(&init_mm, addr, (pte_t *)pmd);
++ pages++;
+ continue;
+ }
+
+ pte_base = (pte_t *)pmd_page_vaddr(*pmd);
+- remove_pte_table(pte_base, addr, next);
++ remove_pte_table(pte_base, addr, next, direct);
+ free_pte_table(pte_base, pmd);
+ }
++ if (direct)
++ update_page_count(MMU_PAGE_2M, -pages);
+ }
+
+ static void __meminit remove_pud_table(pud_t *pud_start, unsigned long addr,
+- unsigned long end)
++ unsigned long end, bool direct)
+ {
+- unsigned long next;
++ unsigned long next, pages = 0;
+ pmd_t *pmd_base;
+ pud_t *pud;
+
+@@ -823,16 +829,20 @@ static void __meminit remove_pud_table(pud_t *pud_start, unsigned long addr,
+ continue;
+ }
+ pte_clear(&init_mm, addr, (pte_t *)pud);
++ pages++;
+ continue;
+ }
+
+ pmd_base = pud_pgtable(*pud);
+- remove_pmd_table(pmd_base, addr, next);
++ remove_pmd_table(pmd_base, addr, next, direct);
+ free_pmd_table(pmd_base, pud);
+ }
++ if (direct)
++ update_page_count(MMU_PAGE_1G, -pages);
+ }
+
+-static void __meminit remove_pagetable(unsigned long start, unsigned long end)
++static void __meminit remove_pagetable(unsigned long start, unsigned long end,
++ bool direct)
+ {
+ unsigned long addr, next;
+ pud_t *pud_base;
+@@ -861,7 +871,7 @@ static void __meminit remove_pagetable(unsigned long start, unsigned long end)
+ }
+
+ pud_base = p4d_pgtable(*p4d);
+- remove_pud_table(pud_base, addr, next);
++ remove_pud_table(pud_base, addr, next, direct);
+ free_pud_table(pud_base, p4d);
+ }
+
+@@ -884,7 +894,7 @@ int __meminit radix__create_section_mapping(unsigned long start,
+
+ int __meminit radix__remove_section_mapping(unsigned long start, unsigned long end)
+ {
+- remove_pagetable(start, end);
++ remove_pagetable(start, end, true);
+ return 0;
+ }
+ #endif /* CONFIG_MEMORY_HOTPLUG */
+@@ -920,7 +930,7 @@ int __meminit radix__vmemmap_create_mapping(unsigned long start,
+ #ifdef CONFIG_MEMORY_HOTPLUG
+ void __meminit radix__vmemmap_remove_mapping(unsigned long start, unsigned long page_size)
+ {
+- remove_pagetable(start, start + page_size);
++ remove_pagetable(start, start + page_size, false);
+ }
+ #endif
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 427f0b213e1c7f336317a4cc44d8699d8f87bcc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jun 2023 10:55:26 +0200
+Subject: powerpc/interrupt: Don't read MSR from
+ interrupt_exit_kernel_prepare()
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 0eb089a72fda3f7969e6277804bde75dc1474a14 ]
+
+A disassembly of interrupt_exit_kernel_prepare() shows a useless read
+of MSR register. This is shown by r9 being re-used immediately without
+doing anything with the value read.
+
+ c000e0e0: 60 00 00 00 nop
+ c000e0e4: 7d 3a c2 a6 mfmd_ap r9
+ c000e0e8: 7d 20 00 a6 mfmsr r9
+ c000e0ec: 7c 51 13 a6 mtspr 81,r2
+ c000e0f0: 81 3f 00 84 lwz r9,132(r31)
+ c000e0f4: 71 29 80 00 andi. r9,r9,32768
+
+This is due to the use of local_irq_save(). The flags read by
+local_irq_save() are never used, use local_irq_disable() instead.
+
+Fixes: 13799748b957 ("powerpc/64: use interrupt restart table to speed up return from interrupt")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/df36c6205ab64326fb1b991993c82057e92ace2f.1685955214.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/interrupt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/interrupt.c b/arch/powerpc/kernel/interrupt.c
+index 0ec1581619db5..cf770d86c03c6 100644
+--- a/arch/powerpc/kernel/interrupt.c
++++ b/arch/powerpc/kernel/interrupt.c
+@@ -368,7 +368,6 @@ void preempt_schedule_irq(void);
+
+ notrace unsigned long interrupt_exit_kernel_prepare(struct pt_regs *regs)
+ {
+- unsigned long flags;
+ unsigned long ret = 0;
+ unsigned long kuap;
+ bool stack_store = read_thread_flags() & _TIF_EMULATE_STACK_STORE;
+@@ -392,7 +391,7 @@ notrace unsigned long interrupt_exit_kernel_prepare(struct pt_regs *regs)
+
+ kuap = kuap_get_and_assert_locked();
+
+- local_irq_save(flags);
++ local_irq_disable();
+
+ if (!arch_irq_disabled_regs(regs)) {
+ /* Returning to a kernel context with local irqs enabled. */
+--
+2.39.2
+
--- /dev/null
+From d7e4aaa332c0af119aec12d0cd4d4115eeff6c85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jun 2023 16:38:15 +0530
+Subject: powerpc/mm/dax: Fix the condition when checking if altmap vmemap can
+ cross-boundary
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit c8eebc4a99f15280654f23e914e746c40a516e50 ]
+
+Without this fix, the last subsection vmemmap can end up in memory even if
+the namespace is created with -M mem and has sufficient space in the altmap
+area.
+
+Fixes: cf387d9644d8 ("libnvdimm/altmap: Track namespace boundaries in altmap")
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Tested-by: Sachin Sant <sachinp@linux.ibm.com <mailto:sachinp@linux.ibm.com>>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230616110826.344417-6-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/init_64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
+index 05b0d584e50b8..fe1b83020e0df 100644
+--- a/arch/powerpc/mm/init_64.c
++++ b/arch/powerpc/mm/init_64.c
+@@ -189,7 +189,7 @@ static bool altmap_cross_boundary(struct vmem_altmap *altmap, unsigned long star
+ unsigned long nr_pfn = page_size / sizeof(struct page);
+ unsigned long start_pfn = page_to_pfn((struct page *)start);
+
+- if ((start_pfn + nr_pfn) > altmap->end_pfn)
++ if ((start_pfn + nr_pfn - 1) > altmap->end_pfn)
+ return true;
+
+ if (start_pfn < altmap->base_pfn)
+--
+2.39.2
+
--- /dev/null
+From 7071b655297d92c15da085286af7ede48d32bd01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jun 2023 10:58:49 +0100
+Subject: powerpc/powernv/sriov: perform null check on iov before dereferencing
+ iov
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit f4f913c980bc6abe0ccfe88fe3909c125afe4a2d ]
+
+Currently pointer iov is being dereferenced before the null check of iov
+which can lead to null pointer dereference errors. Fix this by moving the
+iov null check before the dereferencing.
+
+Detected using cppcheck static analysis:
+linux/arch/powerpc/platforms/powernv/pci-sriov.c:597:12: warning: Either
+the condition '!iov' is redundant or there is possible null pointer
+dereference: iov. [nullPointerRedundantCheck]
+ num_vfs = iov->num_vfs;
+ ^
+
+Fixes: 052da31d45fc ("powerpc/powernv/sriov: De-indent setup and teardown")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230608095849.1147969-1-colin.i.king@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/pci-sriov.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/platforms/powernv/pci-sriov.c b/arch/powerpc/platforms/powernv/pci-sriov.c
+index 7195133b26bb9..59882da3e7425 100644
+--- a/arch/powerpc/platforms/powernv/pci-sriov.c
++++ b/arch/powerpc/platforms/powernv/pci-sriov.c
+@@ -594,12 +594,12 @@ static void pnv_pci_sriov_disable(struct pci_dev *pdev)
+ struct pnv_iov_data *iov;
+
+ iov = pnv_iov_get(pdev);
+- num_vfs = iov->num_vfs;
+- base_pe = iov->vf_pe_arr[0].pe_number;
+-
+ if (WARN_ON(!iov))
+ return;
+
++ num_vfs = iov->num_vfs;
++ base_pe = iov->vf_pe_arr[0].pe_number;
++
+ /* Release VF PEs */
+ pnv_ioda_release_vf_PE(pdev);
+
+--
+2.39.2
+
--- /dev/null
+From cfe6707c3adb83df6000a4be9154386d92177094 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jun 2023 10:58:35 +0200
+Subject: powerpc/signal32: Force inlining of __unsafe_save_user_regs() and
+ save_tm_user_regs_unsafe()
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit a03b1a0b19398a47489fdcef02ec19c2ba05a15d ]
+
+Looking at generated code for handle_signal32() shows calls to a
+function called __unsafe_save_user_regs.constprop.0 while user access
+is open.
+
+And that __unsafe_save_user_regs.constprop.0 function has two nops at
+the begining, allowing it to be traced, which is unexpected during
+user access open window.
+
+The solution could be to mark __unsafe_save_user_regs() no trace, but
+to be on the safe side the most efficient is to flag it __always_inline
+as already done for function __unsafe_restore_general_regs(). The
+function is relatively small and only called twice, so the size
+increase will remain in the noise.
+
+Do the same with save_tm_user_regs_unsafe() as it may suffer the
+same issue.
+
+Fixes: ef75e7318294 ("powerpc/signal32: Transform save_user_regs() and save_tm_user_regs() in 'unsafe' version")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/7e469c8f01860a69c1ada3ca6a5e2aa65f0f74b2.1685955220.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/signal_32.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index c114c7f25645c..7a718ed32b277 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -264,8 +264,9 @@ static void prepare_save_user_regs(int ctx_has_vsx_region)
+ #endif
+ }
+
+-static int __unsafe_save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+- struct mcontext __user *tm_frame, int ctx_has_vsx_region)
++static __always_inline int
++__unsafe_save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
++ struct mcontext __user *tm_frame, int ctx_has_vsx_region)
+ {
+ unsigned long msr = regs->msr;
+
+@@ -364,8 +365,9 @@ static void prepare_save_tm_user_regs(void)
+ current->thread.ckvrsave = mfspr(SPRN_VRSAVE);
+ }
+
+-static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame,
+- struct mcontext __user *tm_frame, unsigned long msr)
++static __always_inline int
++save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame,
++ struct mcontext __user *tm_frame, unsigned long msr)
+ {
+ /* Save both sets of general registers */
+ unsafe_save_general_regs(¤t->thread.ckpt_regs, frame, failed);
+@@ -444,8 +446,9 @@ static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user
+ #else
+ static void prepare_save_tm_user_regs(void) { }
+
+-static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame,
+- struct mcontext __user *tm_frame, unsigned long msr)
++static __always_inline int
++save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame,
++ struct mcontext __user *tm_frame, unsigned long msr)
+ {
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 3eb67cb41563ec374a37c895e2704ab246712a7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Nov 2022 22:49:31 +1000
+Subject: powerpc: simplify ppc_save_regs
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 37195b820d32c23bdefce3f460ed7de48a57e5e4 ]
+
+Adjust the pt_regs pointer so the interrupt frame offsets can be used
+to save registers.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20221127124942.1665522-7-npiggin@gmail.com
+Stable-dep-of: b684c09f09e7 ("powerpc: update ppc_save_regs to save current r1 in pt_regs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/ppc_save_regs.S | 57 ++++++++---------------------
+ 1 file changed, 15 insertions(+), 42 deletions(-)
+
+diff --git a/arch/powerpc/kernel/ppc_save_regs.S b/arch/powerpc/kernel/ppc_save_regs.S
+index 2d4d21bb46a97..6e86f3bf46735 100644
+--- a/arch/powerpc/kernel/ppc_save_regs.S
++++ b/arch/powerpc/kernel/ppc_save_regs.S
+@@ -21,60 +21,33 @@
+ * different ABIs, though).
+ */
+ _GLOBAL(ppc_save_regs)
+- PPC_STL r0,0*SZL(r3)
++ /* This allows stack frame accessor macros and offsets to be used */
++ subi r3,r3,STACK_FRAME_OVERHEAD
++ PPC_STL r0,GPR0(r3)
+ #ifdef CONFIG_PPC32
+- stmw r2, 2*SZL(r3)
++ stmw r2,GPR2(r3)
+ #else
+- PPC_STL r2,2*SZL(r3)
+- PPC_STL r3,3*SZL(r3)
+- PPC_STL r4,4*SZL(r3)
+- PPC_STL r5,5*SZL(r3)
+- PPC_STL r6,6*SZL(r3)
+- PPC_STL r7,7*SZL(r3)
+- PPC_STL r8,8*SZL(r3)
+- PPC_STL r9,9*SZL(r3)
+- PPC_STL r10,10*SZL(r3)
+- PPC_STL r11,11*SZL(r3)
+- PPC_STL r12,12*SZL(r3)
+- PPC_STL r13,13*SZL(r3)
+- PPC_STL r14,14*SZL(r3)
+- PPC_STL r15,15*SZL(r3)
+- PPC_STL r16,16*SZL(r3)
+- PPC_STL r17,17*SZL(r3)
+- PPC_STL r18,18*SZL(r3)
+- PPC_STL r19,19*SZL(r3)
+- PPC_STL r20,20*SZL(r3)
+- PPC_STL r21,21*SZL(r3)
+- PPC_STL r22,22*SZL(r3)
+- PPC_STL r23,23*SZL(r3)
+- PPC_STL r24,24*SZL(r3)
+- PPC_STL r25,25*SZL(r3)
+- PPC_STL r26,26*SZL(r3)
+- PPC_STL r27,27*SZL(r3)
+- PPC_STL r28,28*SZL(r3)
+- PPC_STL r29,29*SZL(r3)
+- PPC_STL r30,30*SZL(r3)
+- PPC_STL r31,31*SZL(r3)
++ SAVE_GPRS(2, 31, r3)
+ lbz r0,PACAIRQSOFTMASK(r13)
+- PPC_STL r0,SOFTE-STACK_FRAME_OVERHEAD(r3)
++ PPC_STL r0,SOFTE(r3)
+ #endif
+ /* go up one stack frame for SP */
+ PPC_LL r4,0(r1)
+- PPC_STL r4,1*SZL(r3)
++ PPC_STL r4,GPR1(r3)
+ /* get caller's LR */
+ PPC_LL r0,LRSAVE(r4)
+- PPC_STL r0,_LINK-STACK_FRAME_OVERHEAD(r3)
++ PPC_STL r0,_LINK(r3)
+ mflr r0
+- PPC_STL r0,_NIP-STACK_FRAME_OVERHEAD(r3)
++ PPC_STL r0,_NIP(r3)
+ mfmsr r0
+- PPC_STL r0,_MSR-STACK_FRAME_OVERHEAD(r3)
++ PPC_STL r0,_MSR(r3)
+ mfctr r0
+- PPC_STL r0,_CTR-STACK_FRAME_OVERHEAD(r3)
++ PPC_STL r0,_CTR(r3)
+ mfxer r0
+- PPC_STL r0,_XER-STACK_FRAME_OVERHEAD(r3)
++ PPC_STL r0,_XER(r3)
+ mfcr r0
+- PPC_STL r0,_CCR-STACK_FRAME_OVERHEAD(r3)
++ PPC_STL r0,_CCR(r3)
+ li r0,0
+- PPC_STL r0,_TRAP-STACK_FRAME_OVERHEAD(r3)
+- PPC_STL r0,ORIG_GPR3-STACK_FRAME_OVERHEAD(r3)
++ PPC_STL r0,_TRAP(r3)
++ PPC_STL r0,ORIG_GPR3(r3)
+ blr
+--
+2.39.2
+
--- /dev/null
+From fbedf5f57c6b22bf218d6ef0a5bcbc6bdd8c01b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 14:40:47 +0530
+Subject: powerpc: update ppc_save_regs to save current r1 in pt_regs
+
+From: Aditya Gupta <adityag@linux.ibm.com>
+
+[ Upstream commit b684c09f09e7a6af3794d4233ef785819e72db79 ]
+
+ppc_save_regs() skips one stack frame while saving the CPU register states.
+Instead of saving current R1, it pulls the previous stack frame pointer.
+
+When vmcores caused by direct panic call (such as `echo c >
+/proc/sysrq-trigger`), are debugged with gdb, gdb fails to show the
+backtrace correctly. On further analysis, it was found that it was because
+of mismatch between r1 and NIP.
+
+GDB uses NIP to get current function symbol and uses corresponding debug
+info of that function to unwind previous frames, but due to the
+mismatching r1 and NIP, the unwinding does not work, and it fails to
+unwind to the 2nd frame and hence does not show the backtrace.
+
+GDB backtrace with vmcore of kernel without this patch:
+
+---------
+(gdb) bt
+ #0 0xc0000000002a53e8 in crash_setup_regs (oldregs=<optimized out>,
+ newregs=0xc000000004f8f8d8) at ./arch/powerpc/include/asm/kexec.h:69
+ #1 __crash_kexec (regs=<optimized out>) at kernel/kexec_core.c:974
+ #2 0x0000000000000063 in ?? ()
+ #3 0xc000000003579320 in ?? ()
+---------
+
+Further analysis revealed that the mismatch occurred because
+"ppc_save_regs" was saving the previous stack's SP instead of the current
+r1. This patch fixes this by storing current r1 in the saved pt_regs.
+
+GDB backtrace with vmcore of patched kernel:
+
+--------
+(gdb) bt
+ #0 0xc0000000002a53e8 in crash_setup_regs (oldregs=0x0, newregs=0xc00000000670b8d8)
+ at ./arch/powerpc/include/asm/kexec.h:69
+ #1 __crash_kexec (regs=regs@entry=0x0) at kernel/kexec_core.c:974
+ #2 0xc000000000168918 in panic (fmt=fmt@entry=0xc000000001654a60 "sysrq triggered crash\n")
+ at kernel/panic.c:358
+ #3 0xc000000000b735f8 in sysrq_handle_crash (key=<optimized out>) at drivers/tty/sysrq.c:155
+ #4 0xc000000000b742cc in __handle_sysrq (key=key@entry=99, check_mask=check_mask@entry=false)
+ at drivers/tty/sysrq.c:602
+ #5 0xc000000000b7506c in write_sysrq_trigger (file=<optimized out>, buf=<optimized out>,
+ count=2, ppos=<optimized out>) at drivers/tty/sysrq.c:1163
+ #6 0xc00000000069a7bc in pde_write (ppos=<optimized out>, count=<optimized out>,
+ buf=<optimized out>, file=<optimized out>, pde=0xc00000000362cb40) at fs/proc/inode.c:340
+ #7 proc_reg_write (file=<optimized out>, buf=<optimized out>, count=<optimized out>,
+ ppos=<optimized out>) at fs/proc/inode.c:352
+ #8 0xc0000000005b3bbc in vfs_write (file=file@entry=0xc000000006aa6b00,
+ buf=buf@entry=0x61f498b4f60 <error: Cannot access memory at address 0x61f498b4f60>,
+ count=count@entry=2, pos=pos@entry=0xc00000000670bda0) at fs/read_write.c:582
+ #9 0xc0000000005b4264 in ksys_write (fd=<optimized out>,
+ buf=0x61f498b4f60 <error: Cannot access memory at address 0x61f498b4f60>, count=2)
+ at fs/read_write.c:637
+ #10 0xc00000000002ea2c in system_call_exception (regs=0xc00000000670be80, r0=<optimized out>)
+ at arch/powerpc/kernel/syscall.c:171
+ #11 0xc00000000000c270 in system_call_vectored_common ()
+ at arch/powerpc/kernel/interrupt_64.S:192
+--------
+
+Nick adds:
+ So this now saves regs as though it was an interrupt taken in the
+ caller, at the instruction after the call to ppc_save_regs, whereas
+ previously the NIP was there, but R1 came from the caller's caller and
+ that mismatch is what causes gdb's dwarf unwinder to go haywire.
+
+Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
+Fixes: d16a58f8854b1 ("powerpc: Improve ppc_save_regs()")
+Reivewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230615091047.90433-1-adityag@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/ppc_save_regs.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kernel/ppc_save_regs.S b/arch/powerpc/kernel/ppc_save_regs.S
+index 6e86f3bf46735..235ae24284519 100644
+--- a/arch/powerpc/kernel/ppc_save_regs.S
++++ b/arch/powerpc/kernel/ppc_save_regs.S
+@@ -31,10 +31,10 @@ _GLOBAL(ppc_save_regs)
+ lbz r0,PACAIRQSOFTMASK(r13)
+ PPC_STL r0,SOFTE(r3)
+ #endif
+- /* go up one stack frame for SP */
+- PPC_LL r4,0(r1)
+- PPC_STL r4,GPR1(r3)
++ /* store current SP */
++ PPC_STL r1,GPR1(r3)
+ /* get caller's LR */
++ PPC_LL r4,0(r1)
+ PPC_LL r0,LRSAVE(r4)
+ PPC_STL r0,_LINK(r3)
+ mflr r0
+--
+2.39.2
+
--- /dev/null
+From fa91391cc82a746a7332ca8edc3dca8ccfdf189e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 17:37:33 +0800
+Subject: pstore/ram: Add check for kstrdup
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit d97038d5ec2062733c1e016caf9baaf68cf64ea1 ]
+
+Add check for the return value of kstrdup() and return the error
+if it fails in order to avoid NULL pointer dereference.
+
+Fixes: e163fdb3f7f8 ("pstore/ram: Regularize prz label allocation lifetime")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230614093733.36048-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram_core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 8bf09886e7e66..2384de1c2d187 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -591,6 +591,8 @@ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
+ raw_spin_lock_init(&prz->buffer_lock);
+ prz->flags = flags;
+ prz->label = kstrdup(label, GFP_KERNEL);
++ if (!prz->label)
++ goto err;
+
+ ret = persistent_ram_buffer_map(start, size, prz, memtype);
+ if (ret)
+--
+2.39.2
+
--- /dev/null
+From 1bad65ac821d2f7a63e5ce10199c1bd12b80ede1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 08:12:28 -0700
+Subject: radeon: avoid double free in ci_dpm_init()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 20c3dffdccbd494e0dd631d1660aeecbff6775f2 ]
+
+Several calls to ci_dpm_fini() will attempt to free resources that
+either have been freed before or haven't been allocated yet. This
+may lead to undefined or dangerous behaviour.
+
+For instance, if r600_parse_extended_power_table() fails, it might
+call r600_free_extended_power_table() as will ci_dpm_fini() later
+during error handling.
+
+Fix this by only freeing pointers to objects previously allocated.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: cc8dbbb4f62a ("drm/radeon: add dpm support for CI dGPUs (v2)")
+Co-developed-by: Natalia Petrova <n.petrova@fintech.ru>
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/ci_dpm.c | 28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
+index 8ef25ab305ae7..b8f4dac68d850 100644
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -5517,6 +5517,7 @@ static int ci_parse_power_table(struct radeon_device *rdev)
+ u8 frev, crev;
+ u8 *power_state_offset;
+ struct ci_ps *ps;
++ int ret;
+
+ if (!atom_parse_data_header(mode_info->atom_context, index, NULL,
+ &frev, &crev, &data_offset))
+@@ -5546,11 +5547,15 @@ static int ci_parse_power_table(struct radeon_device *rdev)
+ non_clock_array_index = power_state->v2.nonClockInfoIndex;
+ non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
+ &non_clock_info_array->nonClockInfo[non_clock_array_index];
+- if (!rdev->pm.power_state[i].clock_info)
+- return -EINVAL;
++ if (!rdev->pm.power_state[i].clock_info) {
++ ret = -EINVAL;
++ goto err_free_ps;
++ }
+ ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL);
+- if (ps == NULL)
+- return -ENOMEM;
++ if (ps == NULL) {
++ ret = -ENOMEM;
++ goto err_free_ps;
++ }
+ rdev->pm.dpm.ps[i].ps_priv = ps;
+ ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i],
+ non_clock_info,
+@@ -5590,6 +5595,12 @@ static int ci_parse_power_table(struct radeon_device *rdev)
+ }
+
+ return 0;
++
++err_free_ps:
++ for (i = 0; i < rdev->pm.dpm.num_ps; i++)
++ kfree(rdev->pm.dpm.ps[i].ps_priv);
++ kfree(rdev->pm.dpm.ps);
++ return ret;
+ }
+
+ static int ci_get_vbios_boot_values(struct radeon_device *rdev,
+@@ -5678,25 +5689,26 @@ int ci_dpm_init(struct radeon_device *rdev)
+
+ ret = ci_get_vbios_boot_values(rdev, &pi->vbios_boot_state);
+ if (ret) {
+- ci_dpm_fini(rdev);
++ kfree(rdev->pm.dpm.priv);
+ return ret;
+ }
+
+ ret = r600_get_platform_caps(rdev);
+ if (ret) {
+- ci_dpm_fini(rdev);
++ kfree(rdev->pm.dpm.priv);
+ return ret;
+ }
+
+ ret = r600_parse_extended_power_table(rdev);
+ if (ret) {
+- ci_dpm_fini(rdev);
++ kfree(rdev->pm.dpm.priv);
+ return ret;
+ }
+
+ ret = ci_parse_power_table(rdev);
+ if (ret) {
+- ci_dpm_fini(rdev);
++ kfree(rdev->pm.dpm.priv);
++ r600_free_extended_power_table(rdev);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 6d2bff9b68b95c578e2e55989890ce7d6e93494f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 10:50:47 -0700
+Subject: rcu: Make rcu_cpu_starting() rely on interrupts being disabled
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit 15d44dfa40305da1648de4bf001e91cc63148725 ]
+
+Currently, rcu_cpu_starting() is written so that it might be invoked
+with interrupts enabled. However, it is always called when interrupts
+are disabled, either by rcu_init(), notify_cpu_starting(), or from a
+call point prior to the call to notify_cpu_starting().
+
+But why bother requiring that interrupts be disabled? The purpose is
+to allow the rcu_data structure's ->beenonline flag to be set after all
+early processing has completed for the incoming CPU, thus allowing this
+flag to be used to determine when workqueues have been set up for the
+incoming CPU, while still allowing this flag to be used as a diagnostic
+within rcu_core().
+
+This commit therefore makes rcu_cpu_starting() rely on interrupts being
+disabled.
+
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Stable-dep-of: 401b0de3ae4f ("rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index d03122f90cc48..5b5ed772f620a 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -4223,15 +4223,16 @@ int rcutree_offline_cpu(unsigned int cpu)
+ * Note that this function is special in that it is invoked directly
+ * from the incoming CPU rather than from the cpuhp_step mechanism.
+ * This is because this function must be invoked at a precise location.
++ * This incoming CPU must not have enabled interrupts yet.
+ */
+ void rcu_cpu_starting(unsigned int cpu)
+ {
+- unsigned long flags;
+ unsigned long mask;
+ struct rcu_data *rdp;
+ struct rcu_node *rnp;
+ bool newcpu;
+
++ lockdep_assert_irqs_disabled();
+ rdp = per_cpu_ptr(&rcu_data, cpu);
+ if (rdp->cpu_started)
+ return;
+@@ -4239,7 +4240,6 @@ void rcu_cpu_starting(unsigned int cpu)
+
+ rnp = rdp->mynode;
+ mask = rdp->grpmask;
+- local_irq_save(flags);
+ arch_spin_lock(&rcu_state.ofl_lock);
+ rcu_dynticks_eqs_online();
+ raw_spin_lock(&rcu_state.barrier_lock);
+@@ -4258,17 +4258,16 @@ void rcu_cpu_starting(unsigned int cpu)
+ /* An incoming CPU should never be blocking a grace period. */
+ if (WARN_ON_ONCE(rnp->qsmask & mask)) { /* RCU waiting on incoming CPU? */
+ /* rcu_report_qs_rnp() *really* wants some flags to restore */
+- unsigned long flags2;
++ unsigned long flags;
+
+- local_irq_save(flags2);
++ local_irq_save(flags);
+ rcu_disable_urgency_upon_qs(rdp);
+ /* Report QS -after- changing ->qsmaskinitnext! */
+- rcu_report_qs_rnp(mask, rnp, rnp->gp_seq, flags2);
++ rcu_report_qs_rnp(mask, rnp, rnp->gp_seq, flags);
+ } else {
+ raw_spin_unlock_rcu_node(rnp);
+ }
+ arch_spin_unlock(&rcu_state.ofl_lock);
+- local_irq_restore(flags);
+ smp_mb(); /* Ensure RCU read-side usage follows above initialization. */
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 86608f260167ef1c6c90539a84c1e32ba28e8a22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 19:42:40 +0800
+Subject: rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup()
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit bf5ddd736509a7d9077c0b6793e6f0852214dbea ]
+
+This code-movement-only commit moves the rcu_scale_cleanup() and
+rcu_scale_shutdown() functions to follow kfree_scale_cleanup().
+This is code movement is in preparation for a bug-fix patch that invokes
+kfree_scale_cleanup() from rcu_scale_cleanup().
+
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Stable-dep-of: 23fc8df26dea ("rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/rcuscale.c | 194 +++++++++++++++++++++---------------------
+ 1 file changed, 97 insertions(+), 97 deletions(-)
+
+diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c
+index de4d4e3844bb1..63e4c2d629a96 100644
+--- a/kernel/rcu/rcuscale.c
++++ b/kernel/rcu/rcuscale.c
+@@ -521,89 +521,6 @@ rcu_scale_print_module_parms(struct rcu_scale_ops *cur_ops, const char *tag)
+ scale_type, tag, nrealreaders, nrealwriters, verbose, shutdown);
+ }
+
+-static void
+-rcu_scale_cleanup(void)
+-{
+- int i;
+- int j;
+- int ngps = 0;
+- u64 *wdp;
+- u64 *wdpp;
+-
+- /*
+- * Would like warning at start, but everything is expedited
+- * during the mid-boot phase, so have to wait till the end.
+- */
+- if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp)
+- SCALEOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!");
+- if (rcu_gp_is_normal() && gp_exp)
+- SCALEOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!");
+- if (gp_exp && gp_async)
+- SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!");
+-
+- if (torture_cleanup_begin())
+- return;
+- if (!cur_ops) {
+- torture_cleanup_end();
+- return;
+- }
+-
+- if (reader_tasks) {
+- for (i = 0; i < nrealreaders; i++)
+- torture_stop_kthread(rcu_scale_reader,
+- reader_tasks[i]);
+- kfree(reader_tasks);
+- }
+-
+- if (writer_tasks) {
+- for (i = 0; i < nrealwriters; i++) {
+- torture_stop_kthread(rcu_scale_writer,
+- writer_tasks[i]);
+- if (!writer_n_durations)
+- continue;
+- j = writer_n_durations[i];
+- pr_alert("%s%s writer %d gps: %d\n",
+- scale_type, SCALE_FLAG, i, j);
+- ngps += j;
+- }
+- pr_alert("%s%s start: %llu end: %llu duration: %llu gps: %d batches: %ld\n",
+- scale_type, SCALE_FLAG,
+- t_rcu_scale_writer_started, t_rcu_scale_writer_finished,
+- t_rcu_scale_writer_finished -
+- t_rcu_scale_writer_started,
+- ngps,
+- rcuscale_seq_diff(b_rcu_gp_test_finished,
+- b_rcu_gp_test_started));
+- for (i = 0; i < nrealwriters; i++) {
+- if (!writer_durations)
+- break;
+- if (!writer_n_durations)
+- continue;
+- wdpp = writer_durations[i];
+- if (!wdpp)
+- continue;
+- for (j = 0; j < writer_n_durations[i]; j++) {
+- wdp = &wdpp[j];
+- pr_alert("%s%s %4d writer-duration: %5d %llu\n",
+- scale_type, SCALE_FLAG,
+- i, j, *wdp);
+- if (j % 100 == 0)
+- schedule_timeout_uninterruptible(1);
+- }
+- kfree(writer_durations[i]);
+- }
+- kfree(writer_tasks);
+- kfree(writer_durations);
+- kfree(writer_n_durations);
+- }
+-
+- /* Do torture-type-specific cleanup operations. */
+- if (cur_ops->cleanup != NULL)
+- cur_ops->cleanup();
+-
+- torture_cleanup_end();
+-}
+-
+ /*
+ * Return the number if non-negative. If -1, the number of CPUs.
+ * If less than -1, that much less than the number of CPUs, but
+@@ -623,20 +540,6 @@ static int compute_real(int n)
+ return nr;
+ }
+
+-/*
+- * RCU scalability shutdown kthread. Just waits to be awakened, then shuts
+- * down system.
+- */
+-static int
+-rcu_scale_shutdown(void *arg)
+-{
+- wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters);
+- smp_mb(); /* Wake before output. */
+- rcu_scale_cleanup();
+- kernel_power_off();
+- return -EINVAL;
+-}
+-
+ /*
+ * kfree_rcu() scalability tests: Start a kfree_rcu() loop on all CPUs for number
+ * of iterations and measure total time and number of GP for all iterations to complete.
+@@ -811,6 +714,103 @@ kfree_scale_init(void)
+ return firsterr;
+ }
+
++static void
++rcu_scale_cleanup(void)
++{
++ int i;
++ int j;
++ int ngps = 0;
++ u64 *wdp;
++ u64 *wdpp;
++
++ /*
++ * Would like warning at start, but everything is expedited
++ * during the mid-boot phase, so have to wait till the end.
++ */
++ if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp)
++ SCALEOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!");
++ if (rcu_gp_is_normal() && gp_exp)
++ SCALEOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!");
++ if (gp_exp && gp_async)
++ SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!");
++
++ if (torture_cleanup_begin())
++ return;
++ if (!cur_ops) {
++ torture_cleanup_end();
++ return;
++ }
++
++ if (reader_tasks) {
++ for (i = 0; i < nrealreaders; i++)
++ torture_stop_kthread(rcu_scale_reader,
++ reader_tasks[i]);
++ kfree(reader_tasks);
++ }
++
++ if (writer_tasks) {
++ for (i = 0; i < nrealwriters; i++) {
++ torture_stop_kthread(rcu_scale_writer,
++ writer_tasks[i]);
++ if (!writer_n_durations)
++ continue;
++ j = writer_n_durations[i];
++ pr_alert("%s%s writer %d gps: %d\n",
++ scale_type, SCALE_FLAG, i, j);
++ ngps += j;
++ }
++ pr_alert("%s%s start: %llu end: %llu duration: %llu gps: %d batches: %ld\n",
++ scale_type, SCALE_FLAG,
++ t_rcu_scale_writer_started, t_rcu_scale_writer_finished,
++ t_rcu_scale_writer_finished -
++ t_rcu_scale_writer_started,
++ ngps,
++ rcuscale_seq_diff(b_rcu_gp_test_finished,
++ b_rcu_gp_test_started));
++ for (i = 0; i < nrealwriters; i++) {
++ if (!writer_durations)
++ break;
++ if (!writer_n_durations)
++ continue;
++ wdpp = writer_durations[i];
++ if (!wdpp)
++ continue;
++ for (j = 0; j < writer_n_durations[i]; j++) {
++ wdp = &wdpp[j];
++ pr_alert("%s%s %4d writer-duration: %5d %llu\n",
++ scale_type, SCALE_FLAG,
++ i, j, *wdp);
++ if (j % 100 == 0)
++ schedule_timeout_uninterruptible(1);
++ }
++ kfree(writer_durations[i]);
++ }
++ kfree(writer_tasks);
++ kfree(writer_durations);
++ kfree(writer_n_durations);
++ }
++
++ /* Do torture-type-specific cleanup operations. */
++ if (cur_ops->cleanup != NULL)
++ cur_ops->cleanup();
++
++ torture_cleanup_end();
++}
++
++/*
++ * RCU scalability shutdown kthread. Just waits to be awakened, then shuts
++ * down system.
++ */
++static int
++rcu_scale_shutdown(void *arg)
++{
++ wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters);
++ smp_mb(); /* Wake before output. */
++ rcu_scale_cleanup();
++ kernel_power_off();
++ return -EINVAL;
++}
++
+ static int __init
+ rcu_scale_init(void)
+ {
+--
+2.39.2
+
--- /dev/null
+From 5bdf06cfc3c51c6e22a23d95bc66bd236d3d7d9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 19:42:41 +0800
+Subject: rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading
+ rcuscale
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 23fc8df26dead16687ae6eb47b0561a4a832e2f6 ]
+
+Running the 'kfree_rcu_test' test case [1] results in a splat [2].
+The root cause is the kfree_scale_thread thread(s) continue running
+after unloading the rcuscale module. This commit fixes that isue by
+invoking kfree_scale_cleanup() from rcu_scale_cleanup() when removing
+the rcuscale module.
+
+[1] modprobe rcuscale kfree_rcu_test=1
+ // After some time
+ rmmod rcuscale
+ rmmod torture
+
+[2] BUG: unable to handle page fault for address: ffffffffc0601a87
+ #PF: supervisor instruction fetch in kernel mode
+ #PF: error_code(0x0010) - not-present page
+ PGD 11de4f067 P4D 11de4f067 PUD 11de51067 PMD 112f4d067 PTE 0
+ Oops: 0010 [#1] PREEMPT SMP NOPTI
+ CPU: 1 PID: 1798 Comm: kfree_scale_thr Not tainted 6.3.0-rc1-rcu+ #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
+ RIP: 0010:0xffffffffc0601a87
+ Code: Unable to access opcode bytes at 0xffffffffc0601a5d.
+ RSP: 0018:ffffb25bc2e57e18 EFLAGS: 00010297
+ RAX: 0000000000000000 RBX: ffffffffc061f0b6 RCX: 0000000000000000
+ RDX: 0000000000000000 RSI: ffffffff962fd0de RDI: ffffffff962fd0de
+ RBP: ffffb25bc2e57ea8 R08: 0000000000000000 R09: 0000000000000000
+ R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
+ R13: 0000000000000000 R14: 000000000000000a R15: 00000000001c1dbe
+ FS: 0000000000000000(0000) GS:ffff921fa2200000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: ffffffffc0601a5d CR3: 000000011de4c006 CR4: 0000000000370ee0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ <TASK>
+ ? kvfree_call_rcu+0xf0/0x3a0
+ ? kthread+0xf3/0x120
+ ? kthread_complete_and_exit+0x20/0x20
+ ? ret_from_fork+0x1f/0x30
+ </TASK>
+ Modules linked in: rfkill sunrpc ... [last unloaded: torture]
+ CR2: ffffffffc0601a87
+ ---[ end trace 0000000000000000 ]---
+
+Fixes: e6e78b004fa7 ("rcuperf: Add kfree_rcu() performance Tests")
+Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/rcuscale.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c
+index 63e4c2d629a96..7854dc3226e1b 100644
+--- a/kernel/rcu/rcuscale.c
++++ b/kernel/rcu/rcuscale.c
+@@ -734,6 +734,11 @@ rcu_scale_cleanup(void)
+ if (gp_exp && gp_async)
+ SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!");
+
++ if (kfree_rcu_test) {
++ kfree_scale_cleanup();
++ return;
++ }
++
+ if (torture_cleanup_begin())
+ return;
+ if (!cur_ops) {
+--
+2.39.2
+
--- /dev/null
+From 46700745f5e101bf32a78c15fb6fd24f34f58de1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 11:11:29 -0700
+Subject: rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit 401b0de3ae4fa49d1014c8941e26d9a25f37e7cf ]
+
+The rcu_tasks_invoke_cbs() function relies on queue_work_on() to silently
+fall back to WORK_CPU_UNBOUND when the specified CPU is offline. However,
+the queue_work_on() function's silent fallback mechanism relies on that
+CPU having been online at some time in the past. When queue_work_on()
+is passed a CPU that has never been online, workqueue lockups ensue,
+which can be bad for your kernel's general health and well-being.
+
+This commit therefore checks whether a given CPU has ever been online,
+and, if not substitutes WORK_CPU_UNBOUND in the subsequent call to
+queue_work_on(). Why not simply omit the queue_work_on() call entirely?
+Because this function is flooding callback-invocation notifications
+to all CPUs, and must deal with possibilities that include a sparse
+cpu_possible_mask.
+
+This commit also moves the setting of the rcu_data structure's
+->beenonline field to rcu_cpu_starting(), which executes on the
+incoming CPU before that CPU has ever enabled interrupts. This ensures
+that the required workqueues are present. In addition, because the
+incoming CPU has not yet enabled its interrupts, there cannot yet have
+been any softirq handlers running on this CPU, which means that the
+WARN_ON_ONCE(!rdp->beenonline) within the RCU_SOFTIRQ handler cannot
+have triggered yet.
+
+Fixes: d363f833c6d88 ("rcu-tasks: Use workqueues for multiple rcu_tasks_invoke_cbs() invocations")
+Reported-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/rcu.h | 6 ++++++
+ kernel/rcu/tasks.h | 7 +++++--
+ kernel/rcu/tree.c | 12 +++++++++++-
+ 3 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h
+index be5979da07f59..48d8f754b730e 100644
+--- a/kernel/rcu/rcu.h
++++ b/kernel/rcu/rcu.h
+@@ -583,4 +583,10 @@ void show_rcu_tasks_trace_gp_kthread(void);
+ static inline void show_rcu_tasks_trace_gp_kthread(void) {}
+ #endif
+
++#ifdef CONFIG_TINY_RCU
++static inline bool rcu_cpu_beenfullyonline(int cpu) { return true; }
++#else
++bool rcu_cpu_beenfullyonline(int cpu);
++#endif
++
+ #endif /* __LINUX_RCU_H */
+diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
+index c8409601fec38..df968321feada 100644
+--- a/kernel/rcu/tasks.h
++++ b/kernel/rcu/tasks.h
+@@ -455,6 +455,7 @@ static void rcu_tasks_invoke_cbs(struct rcu_tasks *rtp, struct rcu_tasks_percpu
+ {
+ int cpu;
+ int cpunext;
++ int cpuwq;
+ unsigned long flags;
+ int len;
+ struct rcu_head *rhp;
+@@ -465,11 +466,13 @@ static void rcu_tasks_invoke_cbs(struct rcu_tasks *rtp, struct rcu_tasks_percpu
+ cpunext = cpu * 2 + 1;
+ if (cpunext < smp_load_acquire(&rtp->percpu_dequeue_lim)) {
+ rtpcp_next = per_cpu_ptr(rtp->rtpcpu, cpunext);
+- queue_work_on(cpunext, system_wq, &rtpcp_next->rtp_work);
++ cpuwq = rcu_cpu_beenfullyonline(cpunext) ? cpunext : WORK_CPU_UNBOUND;
++ queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work);
+ cpunext++;
+ if (cpunext < smp_load_acquire(&rtp->percpu_dequeue_lim)) {
+ rtpcp_next = per_cpu_ptr(rtp->rtpcpu, cpunext);
+- queue_work_on(cpunext, system_wq, &rtpcp_next->rtp_work);
++ cpuwq = rcu_cpu_beenfullyonline(cpunext) ? cpunext : WORK_CPU_UNBOUND;
++ queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work);
+ }
+ }
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 5b5ed772f620a..917a1e43f7839 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -4138,7 +4138,6 @@ int rcutree_prepare_cpu(unsigned int cpu)
+ */
+ rnp = rdp->mynode;
+ raw_spin_lock_rcu_node(rnp); /* irqs already disabled. */
+- rdp->beenonline = true; /* We have now been online. */
+ rdp->gp_seq = READ_ONCE(rnp->gp_seq);
+ rdp->gp_seq_needed = rdp->gp_seq;
+ rdp->cpu_no_qs.b.norm = true;
+@@ -4165,6 +4164,16 @@ static void rcutree_affinity_setting(unsigned int cpu, int outgoing)
+ rcu_boost_kthread_setaffinity(rdp->mynode, outgoing);
+ }
+
++/*
++ * Has the specified (known valid) CPU ever been fully online?
++ */
++bool rcu_cpu_beenfullyonline(int cpu)
++{
++ struct rcu_data *rdp = per_cpu_ptr(&rcu_data, cpu);
++
++ return smp_load_acquire(&rdp->beenonline);
++}
++
+ /*
+ * Near the end of the CPU-online process. Pretty much all services
+ * enabled, and the CPU is now very much alive.
+@@ -4268,6 +4277,7 @@ void rcu_cpu_starting(unsigned int cpu)
+ raw_spin_unlock_rcu_node(rnp);
+ }
+ arch_spin_unlock(&rcu_state.ofl_lock);
++ smp_store_release(&rdp->beenonline, true);
+ smp_mb(); /* Ensure RCU read-side usage follows above initialization. */
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 5551a94de29c0b8e519a25a1211df41e57e05291 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 12:08:54 -0800
+Subject: rcuscale: Move shutdown from wait_event() to wait_event_idle()
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit ef1ef3d47677dc191b88650a9f7f91413452cc1b ]
+
+The rcu_scale_shutdown() and kfree_scale_shutdown() kthreads/functions
+use wait_event() to wait for the rcuscale test to complete. However,
+each updater thread in such a test waits for at least 100 grace periods.
+If each grace period takes more than 1.2 seconds, which is long, but
+not insanely so, this can trigger the hung-task timeout.
+
+This commit therefore replaces those wait_event() calls with calls to
+wait_event_idle(), which do not trigger the hung-task timeout.
+
+Reported-by: kernel test robot <yujie.liu@intel.com>
+Reported-by: Liam Howlett <liam.howlett@oracle.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Tested-by: Yujie Liu <yujie.liu@intel.com>
+Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
+Stable-dep-of: 23fc8df26dea ("rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/rcuscale.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c
+index 3ef02d4a81085..de4d4e3844bb1 100644
+--- a/kernel/rcu/rcuscale.c
++++ b/kernel/rcu/rcuscale.c
+@@ -630,8 +630,7 @@ static int compute_real(int n)
+ static int
+ rcu_scale_shutdown(void *arg)
+ {
+- wait_event(shutdown_wq,
+- atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters);
++ wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters);
+ smp_mb(); /* Wake before output. */
+ rcu_scale_cleanup();
+ kernel_power_off();
+@@ -757,8 +756,8 @@ kfree_scale_cleanup(void)
+ static int
+ kfree_scale_shutdown(void *arg)
+ {
+- wait_event(shutdown_wq,
+- atomic_read(&n_kfree_scale_thread_ended) >= kfree_nrealthreads);
++ wait_event_idle(shutdown_wq,
++ atomic_read(&n_kfree_scale_thread_ended) >= kfree_nrealthreads);
+
+ smp_mb(); /* Wake before output. */
+
+--
+2.39.2
+
--- /dev/null
+From 28033ad2d2a56c5faab15380c8d2cb30e8692777 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 16:40:08 -0700
+Subject: rcutorture: Correct name of use_softirq module parameter
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit b409afe0268faeb77267f028ea85f2d93438fced ]
+
+The BUSTED-BOOST and TREE03 scenarios specify a mythical tree.use_softirq
+module parameter, which means a failure to get full test coverage. This
+commit therefore corrects the name to rcutree.use_softirq.
+
+Fixes: e2b949d54392 ("rcutorture: Make TREE03 use real-time tree.use_softirq setting")
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot | 2 +-
+ tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot b/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot
+index f57720c52c0f9..84f6bb98ce993 100644
+--- a/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot
++++ b/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot
+@@ -5,4 +5,4 @@ rcutree.gp_init_delay=3
+ rcutree.gp_cleanup_delay=3
+ rcutree.kthread_prio=2
+ threadirqs
+-tree.use_softirq=0
++rcutree.use_softirq=0
+diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot b/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot
+index 64f864f1f361f..8e50bfd4b710d 100644
+--- a/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot
++++ b/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot
+@@ -4,4 +4,4 @@ rcutree.gp_init_delay=3
+ rcutree.gp_cleanup_delay=3
+ rcutree.kthread_prio=2
+ threadirqs
+-tree.use_softirq=0
++rcutree.use_softirq=0
+--
+2.39.2
+
--- /dev/null
+From 7b217459ebd06a26f4e285468ae69d38b5e5c3c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 04:01:39 -0700
+Subject: RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context
+
+From: Kashyap Desai <kashyap.desai@broadcom.com>
+
+[ Upstream commit 3099bcdc19b701f732f638ee45679858c08559bb ]
+
+bnxt_qplib_service_creq can be called from interrupt or tasklet or
+process context. So the function take irq variant of spin_lock.
+But when wake_up is invoked with the lock held, it is putting the
+calling context to sleep.
+
+[exception RIP: __wake_up_common+190]
+RIP: ffffffffb7539d7e RSP: ffffa73300207ad8 RFLAGS: 00000083
+RAX: 0000000000000001 RBX: ffff91fa295f69b8 RCX: dead000000000200
+RDX: ffffa733344af940 RSI: ffffa73336527940 RDI: ffffa73336527940
+RBP: 000000000000001c R8: 0000000000000002 R9: 00000000000299c0
+R10: 0000017230de82c5 R11: 0000000000000002 R12: ffffa73300207b28
+R13: 0000000000000000 R14: ffffa733341bf928 R15: 0000000000000000
+ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
+
+Call the wakeup after releasing the lock.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Link: https://lore.kernel.org/r/1686308514-11996-3-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+index 3d76fa71641a4..75e0c42f6f424 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+@@ -299,7 +299,8 @@ static int bnxt_qplib_process_func_event(struct bnxt_qplib_rcfw *rcfw,
+ }
+
+ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
+- struct creq_qp_event *qp_event)
++ struct creq_qp_event *qp_event,
++ u32 *num_wait)
+ {
+ struct creq_qp_error_notification *err_event;
+ struct bnxt_qplib_hwq *hwq = &rcfw->cmdq.hwq;
+@@ -308,6 +309,7 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
+ u16 cbit, blocked = 0;
+ struct pci_dev *pdev;
+ unsigned long flags;
++ u32 wait_cmds = 0;
+ __le16 mcookie;
+ u16 cookie;
+ int rc = 0;
+@@ -367,9 +369,10 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
+ crsqe->req_size = 0;
+
+ if (!blocked)
+- wake_up(&rcfw->cmdq.waitq);
++ wait_cmds++;
+ spin_unlock_irqrestore(&hwq->lock, flags);
+ }
++ *num_wait += wait_cmds;
+ return rc;
+ }
+
+@@ -383,6 +386,7 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t)
+ struct creq_base *creqe;
+ u32 sw_cons, raw_cons;
+ unsigned long flags;
++ u32 num_wakeup = 0;
+
+ /* Service the CREQ until budget is over */
+ spin_lock_irqsave(&hwq->lock, flags);
+@@ -401,7 +405,8 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t)
+ switch (type) {
+ case CREQ_BASE_TYPE_QP_EVENT:
+ bnxt_qplib_process_qp_event
+- (rcfw, (struct creq_qp_event *)creqe);
++ (rcfw, (struct creq_qp_event *)creqe,
++ &num_wakeup);
+ creq->stats.creq_qp_event_processed++;
+ break;
+ case CREQ_BASE_TYPE_FUNC_EVENT:
+@@ -429,6 +434,8 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t)
+ rcfw->res->cctx, true);
+ }
+ spin_unlock_irqrestore(&hwq->lock, flags);
++ if (num_wakeup)
++ wake_up_nr(&rcfw->cmdq.waitq, num_wakeup);
+ }
+
+ static irqreturn_t bnxt_qplib_creq_irq(int irq, void *dev_instance)
+--
+2.39.2
+
--- /dev/null
+From d7ce4674a5618e5b176ba16bf6ec32834bc38c89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 23:48:11 -0700
+Subject: RDMA/bnxt_re: Disable/kill tasklet only if it is enabled
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+[ Upstream commit ab112ee7899d6171da5acd77a7ed7ae103f488de ]
+
+When the ulp hook to start the IRQ fails because the rings are not
+available, tasklets are not enabled. In this case when the driver is
+unloaded, driver calls CREQ tasklet_kill. This causes an indefinite hang
+as the tasklet is not enabled.
+
+Driver shouldn't call tasklet_kill if it is not enabled. So using the
+creq->requested and nq->requested flags to identify if both tasklets/irqs
+are registered. Checking this flag while scheduling the tasklet from
+ISR. Also, added a cleanup for disabling tasklet, in case request_irq
+fails during start_irq.
+
+Check for return value for bnxt_qplib_rcfw_start_irq and in case the
+bnxt_qplib_rcfw_start_irq fails, return bnxt_re_start_irq without
+attempting to start NQ IRQs.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Link: https://lore.kernel.org/r/1684478897-12247-2-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/main.c | 12 +++++++++---
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 16 ++++++++++------
+ drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 14 +++++++++-----
+ 3 files changed, 28 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
+index 8c0c80a8d3384..1589b1105f2ec 100644
+--- a/drivers/infiniband/hw/bnxt_re/main.c
++++ b/drivers/infiniband/hw/bnxt_re/main.c
+@@ -333,15 +333,21 @@ static void bnxt_re_start_irq(void *handle, struct bnxt_msix_entry *ent)
+ for (indx = 0; indx < rdev->num_msix; indx++)
+ rdev->msix_entries[indx].vector = ent[indx].vector;
+
+- bnxt_qplib_rcfw_start_irq(rcfw, msix_ent[BNXT_RE_AEQ_IDX].vector,
+- false);
++ rc = bnxt_qplib_rcfw_start_irq(rcfw, msix_ent[BNXT_RE_AEQ_IDX].vector,
++ false);
++ if (rc) {
++ ibdev_warn(&rdev->ibdev, "Failed to reinit CREQ\n");
++ return;
++ }
+ for (indx = BNXT_RE_NQ_IDX ; indx < rdev->num_msix; indx++) {
+ nq = &rdev->nq[indx - 1];
+ rc = bnxt_qplib_nq_start_irq(nq, indx - 1,
+ msix_ent[indx].vector, false);
+- if (rc)
++ if (rc) {
+ ibdev_warn(&rdev->ibdev, "Failed to reinit NQ index %d\n",
+ indx - 1);
++ return;
++ }
+ }
+ }
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index ab2cc1c67f70b..a143bd3580a27 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -405,6 +405,9 @@ static irqreturn_t bnxt_qplib_nq_irq(int irq, void *dev_instance)
+
+ void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill)
+ {
++ if (!nq->requested)
++ return;
++
+ tasklet_disable(&nq->nq_tasklet);
+ /* Mask h/w interrupt */
+ bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, nq->res->cctx, false);
+@@ -412,11 +415,10 @@ void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill)
+ synchronize_irq(nq->msix_vec);
+ if (kill)
+ tasklet_kill(&nq->nq_tasklet);
+- if (nq->requested) {
+- irq_set_affinity_hint(nq->msix_vec, NULL);
+- free_irq(nq->msix_vec, nq);
+- nq->requested = false;
+- }
++
++ irq_set_affinity_hint(nq->msix_vec, NULL);
++ free_irq(nq->msix_vec, nq);
++ nq->requested = false;
+ }
+
+ void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq)
+@@ -455,8 +457,10 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx,
+
+ snprintf(nq->name, sizeof(nq->name), "bnxt_qplib_nq-%d", nq_indx);
+ rc = request_irq(nq->msix_vec, bnxt_qplib_nq_irq, 0, nq->name, nq);
+- if (rc)
++ if (rc) {
++ tasklet_disable(&nq->nq_tasklet);
+ return rc;
++ }
+
+ cpumask_clear(&nq->mask);
+ cpumask_set_cpu(nq_indx, &nq->mask);
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+index 061b2895dd9b5..e28f0eb5b55d4 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+@@ -635,6 +635,10 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill)
+ struct bnxt_qplib_creq_ctx *creq;
+
+ creq = &rcfw->creq;
++
++ if (!creq->requested)
++ return;
++
+ tasklet_disable(&creq->creq_tasklet);
+ /* Mask h/w interrupts */
+ bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, false);
+@@ -643,10 +647,8 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill)
+ if (kill)
+ tasklet_kill(&creq->creq_tasklet);
+
+- if (creq->requested) {
+- free_irq(creq->msix_vec, rcfw);
+- creq->requested = false;
+- }
++ free_irq(creq->msix_vec, rcfw);
++ creq->requested = false;
+ }
+
+ void bnxt_qplib_disable_rcfw_channel(struct bnxt_qplib_rcfw *rcfw)
+@@ -692,8 +694,10 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector,
+ tasklet_enable(&creq->creq_tasklet);
+ rc = request_irq(creq->msix_vec, bnxt_qplib_creq_irq, 0,
+ "bnxt_qplib_creq", rcfw);
+- if (rc)
++ if (rc) {
++ tasklet_disable(&creq->creq_tasklet);
+ return rc;
++ }
+ creq->requested = true;
+
+ bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, true);
+--
+2.39.2
+
--- /dev/null
+From e4c6a98406721c71d6baea8b591c137e5bc2386d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 23:48:15 -0700
+Subject: RDMA/bnxt_re: Fix to remove an unnecessary log
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+[ Upstream commit 43774bc156614346fe5dacabc8e8c229167f2536 ]
+
+During destroy_qp, driver sets the qp handle in the existing CQEs
+belonging to the QP being destroyed to NULL. As a result, a poll_cq after
+destroy_qp can report unnecessary messages. Remove this noise from system
+logs.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Link: https://lore.kernel.org/r/1684478897-12247-6-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index 640d932bec376..74d56900387a1 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -2734,11 +2734,8 @@ static int bnxt_qplib_cq_process_terminal(struct bnxt_qplib_cq *cq,
+
+ qp = (struct bnxt_qplib_qp *)((unsigned long)
+ le64_to_cpu(hwcqe->qp_handle));
+- if (!qp) {
+- dev_err(&cq->hwq.pdev->dev,
+- "FP: CQ Process terminal qp is NULL\n");
++ if (!qp)
+ return -EINVAL;
+- }
+
+ /* Must block new posting of SQ and RQ */
+ qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
+--
+2.39.2
+
--- /dev/null
+From 5b0df6195a029d4c1d396a4fc64ae118654da8d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 23:48:12 -0700
+Subject: RDMA/bnxt_re: Fix to remove unnecessary return labels
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+[ Upstream commit 9b3ee47796f529e5bc31a355d6cb756d68a7079a ]
+
+If there is no cleanup needed then just return directly. This cleans up
+the code and improve readability.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Link: https://lore.kernel.org/r/1684478897-12247-3-git-send-email-selvin.xavier@broadcom.com
+Reviewed-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Reviewed-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index a143bd3580a27..4abe1f59b3689 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -1605,7 +1605,7 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp,
+ il_src = (void *)wqe->sg_list[indx].addr;
+ t_len += len;
+ if (t_len > qp->max_inline_data)
+- goto bad;
++ return -ENOMEM;
+ while (len) {
+ if (pull_dst) {
+ pull_dst = false;
+@@ -1629,8 +1629,6 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp,
+ }
+
+ return t_len;
+-bad:
+- return -ENOMEM;
+ }
+
+ static u32 bnxt_qplib_put_sges(struct bnxt_qplib_hwq *hwq,
+@@ -2060,7 +2058,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
+ hwq_attr.sginfo = &cq->sg_info;
+ rc = bnxt_qplib_alloc_init_hwq(&cq->hwq, &hwq_attr);
+ if (rc)
+- goto exit;
++ return rc;
+
+ RCFW_CMD_PREP(req, CREATE_CQ, cmd_flags);
+
+@@ -2101,7 +2099,6 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
+
+ fail:
+ bnxt_qplib_free_hwq(res, &cq->hwq);
+-exit:
+ return rc;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 1fafe6e5c2eb5ebe453c9ac09ebf79d1b967e799 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 23:48:14 -0700
+Subject: RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+[ Upstream commit b989f90cef0af48aa5679b6a75476371705ec53c ]
+
+The NULL check inside bnxt_re_update_gid() always return false. If
+sgid_tbl->tbl is not allocated, then dev_init would have failed.
+
+Fixes: 5fac5b1b297f ("RDMA/bnxt_re: Add vlan tag for untagged RoCE traffic when PFC is configured")
+Link: https://lore.kernel.org/r/1684478897-12247-5-git-send-email-selvin.xavier@broadcom.com
+Reviewed-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
+Reviewed-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
+Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/main.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
+index 1589b1105f2ec..e58893387bb4d 100644
+--- a/drivers/infiniband/hw/bnxt_re/main.c
++++ b/drivers/infiniband/hw/bnxt_re/main.c
+@@ -1182,12 +1182,6 @@ static int bnxt_re_update_gid(struct bnxt_re_dev *rdev)
+ if (!ib_device_try_get(&rdev->ibdev))
+ return 0;
+
+- if (!sgid_tbl) {
+- ibdev_err(&rdev->ibdev, "QPLIB: SGID table not allocated");
+- rc = -EINVAL;
+- goto out;
+- }
+-
+ for (index = 0; index < sgid_tbl->active; index++) {
+ gid_idx = sgid_tbl->hw_id[index];
+
+@@ -1205,7 +1199,7 @@ static int bnxt_re_update_gid(struct bnxt_re_dev *rdev)
+ rc = bnxt_qplib_update_sgid(sgid_tbl, &gid, gid_idx,
+ rdev->qplib_res.netdev->dev_addr);
+ }
+-out:
++
+ ib_device_put(&rdev->ibdev);
+ return rc;
+ }
+--
+2.39.2
+
--- /dev/null
+From 3fa3391139a60c9c84d1625817e24a3a55d23382 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 23:48:13 -0700
+Subject: RDMA/bnxt_re: Use unique names while registering interrupts
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+[ Upstream commit ff2e4bfd162cf66a112a81509e419805add44d64 ]
+
+bnxt_re currently uses the names "bnxt_qplib_creq" and "bnxt_qplib_nq-0"
+while registering IRQs. There is no way to distinguish the IRQs of
+different device ports when there are multiple IB devices registered.
+This could make the scenarios worse where one want to pin IRQs of a device
+port to certain CPUs.
+
+Fixed the code to use unique names which has PCI BDF information while
+registering interrupts like: "bnxt_re-nq-0@pci:0000:65:00.0" and
+"bnxt_re-creq@pci:0000:65:00.1".
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Link: https://lore.kernel.org/r/1684478897-12247-4-git-send-email-selvin.xavier@broadcom.com
+Reviewed-by: Bhargava Chenna Marreddy <bhargava.marreddy@broadcom.com>
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 12 ++++++++++--
+ drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +-
+ drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 15 +++++++++++++--
+ drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 1 +
+ 4 files changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index 4abe1f59b3689..640d932bec376 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -418,6 +418,8 @@ void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill)
+
+ irq_set_affinity_hint(nq->msix_vec, NULL);
+ free_irq(nq->msix_vec, nq);
++ kfree(nq->name);
++ nq->name = NULL;
+ nq->requested = false;
+ }
+
+@@ -444,6 +446,7 @@ void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq)
+ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx,
+ int msix_vector, bool need_init)
+ {
++ struct bnxt_qplib_res *res = nq->res;
+ int rc;
+
+ if (nq->requested)
+@@ -455,9 +458,14 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx,
+ else
+ tasklet_enable(&nq->nq_tasklet);
+
+- snprintf(nq->name, sizeof(nq->name), "bnxt_qplib_nq-%d", nq_indx);
++ nq->name = kasprintf(GFP_KERNEL, "bnxt_re-nq-%d@pci:%s",
++ nq_indx, pci_name(res->pdev));
++ if (!nq->name)
++ return -ENOMEM;
+ rc = request_irq(nq->msix_vec, bnxt_qplib_nq_irq, 0, nq->name, nq);
+ if (rc) {
++ kfree(nq->name);
++ nq->name = NULL;
+ tasklet_disable(&nq->nq_tasklet);
+ return rc;
+ }
+@@ -471,7 +479,7 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx,
+ nq->msix_vec, nq_indx);
+ }
+ nq->requested = true;
+- bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, nq->res->cctx, true);
++ bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, res->cctx, true);
+
+ return rc;
+ }
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+index 0375019525431..f859710f9a7f4 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+@@ -471,7 +471,7 @@ typedef int (*srqn_handler_t)(struct bnxt_qplib_nq *nq,
+ struct bnxt_qplib_nq {
+ struct pci_dev *pdev;
+ struct bnxt_qplib_res *res;
+- char name[32];
++ char *name;
+ struct bnxt_qplib_hwq hwq;
+ struct bnxt_qplib_nq_db nq_db;
+ u16 ring_id;
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+index e28f0eb5b55d4..9c63b8b62edfc 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+@@ -648,6 +648,8 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill)
+ tasklet_kill(&creq->creq_tasklet);
+
+ free_irq(creq->msix_vec, rcfw);
++ kfree(creq->irq_name);
++ creq->irq_name = NULL;
+ creq->requested = false;
+ }
+
+@@ -680,9 +682,11 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector,
+ bool need_init)
+ {
+ struct bnxt_qplib_creq_ctx *creq;
++ struct bnxt_qplib_res *res;
+ int rc;
+
+ creq = &rcfw->creq;
++ res = rcfw->res;
+
+ if (creq->requested)
+ return -EFAULT;
+@@ -692,15 +696,22 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector,
+ tasklet_setup(&creq->creq_tasklet, bnxt_qplib_service_creq);
+ else
+ tasklet_enable(&creq->creq_tasklet);
++
++ creq->irq_name = kasprintf(GFP_KERNEL, "bnxt_re-creq@pci:%s",
++ pci_name(res->pdev));
++ if (!creq->irq_name)
++ return -ENOMEM;
+ rc = request_irq(creq->msix_vec, bnxt_qplib_creq_irq, 0,
+- "bnxt_qplib_creq", rcfw);
++ creq->irq_name, rcfw);
+ if (rc) {
++ kfree(creq->irq_name);
++ creq->irq_name = NULL;
+ tasklet_disable(&creq->creq_tasklet);
+ return rc;
+ }
+ creq->requested = true;
+
+- bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, true);
++ bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, res->cctx, true);
+
+ return 0;
+ }
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+index 0a3d8e7da3d42..b887e7fbad9ef 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+@@ -174,6 +174,7 @@ struct bnxt_qplib_creq_ctx {
+ u16 ring_id;
+ int msix_vec;
+ bool requested; /*irq handler installed */
++ char *irq_name;
+ };
+
+ /* RCFW Communication Channels */
+--
+2.39.2
+
--- /dev/null
+From 4e3f248dbf01958c7c85d645c740e2abe2a3b84c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 04:01:38 -0700
+Subject: RDMA/bnxt_re: wraparound mbox producer index
+
+From: Kashyap Desai <kashyap.desai@broadcom.com>
+
+[ Upstream commit 0af91306e17ef3d18e5f100aa58aa787869118af ]
+
+Driver is not handling the wraparound of the mbox producer index correctly.
+Currently the wraparound happens once u32 max is reached.
+
+Bit 31 of the producer index register is special and should be set
+only once for the first command. Because the producer index overflow
+setting bit31 after a long time, FW goes to initialization sequence
+and this causes FW hang.
+
+Fix is to wraparound the mbox producer index once it reaches u16 max.
+
+Fixes: cee0c7bba486 ("RDMA/bnxt_re: Refactor command queue management code")
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Link: https://lore.kernel.org/r/1686308514-11996-2-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+index 9c63b8b62edfc..3d76fa71641a4 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+@@ -181,7 +181,7 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req,
+ } while (size > 0);
+ cmdq->seq_num++;
+
+- cmdq_prod = hwq->prod;
++ cmdq_prod = hwq->prod & 0xFFFF;
+ if (test_bit(FIRMWARE_FIRST_FLAG, &cmdq->flags)) {
+ /* The very first doorbell write
+ * is required to set this flag
+@@ -598,7 +598,7 @@ int bnxt_qplib_alloc_rcfw_channel(struct bnxt_qplib_res *res,
+ rcfw->cmdq_depth = BNXT_QPLIB_CMDQE_MAX_CNT_8192;
+
+ sginfo.pgsize = bnxt_qplib_cmdqe_page_size(rcfw->cmdq_depth);
+- hwq_attr.depth = rcfw->cmdq_depth;
++ hwq_attr.depth = rcfw->cmdq_depth & 0x7FFFFFFF;
+ hwq_attr.stride = BNXT_QPLIB_CMDQE_UNITS;
+ hwq_attr.type = HWQ_TYPE_CTX;
+ if (bnxt_qplib_alloc_init_hwq(&cmdq->hwq, &hwq_attr)) {
+--
+2.39.2
+
--- /dev/null
+From c0c2a8a47e0b31f3097b7bc7da0d1fbbe406a6c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 20:16:40 +0800
+Subject: RDMA/hns: Fix hns_roce_table_get return value
+
+From: Chengchang Tang <tangchengchang@huawei.com>
+
+[ Upstream commit cf5b608fb0e369c473a8303cad6ddb386505e5b8 ]
+
+The return value of set_hem has been fixed to ENODEV, which will lead a
+diagnostic information missing.
+
+Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
+Link: https://lore.kernel.org/r/20230523121641.3132102-3-huangjunxian6@hisilicon.com
+Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hem.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index aa8a08d1c0145..f30274986c0da 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -595,11 +595,12 @@ int hns_roce_table_get(struct hns_roce_dev *hr_dev,
+ }
+
+ /* Set HEM base address(128K/page, pa) to Hardware */
+- if (hr_dev->hw->set_hem(hr_dev, table, obj, HEM_HOP_STEP_DIRECT)) {
++ ret = hr_dev->hw->set_hem(hr_dev, table, obj, HEM_HOP_STEP_DIRECT);
++ if (ret) {
+ hns_roce_free_hem(hr_dev, table->hem[i]);
+ table->hem[i] = NULL;
+- ret = -ENODEV;
+- dev_err(dev, "set HEM base address to HW failed.\n");
++ dev_err(dev, "set HEM base address to HW failed, ret = %d.\n",
++ ret);
+ goto out;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 80060e7d2e21930ebfe3e64f9d41474df7abb72d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 13:18:45 +0200
+Subject: RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit b002760f877c0d91ecd3c78565b52f4bbac379dd ]
+
+Commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") triggers a
+warning for fortified memset():
+
+In function 'fortify_memset_chk',
+ inlined from 'irdma_clr_wqes' at drivers/infiniband/hw/irdma/uk.c:103:4:
+include/linux/fortify-string.h:493:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
+ 493 | __write_overflow_field(p_size_field, size);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The problem here isthat the inner array only has four 8-byte elements, so
+clearing 4096 bytes overflows that. As this structure is part of an outer
+array, change the code to pass a pointer to the irdma_qp_quanta instead,
+and change the size argument for readability, matching the comment above
+it.
+
+Fixes: 551c46edc769 ("RDMA/irdma: Add user/kernel shared libraries")
+Link: https://lore.kernel.org/r/20230523111859.2197825-1-arnd@kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/uk.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/irdma/uk.c b/drivers/infiniband/hw/irdma/uk.c
+index 16183e894da77..dd428d915c175 100644
+--- a/drivers/infiniband/hw/irdma/uk.c
++++ b/drivers/infiniband/hw/irdma/uk.c
+@@ -93,16 +93,18 @@ static int irdma_nop_1(struct irdma_qp_uk *qp)
+ */
+ void irdma_clr_wqes(struct irdma_qp_uk *qp, u32 qp_wqe_idx)
+ {
+- __le64 *wqe;
++ struct irdma_qp_quanta *sq;
+ u32 wqe_idx;
+
+ if (!(qp_wqe_idx & 0x7F)) {
+ wqe_idx = (qp_wqe_idx + 128) % qp->sq_ring.size;
+- wqe = qp->sq_base[wqe_idx].elem;
++ sq = qp->sq_base + wqe_idx;
+ if (wqe_idx)
+- memset(wqe, qp->swqe_polarity ? 0 : 0xFF, 0x1000);
++ memset(sq, qp->swqe_polarity ? 0 : 0xFF,
++ 128 * sizeof(*sq));
+ else
+- memset(wqe, qp->swqe_polarity ? 0xFF : 0, 0x1000);
++ memset(sq, qp->swqe_polarity ? 0xFF : 0,
++ 128 * sizeof(*sq));
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 9d9ee0a4913369c785555fbc6b36fb194784f0b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Nov 2022 12:09:59 -0500
+Subject: RDMA/rxe: Add ibdev_dbg macros for rxe
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 4554bac48a8c464ff00136a64efe8847e4da4ea8 ]
+
+Add macros borrowed from siw to call dynamic debug macro ibdev_dbg.
+
+Link: https://lore.kernel.org/r/20221103171013.20659-2-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 425e1c9018fd ("RDMA/rxe: Fix access checks in rxe_check_bind_mw")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.h | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
+index 30fbdf3bc76a3..ab334900fcc3d 100644
+--- a/drivers/infiniband/sw/rxe/rxe.h
++++ b/drivers/infiniband/sw/rxe/rxe.h
+@@ -38,6 +38,25 @@
+
+ #define RXE_ROCE_V2_SPORT (0xc000)
+
++#define rxe_dbg(rxe, fmt, ...) ibdev_dbg(&(rxe)->ib_dev, \
++ "%s: " fmt, __func__, ##__VA_ARGS__)
++#define rxe_dbg_uc(uc, fmt, ...) ibdev_dbg((uc)->ibuc.device, \
++ "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_dbg_pd(pd, fmt, ...) ibdev_dbg((pd)->ibpd.device, \
++ "pd#%d %s: " fmt, (pd)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_dbg_ah(ah, fmt, ...) ibdev_dbg((ah)->ibah.device, \
++ "ah#%d %s: " fmt, (ah)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_dbg_srq(srq, fmt, ...) ibdev_dbg((srq)->ibsrq.device, \
++ "srq#%d %s: " fmt, (srq)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_dbg_qp(qp, fmt, ...) ibdev_dbg((qp)->ibqp.device, \
++ "qp#%d %s: " fmt, (qp)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_dbg_cq(cq, fmt, ...) ibdev_dbg((cq)->ibcq.device, \
++ "cq#%d %s: " fmt, (cq)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_dbg_mr(mr, fmt, ...) ibdev_dbg((mr)->ibmr.device, \
++ "mr#%d %s: " fmt, (mr)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_dbg_mw(mw, fmt, ...) ibdev_dbg((mw)->ibmw.device, \
++ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__)
++
+ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu);
+
+ int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name);
+--
+2.39.2
+
--- /dev/null
+From d3e0f537b749af37a3867562f8d2adb325c58440 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 17:13:32 -0500
+Subject: RDMA/rxe: Fix access checks in rxe_check_bind_mw
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 425e1c9018fdf25cb4531606cc92d9d01a55534f ]
+
+The subroutine rxe_check_bind_mw() in rxe_mw.c performs checks on the mw
+access flags before they are set so they always succeed. This patch
+instead checks the access flags passed in the send wqe.
+
+Fixes: 32a577b4c3a9 ("RDMA/rxe: Add support for bind MW work requests")
+Link: https://lore.kernel.org/r/20230530221334.89432-4-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_mw.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c
+index 70252991320a0..cebc9f0f428d8 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mw.c
++++ b/drivers/infiniband/sw/rxe/rxe_mw.c
+@@ -48,7 +48,7 @@ int rxe_dealloc_mw(struct ib_mw *ibmw)
+ }
+
+ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+- struct rxe_mw *mw, struct rxe_mr *mr)
++ struct rxe_mw *mw, struct rxe_mr *mr, int access)
+ {
+ if (mw->ibmw.type == IB_MW_TYPE_1) {
+ if (unlikely(mw->state != RXE_MW_STATE_VALID)) {
+@@ -58,7 +58,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ }
+
+ /* o10-36.2.2 */
+- if (unlikely((mw->access & IB_ZERO_BASED))) {
++ if (unlikely((access & IB_ZERO_BASED))) {
+ rxe_dbg_mw(mw, "attempt to bind a zero based type 1 MW\n");
+ return -EINVAL;
+ }
+@@ -104,7 +104,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ }
+
+ /* C10-74 */
+- if (unlikely((mw->access &
++ if (unlikely((access &
+ (IB_ACCESS_REMOTE_WRITE | IB_ACCESS_REMOTE_ATOMIC)) &&
+ !(mr->access & IB_ACCESS_LOCAL_WRITE))) {
+ rxe_dbg_mw(mw,
+@@ -113,7 +113,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ }
+
+ /* C10-75 */
+- if (mw->access & IB_ZERO_BASED) {
++ if (access & IB_ZERO_BASED) {
+ if (unlikely(wqe->wr.wr.mw.length > mr->ibmr.length)) {
+ rxe_dbg_mw(mw,
+ "attempt to bind a ZB MW outside of the MR\n");
+@@ -133,12 +133,12 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ }
+
+ static void rxe_do_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+- struct rxe_mw *mw, struct rxe_mr *mr)
++ struct rxe_mw *mw, struct rxe_mr *mr, int access)
+ {
+ u32 key = wqe->wr.wr.mw.rkey & 0xff;
+
+ mw->rkey = (mw->rkey & ~0xff) | key;
+- mw->access = wqe->wr.wr.mw.access;
++ mw->access = access;
+ mw->state = RXE_MW_STATE_VALID;
+ mw->addr = wqe->wr.wr.mw.addr;
+ mw->length = wqe->wr.wr.mw.length;
+@@ -169,6 +169,7 @@ int rxe_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
+ struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
+ u32 mw_rkey = wqe->wr.wr.mw.mw_rkey;
+ u32 mr_lkey = wqe->wr.wr.mw.mr_lkey;
++ int access = wqe->wr.wr.mw.access;
+
+ mw = rxe_pool_get_index(&rxe->mw_pool, mw_rkey >> 8);
+ if (unlikely(!mw)) {
+@@ -198,11 +199,11 @@ int rxe_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
+
+ spin_lock_bh(&mw->lock);
+
+- ret = rxe_check_bind_mw(qp, wqe, mw, mr);
++ ret = rxe_check_bind_mw(qp, wqe, mw, mr, access);
+ if (ret)
+ goto err_unlock;
+
+- rxe_do_bind_mw(qp, wqe, mw, mr);
++ rxe_do_bind_mw(qp, wqe, mw, mr, access);
+ err_unlock:
+ spin_unlock_bh(&mw->lock);
+ err_drop_mr:
+--
+2.39.2
+
--- /dev/null
+From 591de55311744cb9337653dc8053b89bf44386a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Nov 2022 12:10:03 -0500
+Subject: RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_mw.c
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit e8a87efdf87455454d0a14fd486c679769bfeee2 ]
+
+Replace calls to pr_xxx() int rxe_mw.c with rxe_dbg_xxx().
+
+Link: https://lore.kernel.org/r/20221103171013.20659-6-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 425e1c9018fd ("RDMA/rxe: Fix access checks in rxe_check_bind_mw")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_mw.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c
+index 902b7df7aaedb..70252991320a0 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mw.c
++++ b/drivers/infiniband/sw/rxe/rxe_mw.c
+@@ -52,14 +52,14 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ {
+ if (mw->ibmw.type == IB_MW_TYPE_1) {
+ if (unlikely(mw->state != RXE_MW_STATE_VALID)) {
+- pr_err_once(
++ rxe_dbg_mw(mw,
+ "attempt to bind a type 1 MW not in the valid state\n");
+ return -EINVAL;
+ }
+
+ /* o10-36.2.2 */
+ if (unlikely((mw->access & IB_ZERO_BASED))) {
+- pr_err_once("attempt to bind a zero based type 1 MW\n");
++ rxe_dbg_mw(mw, "attempt to bind a zero based type 1 MW\n");
+ return -EINVAL;
+ }
+ }
+@@ -67,21 +67,21 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ if (mw->ibmw.type == IB_MW_TYPE_2) {
+ /* o10-37.2.30 */
+ if (unlikely(mw->state != RXE_MW_STATE_FREE)) {
+- pr_err_once(
++ rxe_dbg_mw(mw,
+ "attempt to bind a type 2 MW not in the free state\n");
+ return -EINVAL;
+ }
+
+ /* C10-72 */
+ if (unlikely(qp->pd != to_rpd(mw->ibmw.pd))) {
+- pr_err_once(
++ rxe_dbg_mw(mw,
+ "attempt to bind type 2 MW with qp with different PD\n");
+ return -EINVAL;
+ }
+
+ /* o10-37.2.40 */
+ if (unlikely(!mr || wqe->wr.wr.mw.length == 0)) {
+- pr_err_once(
++ rxe_dbg_mw(mw,
+ "attempt to invalidate type 2 MW by binding with NULL or zero length MR\n");
+ return -EINVAL;
+ }
+@@ -92,13 +92,13 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ return 0;
+
+ if (unlikely(mr->access & IB_ZERO_BASED)) {
+- pr_err_once("attempt to bind MW to zero based MR\n");
++ rxe_dbg_mw(mw, "attempt to bind MW to zero based MR\n");
+ return -EINVAL;
+ }
+
+ /* C10-73 */
+ if (unlikely(!(mr->access & IB_ACCESS_MW_BIND))) {
+- pr_err_once(
++ rxe_dbg_mw(mw,
+ "attempt to bind an MW to an MR without bind access\n");
+ return -EINVAL;
+ }
+@@ -107,7 +107,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ if (unlikely((mw->access &
+ (IB_ACCESS_REMOTE_WRITE | IB_ACCESS_REMOTE_ATOMIC)) &&
+ !(mr->access & IB_ACCESS_LOCAL_WRITE))) {
+- pr_err_once(
++ rxe_dbg_mw(mw,
+ "attempt to bind an Writable MW to an MR without local write access\n");
+ return -EINVAL;
+ }
+@@ -115,7 +115,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ /* C10-75 */
+ if (mw->access & IB_ZERO_BASED) {
+ if (unlikely(wqe->wr.wr.mw.length > mr->ibmr.length)) {
+- pr_err_once(
++ rxe_dbg_mw(mw,
+ "attempt to bind a ZB MW outside of the MR\n");
+ return -EINVAL;
+ }
+@@ -123,7 +123,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ if (unlikely((wqe->wr.wr.mw.addr < mr->ibmr.iova) ||
+ ((wqe->wr.wr.mw.addr + wqe->wr.wr.mw.length) >
+ (mr->ibmr.iova + mr->ibmr.length)))) {
+- pr_err_once(
++ rxe_dbg_mw(mw,
+ "attempt to bind a VA MW outside of the MR\n");
+ return -EINVAL;
+ }
+--
+2.39.2
+
--- /dev/null
+From 01a4a458f54d6456678f45f6583e66acc21b0bea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 13:13:58 +0200
+Subject: regulator: core: Fix more error checking for debugfs_create_dir()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2715bb11cfff964aa33946847f9527cfbd4874f5 ]
+
+In case of failure, debugfs_create_dir() does not return NULL, but an
+error pointer. Most incorrect error checks were fixed, but the one in
+create_regulator() was forgotten.
+
+Fix the remaining error check.
+
+Fixes: 2bf1c45be3b8f3a3 ("regulator: Fix error checking for debugfs_create_dir")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/ee980a108b5854dd8ce3630f8f673e784e057d17.1685013051.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index e01cade8be0c7..eaf9d99f1f43c 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1918,7 +1918,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+
+ if (err != -EEXIST)
+ regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs);
+- if (!regulator->debugfs) {
++ if (IS_ERR(regulator->debugfs)) {
+ rdev_dbg(rdev, "Failed to create debugfs directory\n");
+ } else {
+ debugfs_create_u32("uA_load", 0444, regulator->debugfs,
+--
+2.39.2
+
--- /dev/null
+From 76719d76b99136d2b2d98095519ac4dd1f9d01e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 13:13:59 +0200
+Subject: regulator: core: Streamline debugfs operations
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 08880713ceec023dd94d634f1e8902728c385939 ]
+
+If CONFIG_DEBUG_FS is not set:
+
+ regulator: Failed to create debugfs directory
+ ...
+ regulator-dummy: Failed to create debugfs directory
+
+As per the comments for debugfs_create_dir(), errors returned by this
+function should be expected, and ignored:
+
+ * If debugfs is not enabled in the kernel, the value -%ENODEV will be
+ * returned.
+ *
+ * NOTE: it's expected that most callers should _ignore_ the errors returned
+ * by this function. Other debugfs functions handle the fact that the "dentry"
+ * passed to them could be an error and they don't crash in that case.
+ * Drivers should generally work fine even if debugfs fails to init anyway.
+
+Adhere to the debugfs spirit, and streamline all operations by:
+ 1. Demoting the importance of the printed error messages to debug
+ level, like is already done in create_regulator(),
+ 2. Further ignoring any returned errors, as by design, all debugfs
+ functions are no-ops when passed an error pointer.
+
+Fixes: 2bf1c45be3b8f3a3 ("regulator: Fix error checking for debugfs_create_dir")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/2f8bb6e113359ddfab7b59e4d4274bd4c06d6d0a.1685013051.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 30 +++++++++++++-----------------
+ 1 file changed, 13 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index eaf9d99f1f43c..351f0fd225b14 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1918,19 +1918,17 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+
+ if (err != -EEXIST)
+ regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs);
+- if (IS_ERR(regulator->debugfs)) {
++ if (IS_ERR(regulator->debugfs))
+ rdev_dbg(rdev, "Failed to create debugfs directory\n");
+- } else {
+- debugfs_create_u32("uA_load", 0444, regulator->debugfs,
+- ®ulator->uA_load);
+- debugfs_create_u32("min_uV", 0444, regulator->debugfs,
+- ®ulator->voltage[PM_SUSPEND_ON].min_uV);
+- debugfs_create_u32("max_uV", 0444, regulator->debugfs,
+- ®ulator->voltage[PM_SUSPEND_ON].max_uV);
+- debugfs_create_file("constraint_flags", 0444,
+- regulator->debugfs, regulator,
+- &constraint_flags_fops);
+- }
++
++ debugfs_create_u32("uA_load", 0444, regulator->debugfs,
++ ®ulator->uA_load);
++ debugfs_create_u32("min_uV", 0444, regulator->debugfs,
++ ®ulator->voltage[PM_SUSPEND_ON].min_uV);
++ debugfs_create_u32("max_uV", 0444, regulator->debugfs,
++ ®ulator->voltage[PM_SUSPEND_ON].max_uV);
++ debugfs_create_file("constraint_flags", 0444, regulator->debugfs,
++ regulator, &constraint_flags_fops);
+
+ /*
+ * Check now if the regulator is an always on regulator - if
+@@ -5257,10 +5255,8 @@ static void rdev_init_debugfs(struct regulator_dev *rdev)
+ }
+
+ rdev->debugfs = debugfs_create_dir(rname, debugfs_root);
+- if (IS_ERR(rdev->debugfs)) {
+- rdev_warn(rdev, "Failed to create debugfs directory\n");
+- return;
+- }
++ if (IS_ERR(rdev->debugfs))
++ rdev_dbg(rdev, "Failed to create debugfs directory\n");
+
+ debugfs_create_u32("use_count", 0444, rdev->debugfs,
+ &rdev->use_count);
+@@ -6180,7 +6176,7 @@ static int __init regulator_init(void)
+
+ debugfs_root = debugfs_create_dir("regulator", NULL);
+ if (IS_ERR(debugfs_root))
+- pr_warn("regulator: Failed to create debugfs directory\n");
++ pr_debug("regulator: Failed to create debugfs directory\n");
+
+ #ifdef CONFIG_DEBUG_FS
+ debugfs_create_file("supply_map", 0444, debugfs_root, NULL,
+--
+2.39.2
+
--- /dev/null
+From 0fa7955c8bc2ab061a72ff6c9b1f6757c3d7fac9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Apr 2023 09:42:26 +0800
+Subject: riscv: uprobes: Restore thread.bad_cause
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 58b1294dd1d65bb62f08dddbf418f954210c2057 ]
+
+thread.bad_cause is saved in arch_uprobe_pre_xol(), it should be restored
+in arch_uprobe_{post,abort}_xol() accordingly, otherwise the save operation
+is meaningless, this change is similar with x86 and powerpc.
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Fixes: 74784081aac8 ("riscv: Add uprobes supported")
+Link: https://lore.kernel.org/r/1682214146-3756-1-git-send-email-yangtiezhu@loongson.cn
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/probes/uprobes.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/riscv/kernel/probes/uprobes.c b/arch/riscv/kernel/probes/uprobes.c
+index c976a21cd4bd5..194f166b2cc40 100644
+--- a/arch/riscv/kernel/probes/uprobes.c
++++ b/arch/riscv/kernel/probes/uprobes.c
+@@ -67,6 +67,7 @@ int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
+ struct uprobe_task *utask = current->utask;
+
+ WARN_ON_ONCE(current->thread.bad_cause != UPROBE_TRAP_NR);
++ current->thread.bad_cause = utask->autask.saved_cause;
+
+ instruction_pointer_set(regs, utask->vaddr + auprobe->insn_size);
+
+@@ -102,6 +103,7 @@ void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
+ {
+ struct uprobe_task *utask = current->utask;
+
++ current->thread.bad_cause = utask->autask.saved_cause;
+ /*
+ * Task has received a fatal signal, so reset back to probbed
+ * address.
+--
+2.39.2
+
--- /dev/null
+From d772fda0519dde16f1237c4b8c715d175c750c8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jun 2023 13:51:08 +0300
+Subject: rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
+
+From: Edwin Peer <edwin.peer@broadcom.com>
+
+[ Upstream commit fa0e21fa44438a0e856d42224bfa24641d37b979 ]
+
+This filter already exists for excluding IPv6 SNMP stats. Extend its
+definition to also exclude IFLA_VF_INFO stats in RTM_GETLINK.
+
+This patch constitutes a partial fix for a netlink attribute nesting
+overflow bug in IFLA_VFINFO_LIST. By excluding the stats when the
+requester doesn't need them, the truncation of the VF list is avoided.
+
+While it was technically only the stats added in commit c5a9f6f0ab40
+("net/core: Add drop counters to VF statistics") breaking the camel's
+back, the appreciable size of the stats data should never have been
+included without due consideration for the maximum number of VFs
+supported by PCI.
+
+Fixes: 3b766cd83232 ("net/core: Add reading VF statistics through the PF netdevice")
+Fixes: c5a9f6f0ab40 ("net/core: Add drop counters to VF statistics")
+Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
+Cc: Edwin Peer <espeer@gmail.com>
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Link: https://lore.kernel.org/r/20230611105108.122586-1-gal@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/rtnetlink.c | 96 +++++++++++++++++++++++---------------------
+ 1 file changed, 51 insertions(+), 45 deletions(-)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index b192c69f3936c..ef2a07ae5496e 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -957,24 +957,27 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev,
+ nla_total_size(sizeof(struct ifla_vf_rate)) +
+ nla_total_size(sizeof(struct ifla_vf_link_state)) +
+ nla_total_size(sizeof(struct ifla_vf_rss_query_en)) +
+- nla_total_size(0) + /* nest IFLA_VF_STATS */
+- /* IFLA_VF_STATS_RX_PACKETS */
+- nla_total_size_64bit(sizeof(__u64)) +
+- /* IFLA_VF_STATS_TX_PACKETS */
+- nla_total_size_64bit(sizeof(__u64)) +
+- /* IFLA_VF_STATS_RX_BYTES */
+- nla_total_size_64bit(sizeof(__u64)) +
+- /* IFLA_VF_STATS_TX_BYTES */
+- nla_total_size_64bit(sizeof(__u64)) +
+- /* IFLA_VF_STATS_BROADCAST */
+- nla_total_size_64bit(sizeof(__u64)) +
+- /* IFLA_VF_STATS_MULTICAST */
+- nla_total_size_64bit(sizeof(__u64)) +
+- /* IFLA_VF_STATS_RX_DROPPED */
+- nla_total_size_64bit(sizeof(__u64)) +
+- /* IFLA_VF_STATS_TX_DROPPED */
+- nla_total_size_64bit(sizeof(__u64)) +
+ nla_total_size(sizeof(struct ifla_vf_trust)));
++ if (~ext_filter_mask & RTEXT_FILTER_SKIP_STATS) {
++ size += num_vfs *
++ (nla_total_size(0) + /* nest IFLA_VF_STATS */
++ /* IFLA_VF_STATS_RX_PACKETS */
++ nla_total_size_64bit(sizeof(__u64)) +
++ /* IFLA_VF_STATS_TX_PACKETS */
++ nla_total_size_64bit(sizeof(__u64)) +
++ /* IFLA_VF_STATS_RX_BYTES */
++ nla_total_size_64bit(sizeof(__u64)) +
++ /* IFLA_VF_STATS_TX_BYTES */
++ nla_total_size_64bit(sizeof(__u64)) +
++ /* IFLA_VF_STATS_BROADCAST */
++ nla_total_size_64bit(sizeof(__u64)) +
++ /* IFLA_VF_STATS_MULTICAST */
++ nla_total_size_64bit(sizeof(__u64)) +
++ /* IFLA_VF_STATS_RX_DROPPED */
++ nla_total_size_64bit(sizeof(__u64)) +
++ /* IFLA_VF_STATS_TX_DROPPED */
++ nla_total_size_64bit(sizeof(__u64)));
++ }
+ return size;
+ } else
+ return 0;
+@@ -1253,7 +1256,8 @@ static noinline_for_stack int rtnl_fill_stats(struct sk_buff *skb,
+ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
+ struct net_device *dev,
+ int vfs_num,
+- struct nlattr *vfinfo)
++ struct nlattr *vfinfo,
++ u32 ext_filter_mask)
+ {
+ struct ifla_vf_rss_query_en vf_rss_query_en;
+ struct nlattr *vf, *vfstats, *vfvlanlist;
+@@ -1359,33 +1363,35 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
+ goto nla_put_vf_failure;
+ }
+ nla_nest_end(skb, vfvlanlist);
+- memset(&vf_stats, 0, sizeof(vf_stats));
+- if (dev->netdev_ops->ndo_get_vf_stats)
+- dev->netdev_ops->ndo_get_vf_stats(dev, vfs_num,
+- &vf_stats);
+- vfstats = nla_nest_start_noflag(skb, IFLA_VF_STATS);
+- if (!vfstats)
+- goto nla_put_vf_failure;
+- if (nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_PACKETS,
+- vf_stats.rx_packets, IFLA_VF_STATS_PAD) ||
+- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_PACKETS,
+- vf_stats.tx_packets, IFLA_VF_STATS_PAD) ||
+- nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_BYTES,
+- vf_stats.rx_bytes, IFLA_VF_STATS_PAD) ||
+- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_BYTES,
+- vf_stats.tx_bytes, IFLA_VF_STATS_PAD) ||
+- nla_put_u64_64bit(skb, IFLA_VF_STATS_BROADCAST,
+- vf_stats.broadcast, IFLA_VF_STATS_PAD) ||
+- nla_put_u64_64bit(skb, IFLA_VF_STATS_MULTICAST,
+- vf_stats.multicast, IFLA_VF_STATS_PAD) ||
+- nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_DROPPED,
+- vf_stats.rx_dropped, IFLA_VF_STATS_PAD) ||
+- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_DROPPED,
+- vf_stats.tx_dropped, IFLA_VF_STATS_PAD)) {
+- nla_nest_cancel(skb, vfstats);
+- goto nla_put_vf_failure;
++ if (~ext_filter_mask & RTEXT_FILTER_SKIP_STATS) {
++ memset(&vf_stats, 0, sizeof(vf_stats));
++ if (dev->netdev_ops->ndo_get_vf_stats)
++ dev->netdev_ops->ndo_get_vf_stats(dev, vfs_num,
++ &vf_stats);
++ vfstats = nla_nest_start_noflag(skb, IFLA_VF_STATS);
++ if (!vfstats)
++ goto nla_put_vf_failure;
++ if (nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_PACKETS,
++ vf_stats.rx_packets, IFLA_VF_STATS_PAD) ||
++ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_PACKETS,
++ vf_stats.tx_packets, IFLA_VF_STATS_PAD) ||
++ nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_BYTES,
++ vf_stats.rx_bytes, IFLA_VF_STATS_PAD) ||
++ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_BYTES,
++ vf_stats.tx_bytes, IFLA_VF_STATS_PAD) ||
++ nla_put_u64_64bit(skb, IFLA_VF_STATS_BROADCAST,
++ vf_stats.broadcast, IFLA_VF_STATS_PAD) ||
++ nla_put_u64_64bit(skb, IFLA_VF_STATS_MULTICAST,
++ vf_stats.multicast, IFLA_VF_STATS_PAD) ||
++ nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_DROPPED,
++ vf_stats.rx_dropped, IFLA_VF_STATS_PAD) ||
++ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_DROPPED,
++ vf_stats.tx_dropped, IFLA_VF_STATS_PAD)) {
++ nla_nest_cancel(skb, vfstats);
++ goto nla_put_vf_failure;
++ }
++ nla_nest_end(skb, vfstats);
+ }
+- nla_nest_end(skb, vfstats);
+ nla_nest_end(skb, vf);
+ return 0;
+
+@@ -1418,7 +1424,7 @@ static noinline_for_stack int rtnl_fill_vf(struct sk_buff *skb,
+ return -EMSGSIZE;
+
+ for (i = 0; i < num_vfs; i++) {
+- if (rtnl_fill_vfinfo(skb, dev, i, vfinfo))
++ if (rtnl_fill_vfinfo(skb, dev, i, vfinfo, ext_filter_mask))
+ return -EMSGSIZE;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 57c7cc673825a53e62e62f1c5547cb6bf83cf3e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 16:50:58 +0800
+Subject: samples/bpf: Fix buffer overflow in tcp_basertt
+
+From: Pengcheng Yang <yangpc@wangsu.com>
+
+[ Upstream commit f4dea9689c5fea3d07170c2cb0703e216f1a0922 ]
+
+Using sizeof(nv) or strlen(nv)+1 is correct.
+
+Fixes: c890063e4404 ("bpf: sample BPF_SOCKET_OPS_BASE_RTT program")
+Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
+Link: https://lore.kernel.org/r/1683276658-2860-1-git-send-email-yangpc@wangsu.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/tcp_basertt_kern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/samples/bpf/tcp_basertt_kern.c b/samples/bpf/tcp_basertt_kern.c
+index 8dfe09a92feca..822b0742b8154 100644
+--- a/samples/bpf/tcp_basertt_kern.c
++++ b/samples/bpf/tcp_basertt_kern.c
+@@ -47,7 +47,7 @@ int bpf_basertt(struct bpf_sock_ops *skops)
+ case BPF_SOCK_OPS_BASE_RTT:
+ n = bpf_getsockopt(skops, SOL_TCP, TCP_CONGESTION,
+ cong, sizeof(cong));
+- if (!n && !__builtin_memcmp(cong, nv, sizeof(nv)+1)) {
++ if (!n && !__builtin_memcmp(cong, nv, sizeof(nv))) {
+ /* Set base_rtt to 80us */
+ rv = 80;
+ } else if (n) {
+--
+2.39.2
+
--- /dev/null
+From 2af2b621781b0e4d5b91a3ee49ce27319d65e0e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 16:30:41 +0200
+Subject: samples/bpf: xdp1 and xdp2 reduce XDPBUFSIZE to 60
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 60548b825b082cedf89b275c21c28b1e1d030e50 ]
+
+Default samples/pktgen scripts send 60 byte packets as hardware adds
+4-bytes FCS checksum, which fulfils minimum Ethernet 64 bytes frame
+size.
+
+XDP layer will not necessary have access to the 4-bytes FCS checksum.
+
+This leads to bpf_xdp_load_bytes() failing as it tries to copy 64-bytes
+from an XDP packet that only have 60-bytes available.
+
+Fixes: 772251742262 ("samples/bpf: fixup some tools to be able to support xdp multibuffer")
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://lore.kernel.org/bpf/168545704139.2996228.2516528552939485216.stgit@firesoul
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/xdp1_kern.c | 2 +-
+ samples/bpf/xdp2_kern.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/samples/bpf/xdp1_kern.c b/samples/bpf/xdp1_kern.c
+index 0a5c704badd00..d91f27cbcfa99 100644
+--- a/samples/bpf/xdp1_kern.c
++++ b/samples/bpf/xdp1_kern.c
+@@ -39,7 +39,7 @@ static int parse_ipv6(void *data, u64 nh_off, void *data_end)
+ return ip6h->nexthdr;
+ }
+
+-#define XDPBUFSIZE 64
++#define XDPBUFSIZE 60
+ SEC("xdp.frags")
+ int xdp_prog1(struct xdp_md *ctx)
+ {
+diff --git a/samples/bpf/xdp2_kern.c b/samples/bpf/xdp2_kern.c
+index 67804ecf7ce37..8bca674451ed1 100644
+--- a/samples/bpf/xdp2_kern.c
++++ b/samples/bpf/xdp2_kern.c
+@@ -55,7 +55,7 @@ static int parse_ipv6(void *data, u64 nh_off, void *data_end)
+ return ip6h->nexthdr;
+ }
+
+-#define XDPBUFSIZE 64
++#define XDPBUFSIZE 60
+ SEC("xdp.frags")
+ int xdp_prog1(struct xdp_md *ctx)
+ {
+--
+2.39.2
+
--- /dev/null
+From 8e0f66ac778049f4d627ab9f4b691c0bc124b8fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 22:12:55 +0800
+Subject: scsi: 3w-xxxx: Add error handling for initialization failure in
+ tw_probe()
+
+From: Yuchen Yang <u202114568@hust.edu.cn>
+
+[ Upstream commit 2e2fe5ac695a00ab03cab4db1f4d6be07168ed9d ]
+
+Smatch complains that:
+
+tw_probe() warn: missing error code 'retval'
+
+This patch adds error checking to tw_probe() to handle initialization
+failure. If tw_reset_sequence() function returns a non-zero value, the
+function will return -EINVAL to indicate initialization failure.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yuchen Yang <u202114568@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230505141259.7730-1-u202114568@hust.edu.cn
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/3w-xxxx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
+index ffdecb12d654c..9bd70e4618d52 100644
+--- a/drivers/scsi/3w-xxxx.c
++++ b/drivers/scsi/3w-xxxx.c
+@@ -2305,8 +2305,10 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
+ TW_DISABLE_INTERRUPTS(tw_dev);
+
+ /* Initialize the card */
+- if (tw_reset_sequence(tw_dev))
++ if (tw_reset_sequence(tw_dev)) {
++ retval = -EINVAL;
+ goto out_release_mem_region;
++ }
+
+ /* Set host specific parameters */
+ host->max_id = TW_MAX_UNITS;
+--
+2.39.2
+
--- /dev/null
+From e35000e2234a1bbbf63bab181ac7d32fd658b78b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 11:32:01 -0700
+Subject: scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based
+ on nlp_state
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 9914a3d033d3e1d836a43e93e9738e7dd44a096a ]
+
+When NPIV ports are zoned to devices that support both initiator and target
+mode, a remote device's initiated PRLI results in unintended final kref
+clean up of the device's ndlp structure. This disrupts NPIV ports'
+discovery for target devices that support both initiator and target mode.
+
+Modify the NPIV lpfc_drop_node clause such that we allow the ndlp to live
+so long as it was in NLP_STE_PLOGI_ISSUE, NLP_STE_REG_LOGIN_ISSUE, or
+NLP_STE_PRLI_ISSUE nlp_state. This allows lpfc's issued PRLI completion
+routine to determine if the final kref clean up should execute rather than
+a remote device's issued PRLI.
+
+Fixes: db651ec22524 ("scsi: lpfc: Correct used_rpi count when devloss tmo fires with no recovery")
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://lore.kernel.org/r/20230523183206.7728-5-justintee8345@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index ddd5949d8fc01..e21c73a3803ec 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -5413,9 +5413,19 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ ndlp->nlp_flag &= ~NLP_RELEASE_RPI;
+ spin_unlock_irq(&ndlp->lock);
+ }
++ lpfc_drop_node(vport, ndlp);
++ } else if (ndlp->nlp_state != NLP_STE_PLOGI_ISSUE &&
++ ndlp->nlp_state != NLP_STE_REG_LOGIN_ISSUE &&
++ ndlp->nlp_state != NLP_STE_PRLI_ISSUE) {
++ /* Drop ndlp if there is no planned or outstanding
++ * issued PRLI.
++ *
++ * In cases when the ndlp is acting as both an initiator
++ * and target function, let our issued PRLI determine
++ * the final ndlp kref drop.
++ */
++ lpfc_drop_node(vport, ndlp);
+ }
+-
+- lpfc_drop_node(vport, ndlp);
+ }
+
+ /* Release the originating I/O reference. */
+--
+2.39.2
+
--- /dev/null
+From 2cd866532edad92d91f33bc16006502ab19cc796 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 May 2023 22:00:21 +0800
+Subject: scsi: qedf: Fix NULL dereference in error handling
+
+From: Jinhong Zhu <jinhongzhu@hust.edu.cn>
+
+[ Upstream commit f025312b089474a54e4859f3453771314d9e3d4f ]
+
+Smatch reported:
+
+drivers/scsi/qedf/qedf_main.c:3056 qedf_alloc_global_queues()
+warn: missing unwind goto?
+
+At this point in the function, nothing has been allocated so we can return
+directly. In particular the "qedf->global_queues" have not been allocated
+so calling qedf_free_global_queues() will lead to a NULL dereference when
+we check if (!gl[i]) and "gl" is NULL.
+
+Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
+Signed-off-by: Jinhong Zhu <jinhongzhu@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230502140022.2852-1-jinhongzhu@hust.edu.cn
+Reviewed-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedf/qedf_main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index e045c6e250902..ecff2ec83a002 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -3046,9 +3046,8 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)
+ * addresses of our queues
+ */
+ if (!qedf->p_cpuq) {
+- status = -EINVAL;
+ QEDF_ERR(&qedf->dbg_ctx, "p_cpuq is NULL.\n");
+- goto mem_alloc_failure;
++ return -EINVAL;
+ }
+
+ qedf->global_queues = kzalloc((sizeof(struct global_queue *)
+--
+2.39.2
+
--- /dev/null
+From edb1bf796d46b88c864335ca4e6ce63a04ef47ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 May 2023 15:25:06 +0200
+Subject: sctp: add bpf_bypass_getsockopt proto callback
+
+From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
+
+[ Upstream commit 2598619e012cee5273a2821441b9a051ad931249 ]
+
+Implement ->bpf_bypass_getsockopt proto callback and filter out
+SCTP_SOCKOPT_PEELOFF, SCTP_SOCKOPT_PEELOFF_FLAGS and SCTP_SOCKOPT_CONNECTX3
+socket options from running eBPF hook on them.
+
+SCTP_SOCKOPT_PEELOFF and SCTP_SOCKOPT_PEELOFF_FLAGS options do fd_install(),
+and if BPF_CGROUP_RUN_PROG_GETSOCKOPT hook returns an error after success of
+the original handler sctp_getsockopt(...), userspace will receive an error
+from getsockopt syscall and will be not aware that fd was successfully
+installed into a fdtable.
+
+As pointed by Marcelo Ricardo Leitner it seems reasonable to skip
+bpf getsockopt hook for SCTP_SOCKOPT_CONNECTX3 sockopt too.
+Because internaly, it triggers connect() and if error is masked
+then userspace will be confused.
+
+This patch was born as a result of discussion around a new SCM_PIDFD interface:
+https://lore.kernel.org/all/20230413133355.350571-3-aleksandr.mikhalitsyn@canonical.com/
+
+Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks")
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Stanislav Fomichev <sdf@google.com>
+Cc: Neil Horman <nhorman@tuxdriver.com>
+Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Cc: Xin Long <lucien.xin@gmail.com>
+Cc: linux-sctp@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: netdev@vger.kernel.org
+Suggested-by: Stanislav Fomichev <sdf@google.com>
+Acked-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/socket.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index bc3d08bd7cef3..e1011311bc877 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -8279,6 +8279,22 @@ static int sctp_getsockopt(struct sock *sk, int level, int optname,
+ return retval;
+ }
+
++static bool sctp_bpf_bypass_getsockopt(int level, int optname)
++{
++ if (level == SOL_SCTP) {
++ switch (optname) {
++ case SCTP_SOCKOPT_PEELOFF:
++ case SCTP_SOCKOPT_PEELOFF_FLAGS:
++ case SCTP_SOCKOPT_CONNECTX3:
++ return true;
++ default:
++ return false;
++ }
++ }
++
++ return false;
++}
++
+ static int sctp_hash(struct sock *sk)
+ {
+ /* STUB */
+@@ -9643,6 +9659,7 @@ struct proto sctp_prot = {
+ .shutdown = sctp_shutdown,
+ .setsockopt = sctp_setsockopt,
+ .getsockopt = sctp_getsockopt,
++ .bpf_bypass_getsockopt = sctp_bpf_bypass_getsockopt,
+ .sendmsg = sctp_sendmsg,
+ .recvmsg = sctp_recvmsg,
+ .bind = sctp_bind,
+@@ -9698,6 +9715,7 @@ struct proto sctpv6_prot = {
+ .shutdown = sctp_shutdown,
+ .setsockopt = sctp_setsockopt,
+ .getsockopt = sctp_getsockopt,
++ .bpf_bypass_getsockopt = sctp_bpf_bypass_getsockopt,
+ .sendmsg = sctp_sendmsg,
+ .recvmsg = sctp_recvmsg,
+ .bind = sctp_bind,
+--
+2.39.2
+
--- /dev/null
+From 4107f6e289467006d779ac7e2c533f83d88bffbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 11:49:46 +0200
+Subject: selftests/bpf: Do not use sign-file as testcase
+
+From: Alexey Gladkov <legion@kernel.org>
+
+[ Upstream commit f04a32b2c5b539e3c097cb5c7c1df12a8f4a0cf0 ]
+
+The sign-file utility (from scripts/) is used in prog_tests/verify_pkcs7_sig.c,
+but the utility should not be called as a test. Executing this utility produces
+the following error:
+
+ selftests: /linux/tools/testing/selftests/bpf: urandom_read
+ ok 16 selftests: /linux/tools/testing/selftests/bpf: urandom_read
+
+ selftests: /linux/tools/testing/selftests/bpf: sign-file
+ not ok 17 selftests: /linux/tools/testing/selftests/bpf: sign-file # exit=2
+
+Also, urandom_read is mistakenly used as a test. It does not lead to an error,
+but should be moved over to TEST_GEN_FILES as well. The empty TEST_CUSTOM_PROGS
+can then be removed.
+
+Fixes: fc97590668ae ("selftests/bpf: Add test for bpf_verify_pkcs7_signature() kfunc")
+Signed-off-by: Alexey Gladkov <legion@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
+Acked-by: Stanislav Fomichev <sdf@google.com>
+Link: https://lore.kernel.org/bpf/ZEuWFk3QyML9y5QQ@example.org
+Link: https://lore.kernel.org/bpf/88e3ab23029d726a2703adcf6af8356f7a2d3483.1684316821.git.legion@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index 0465ddc81f352..3b57fbf8fff4a 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -85,8 +85,7 @@ TEST_GEN_PROGS_EXTENDED = test_sock_addr test_skb_cgroup_id_user \
+ test_lirc_mode2_user xdping test_cpp runqslower bench bpf_testmod.ko \
+ xskxceiver xdp_redirect_multi xdp_synproxy veristat
+
+-TEST_CUSTOM_PROGS = $(OUTPUT)/urandom_read $(OUTPUT)/sign-file
+-TEST_GEN_FILES += liburandom_read.so
++TEST_GEN_FILES += liburandom_read.so urandom_read sign-file
+
+ # Emit succinct information message describing current building step
+ # $1 - generic step name (e.g., CC, LINK, etc);
+--
+2.39.2
+
--- /dev/null
+From 6c6b5547e3922bc67b9a1b16456da8d608ad42c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 13:30:47 +0200
+Subject: selftests/bpf: Fix check_mtu using wrong variable type
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 095641817e1bf6aa2560e025e47575188ee3edaf ]
+
+Dan Carpenter found via Smatch static checker, that unsigned 'mtu_lo' is
+never less than zero.
+
+Variable mtu_lo should have been an 'int', because read_mtu_device_lo()
+uses minus as error indications.
+
+Fixes: b62eba563229 ("selftests/bpf: Tests using bpf_check_mtu BPF-helper")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/bpf/168605104733.3636467.17945947801753092590.stgit@firesoul
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/check_mtu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/check_mtu.c b/tools/testing/selftests/bpf/prog_tests/check_mtu.c
+index 12f4395f18b37..a756760a45edb 100644
+--- a/tools/testing/selftests/bpf/prog_tests/check_mtu.c
++++ b/tools/testing/selftests/bpf/prog_tests/check_mtu.c
+@@ -183,7 +183,7 @@ static void test_check_mtu_tc(__u32 mtu, __u32 ifindex)
+
+ void serial_test_check_mtu(void)
+ {
+- __u32 mtu_lo;
++ int mtu_lo;
+
+ if (test__start_subtest("bpf_check_mtu XDP-attach"))
+ test_check_mtu_xdp_attach();
+--
+2.39.2
+
--- /dev/null
+From 76414634f75ae06e7c1619ff1c9365ab41367e92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 May 2023 09:52:33 +0000
+Subject: selftests: cgroup: fix unexpected failure on test_memcg_low
+
+From: Haifeng Xu <haifeng.xu@shopee.com>
+
+[ Upstream commit 19ab365762c6cc39dfdee9e13ab0d12fe4b5540d ]
+
+Since commit f079a020ba95 ("selftests: memcg: factor out common parts of
+memory.{low,min} tests"), the value used in second alloc_anon has changed
+from 148M to 170M. Because memory.low allows reclaiming page cache in
+child cgroups, so the memory.current is close to 30M instead of 50M.
+Therefore, adjust the expected value of parent cgroup.
+
+Link: https://lkml.kernel.org/r/20230522095233.4246-2-haifeng.xu@shopee.com
+Fixes: f079a020ba95 ("selftests: memcg: factor out common parts of memory.{low,min} tests")
+Signed-off-by: Haifeng Xu <haifeng.xu@shopee.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Shakeel Butt <shakeelb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/cgroup/test_memcontrol.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/cgroup/test_memcontrol.c b/tools/testing/selftests/cgroup/test_memcontrol.c
+index fe4f9f4302822..5a526a8e7d333 100644
+--- a/tools/testing/selftests/cgroup/test_memcontrol.c
++++ b/tools/testing/selftests/cgroup/test_memcontrol.c
+@@ -284,6 +284,7 @@ static int test_memcg_protection(const char *root, bool min)
+ char *children[4] = {NULL};
+ const char *attribute = min ? "memory.min" : "memory.low";
+ long c[4];
++ long current;
+ int i, attempts;
+ int fd;
+
+@@ -392,7 +393,8 @@ static int test_memcg_protection(const char *root, bool min)
+ goto cleanup;
+ }
+
+- if (!values_close(cg_read_long(parent[1], "memory.current"), MB(50), 3))
++ current = min ? MB(50) : MB(30);
++ if (!values_close(cg_read_long(parent[1], "memory.current"), current, 3))
+ goto cleanup;
+
+ if (min) {
+--
+2.39.2
+
--- /dev/null
+From 20a9c2e73d8db5375f521ee2bf8a35c7dc8671ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 23:03:34 +0200
+Subject: selftests: rtnetlink: remove netdevsim device after ipsec offload
+ test
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 5f789f103671fec3733ebe756e56adf15c90c21d ]
+
+On systems where netdevsim is built-in or loaded before the test
+starts, kci_test_ipsec_offload doesn't remove the netdevsim device it
+created during the test.
+
+Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Link: https://lore.kernel.org/r/e1cb94f4f82f4eca4a444feec4488a1323396357.1687466906.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/rtnetlink.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh
+index 275491be3da2f..cafd14b1ed2ab 100755
+--- a/tools/testing/selftests/net/rtnetlink.sh
++++ b/tools/testing/selftests/net/rtnetlink.sh
+@@ -835,6 +835,7 @@ EOF
+ fi
+
+ # clean up any leftovers
++ echo 0 > /sys/bus/netdevsim/del_device
+ $probed && rmmod netdevsim
+
+ if [ $ret -ne 0 ]; then
+--
+2.39.2
+
drm-use-mgr-dev-in-drm_dbg_kms-in-drm_dp_add_payload_part2.patch
+fs-pipe-reveal-missing-function-protoypes.patch
+block-fix-the-type-of-the-second-bdev_op_is_zoned_wr.patch
+erofs-clean-up-cached-i-o-strategies.patch
+erofs-avoid-tagged-pointers-to-mark-sync-decompressi.patch
+erofs-remove-tagged-pointer-helpers.patch
+erofs-move-zdata.h-into-zdata.c.patch
+erofs-kill-hooked-chains-to-avoid-loops-on-deduplica.patch
+x86-resctrl-only-show-tasks-pid-in-current-pid-names.patch
+blk-iocost-use-spin_lock_irqsave-in-adjust_inuse_and.patch
+x86-sev-fix-calculation-of-end-address-based-on-numb.patch
+virt-sevguest-add-config_crypto-dependency.patch
+blk-mq-fix-potential-io-hang-by-wrong-wake_batch.patch
+lockd-drop-inappropriate-svc_get-from-locked_get.patch
+nvme-auth-rename-__nvme_auth_-reset-free-to-nvme_aut.patch
+nvme-auth-rename-authentication-work-elements.patch
+nvme-auth-remove-symbol-export-from-nvme_auth_reset.patch
+nvme-auth-no-need-to-reset-chap-contexts-on-re-authe.patch
+nvme-core-fix-memory-leak-in-dhchap_secret_store.patch
+nvme-core-fix-memory-leak-in-dhchap_ctrl_secret.patch
+nvme-auth-don-t-ignore-key-generation-failures-when-.patch
+nvme-core-add-missing-fault-injection-cleanup.patch
+nvme-core-fix-dev_pm_qos-memleak.patch
+md-raid10-check-slab-out-of-bounds-in-md_bitmap_get_.patch
+md-raid10-fix-overflow-of-md-safe_mode_delay.patch
+md-raid10-fix-wrong-setting-of-max_corr_read_errors.patch
+md-raid10-fix-null-ptr-deref-of-mreplace-in-raid10_s.patch
+md-raid10-fix-io-loss-while-replacement-replace-rdev.patch
+md-raid1-10-factor-out-a-helper-to-add-bio-to-plug.patch
+md-raid1-10-factor-out-a-helper-to-submit-normal-wri.patch
+md-raid1-10-submit-write-io-directly-if-bitmap-is-no.patch
+block-fix-blktrace-debugfs-entries-leakage.patch
+irqchip-stm32-exti-fix-warning-on-initialized-field-.patch
+irqchip-jcore-aic-fix-missing-allocation-of-irq-desc.patch
+svcrdma-prevent-page-release-when-nothing-was-receiv.patch
+erofs-simplify-iloc.patch
+erofs-fix-compact-4b-support-for-16k-block-size.patch
+posix-timers-prevent-rt-livelock-in-itimer_delete.patch
+tick-rcu-fix-bogus-ratelimit-condition.patch
+tracing-timer-add-missing-hrtimer-modes-to-decode_hr.patch
+clocksource-drivers-cadence-ttc-fix-memory-leak-in-t.patch
+pm-domains-fix-integer-overflow-issues-in-genpd_pars.patch
+perf-arm-cmn-fix-dtc-reset.patch
+x86-mm-allow-guest.enc_status_change_prepare-to-fail.patch
+x86-tdx-fix-race-between-set_memory_encrypted-and-lo.patch
+drivers-perf-hisi-don-t-migrate-perf-to-the-cpu-goin.patch
+powercap-rapl-fix-config_iosf_mbi-dependency.patch
+pm-domains-move-the-verification-of-in-params-from-g.patch
+arm-9303-1-kprobes-avoid-missing-declaration-warning.patch
+cpufreq-intel_pstate-fix-energy_performance_preferen.patch
+thermal-drivers-mediatek-relocate-driver-to-mediatek.patch
+thermal-drivers-sun8i-fix-some-error-handling-paths-.patch
+rcu-make-rcu_cpu_starting-rely-on-interrupts-being-d.patch
+rcu-tasks-stop-rcu_tasks_invoke_cbs-from-using-never.patch
+rcutorture-correct-name-of-use_softirq-module-parame.patch
+rcuscale-move-shutdown-from-wait_event-to-wait_event.patch
+rcu-rcuscale-move-rcu_scale_-after-kfree_scale_clean.patch
+rcu-rcuscale-stop-kfree_scale_thread-thread-s-after-.patch
+kselftest-vdso-fix-accumulation-of-uninitialized-ret.patch
+perf-ibs-fix-interface-via-core-pmu-events.patch
+x86-mm-fix-__swp_entry_to_pte-for-xen-pv-guests.patch
+locking-atomic-arm-fix-sync-ops.patch
+evm-complete-description-of-evm_inode_setattr.patch
+evm-fix-build-warnings.patch
+ima-fix-build-warnings.patch
+pstore-ram-add-check-for-kstrdup.patch
+igc-enable-and-fix-rx-hash-usage-by-netstack.patch
+wifi-ath9k-fix-ar9003-mac-hardware-hang-check-regist.patch
+wifi-ath9k-avoid-referencing-uninit-memory-in-ath9k_.patch
+libbpf-btf_dump_type_data_check_overflow-needs-to-co.patch
+samples-bpf-fix-buffer-overflow-in-tcp_basertt.patch
+spi-spi-geni-qcom-correct-cs_toggle-bit-in-spi_trans.patch
+wifi-wilc1000-fix-for-absent-rsn-capabilities-wfa-te.patch
+wifi-mwifiex-fix-the-size-of-a-memory-allocation-in-.patch
+sctp-add-bpf_bypass_getsockopt-proto-callback.patch
+libbpf-fix-offsetof-and-container_of-to-work-with-co.patch
+bpf-don-t-efault-for-g-s-setsockopt-with-wrong-optle.patch
+spi-dw-round-of-n_bytes-to-power-of-2.patch
+nfc-llcp-fix-possible-use-of-uninitialized-variable-.patch
+bpftool-jit-limited-misreported-as-negative-value-on.patch
+bpf-remove-bpf-trampoline-selector.patch
+bpf-fix-memleak-due-to-fentry-attach-failure.patch
+selftests-bpf-do-not-use-sign-file-as-testcase.patch
+regulator-core-fix-more-error-checking-for-debugfs_c.patch
+regulator-core-streamline-debugfs-operations.patch
+wifi-orinoco-fix-an-error-handling-path-in-spectrum_.patch
+wifi-orinoco-fix-an-error-handling-path-in-orinoco_c.patch
+wifi-atmel-fix-an-error-handling-path-in-atmel_probe.patch
+wifi-wl3501_cs-fix-an-error-handling-path-in-wl3501_.patch
+wifi-ray_cs-fix-an-error-handling-path-in-ray_probe.patch
+wifi-ath9k-don-t-allow-to-overwrite-endpoint0-attrib.patch
+samples-bpf-xdp1-and-xdp2-reduce-xdpbufsize-to-60.patch
+wifi-ath10k-trigger-sta-disconnect-after-reconfig-co.patch
+wifi-mac80211-recalc-min-chandef-for-new-sta-links.patch
+selftests-bpf-fix-check_mtu-using-wrong-variable-typ.patch
+wifi-rsi-do-not-configure-wowlan-in-shutdown-hook-if.patch
+wifi-rsi-do-not-set-mmc_pm_keep_power-in-shutdown.patch
+ice-handle-extts-in-the-miscellaneous-interrupt-thre.patch
+selftests-cgroup-fix-unexpected-failure-on-test_memc.patch
+watchdog-perf-define-dummy-watchdog_update_hrtimer_t.patch
+watchdog-perf-more-properly-prevent-false-positives-.patch
+kexec-fix-a-memory-leak-in-crash_shrink_memory.patch
+mmc-mediatek-avoid-ugly-error-message-when-sdio-wake.patch
+memstick-r592-make-memstick_debug_get_tpc_name-stati.patch
+wifi-ath9k-fix-possible-stall-on-ath9k_txq_list_has_.patch
+wifi-mac80211-fix-permissions-for-valid_links-debugf.patch
+rtnetlink-extend-rtext_filter_skip_stats-to-ifla_vf_.patch
+wifi-ath11k-add-missing-check-for-ioremap.patch
+wifi-iwlwifi-pull-from-txqs-with-softirqs-disabled.patch
+wifi-iwlwifi-pcie-fix-null-pointer-dereference-in-iw.patch
+wifi-mac80211-remove-missing-iftype-sband-data-eht-c.patch
+wifi-cfg80211-rewrite-merging-of-inherited-elements.patch
+wifi-cfg80211-drop-incorrect-nontransmitted-bss-upda.patch
+wifi-cfg80211-fix-regulatory-disconnect-with-ocb-nan.patch
+wifi-cfg80211-mac80211-fix-ml-element-common-size-ca.patch
+wifi-ieee80211-fix-the-common-size-calculation-for-r.patch
+mmc-add-mmc_quirk_broken_sd_cache-for-kingston-canva.patch
+wifi-iwlwifi-mvm-indicate-hw-decrypt-for-beacon-prot.patch
+wifi-ath9k-convert-msecs-to-jiffies-where-needed.patch
+bpf-factor-out-socket-lookup-functions-for-the-tc-ho.patch
+bpf-call-__bpf_sk_lookup-__bpf_skc_lookup-directly-v.patch
+bpf-fix-bpf-socket-lookup-from-tc-xdp-to-respect-soc.patch
+can-length-fix-bitstuffing-count.patch
+can-kvaser_pciefd-add-function-to-set-skb-hwtstamps.patch
+can-kvaser_pciefd-set-hardware-timestamp-on-transmit.patch
+net-stmmac-fix-double-serdes-powerdown.patch
+netlink-fix-potential-deadlock-in-netlink_set_err.patch
+netlink-do-not-hard-code-device-address-lenth-in-fdb.patch
+bonding-do-not-assume-skb-mac_header-is-set.patch
+selftests-rtnetlink-remove-netdevsim-device-after-ip.patch
+gtp-fix-use-after-free-in-__gtp_encap_destroy.patch
+net-axienet-move-reset-before-64-bit-dma-detection.patch
+ocfs2-fix-use-of-slab-data-with-sendpage.patch
+sfc-fix-crash-when-reading-stats-while-nic-is-resett.patch
+net-nfc-fix-use-after-free-caused-by-nfc_llcp_find_l.patch
+lib-ts_bm-reset-initial-match-offset-for-every-block.patch
+netfilter-conntrack-dccp-copy-entire-header-to-stack.patch
+netfilter-nf_conntrack_sip-fix-the-ct_sip_parse_nume.patch
+ipvlan-fix-return-value-of-ipvlan_queue_xmit.patch
+netlink-add-__sock_i_ino-for-__netlink_diag_dump.patch
+drm-amd-display-add-logging-for-display-mall-refresh.patch
+radeon-avoid-double-free-in-ci_dpm_init.patch
+drm-amd-display-explicitly-specify-update-type-per-p.patch
+drm-bridge-it6505-move-a-variable-assignment-behind-.patch
+input-drv260x-sleep-between-polling-go-bit.patch
+drm-bridge-ti-sn65dsi83-fix-enable-error-path.patch
+drm-bridge-tc358768-always-enable-hs-video-mode.patch
+drm-bridge-tc358768-fix-pll-parameters-computation.patch
+drm-bridge-tc358768-fix-pll-target-frequency.patch
+drm-bridge-tc358768-fix-tclk_zerocnt-computation.patch
+drm-bridge-tc358768-add-atomic_get_input_bus_fmts-im.patch
+drm-bridge-tc358768-fix-tclk_trailcnt-computation.patch
+drm-bridge-tc358768-fix-ths_zerocnt-computation.patch
+drm-bridge-tc358768-fix-txtagocnt-computation.patch
+drm-bridge-tc358768-fix-ths_trailcnt-computation.patch
+drm-vram-helper-fix-function-names-in-vram-helper-do.patch
+arm-dts-bcm5301x-drop-clock-names-from-the-spi-node.patch
+arm-dts-meson8b-correct-uart_b-and-uart_c-clock-refe.patch
+clk-vc5-use-clamp-to-restrict-pll-range.patch
+clk-vc5-fix-.driver_data-content-in-i2c_device_id.patch
+clk-vc7-fix-.driver_data-content-in-i2c_device_id.patch
+clk-rs9-fix-.driver_data-content-in-i2c_device_id.patch
+input-adxl34x-do-not-hardcode-interrupt-trigger-type.patch
+drm-sun4i_tcon-use-devm_clk_get_enabled-in-sun4i_tco.patch
+drm-panel-sharp-ls043t1le01-adjust-mode-settings.patch
+driver-soc-xilinx-use-_safe-loop-iterator-to-avoid-a.patch
+asoc-intel-sof_sdw-remove-sof_sdw_tgl_hdmi-for-meteo.patch
+drm-vkms-isolate-pixel-conversion-functionality.patch
+drm-add-fixed-point-helper-to-get-rounded-integer-va.patch
+drm-vkms-fix-rgb565-pixel-conversion.patch
+arm-dts-stm32-move-ethernet-mac-eeprom-from-som-to-c.patch
+bus-ti-sysc-fix-dispc-quirk-masking-bool-variables.patch
+arm64-dts-microchip-sparx5-do-not-use-psci-on-refere.patch
+drm-bridge-tc358767-switch-to-devm-mipi-dsi-helpers.patch
+clk-imx-scu-use-_safe-list-iterator-to-avoid-a-use-a.patch
+hwmon-f71882fg-prevent-possible-division-by-zero.patch
+rdma-bnxt_re-disable-kill-tasklet-only-if-it-is-enab.patch
+rdma-bnxt_re-fix-to-remove-unnecessary-return-labels.patch
+rdma-bnxt_re-use-unique-names-while-registering-inte.patch
+rdma-bnxt_re-remove-a-redundant-check-inside-bnxt_re.patch
+rdma-bnxt_re-fix-to-remove-an-unnecessary-log.patch
+drm-msm-dsi-don-t-allow-enabling-14nm-vco-with-unpro.patch
+drm-msm-disp-dpu-get-timing-engine-status-from-intf-.patch
+drm-msm-dpu-set-dpu_data_hctl_en-for-in-intf_sc7180_.patch
+iommu-virtio-detach-domain-on-endpoint-release.patch
+iommu-virtio-return-size-mapped-for-a-detached-domai.patch
+clk-renesas-rzg2l-fix-cpg_sipll5_clk1-register-write.patch
+arm-dts-gta04-move-model-property-out-of-pinctrl-nod.patch
+drm-bridge-anx7625-convert-to-i2c-s-.probe_new.patch
+drm-bridge-anx7625-prevent-endless-probe-loop.patch
+arm-dts-qcom-msm8974-do-not-use-underscore-in-node-n.patch
+arm64-dts-qcom-msm8916-correct-camss-unit-address.patch
+arm64-dts-qcom-msm8916-correct-mmc-unit-address.patch
+arm64-dts-qcom-msm8994-correct-spmi-unit-address.patch
+arm64-dts-qcom-msm8996-correct-camss-unit-address.patch
+arm64-dts-qcom-sdm630-correct-camss-unit-address.patch
+arm64-dts-qcom-sdm845-correct-camss-unit-address.patch
+arm64-dts-qcom-sm8350-add-gpi-dma-compatible-fallbac.patch
+arm64-dts-qcom-sm8350-correct-dma-controller-unit-ad.patch
+arm64-dts-qcom-sdm845-polaris-add-missing-touchscree.patch
+arm64-dts-qcom-apq8016-sbc-fix-regulator-constraints.patch
+arm64-dts-qcom-apq8016-sbc-fix-1.8v-power-rail-on-ls.patch
+drm-bridge-introduce-pre_enable_prev_first-to-alter-.patch
+drm-bridge-ti-sn65dsi83-fix-enable-disable-flow-to-m.patch
+drm-panel-simple-fix-active-size-for-ampire-am-48027.patch
+arm-ep93xx-fix-missing-prototype-warnings.patch
+arm-omap2-fix-missing-tick_broadcast-prototype.patch
+arm64-dts-qcom-pm7250b-add-missing-spmi-vadc-include.patch
+arm64-dts-qcom-apq8096-fix-fixed-regulator-name-prop.patch
+arm64-dts-mediatek-mt8183-add-mediatek-broken-save-r.patch
+arm-dts-stm32-shorten-the-av96-hdmi-sound-card-name.patch
+memory-brcmstb_dpfe-fix-testing-array-offset-after-u.patch
+arm-dts-qcom-apq8074-dragonboard-set-dma-as-remotely.patch
+asoc-es8316-increment-max-value-for-alc-capture-targ.patch
+asoc-es8316-do-not-set-rate-constraints-for-unsuppor.patch
+arm-dts-meson8-correct-uart_b-and-uart_c-clock-refer.patch
+soc-fsl-qe-fix-usb.c-build-errors.patch
+rdma-irdma-avoid-fortify-string-warning-in-irdma_clr.patch
+ib-hfi1-fix-wrong-mmu_node-used-for-user-sdma-packet.patch
+rdma-hns-fix-hns_roce_table_get-return-value.patch
+arm-dts-iwg20d-q7-common-fix-backlight-pwm-specifier.patch
+arm64-dts-renesas-ulcb-kf-remove-flow-control-for-sc.patch
+drm-msm-dpu-set-dsc-flush-bit-correctly-at-mdp-ctl-f.patch
+fbdev-omapfb-lcd_mipid-fix-an-error-handling-path-in.patch
+arm64-dts-ti-k3-j7200-fix-physical-address-of-pin.patch
+input-pm8941-powerkey-fix-debounce-on-gen2-pmics.patch
+arm-dts-stm32-fix-audio-routing-on-stm32mp15xx-dhcom.patch
+arm-dts-stm32-fix-i2s-endpoint-format-property-for-s.patch
+hwmon-gsc-hwmon-fix-fan-pwm-temperature-scaling.patch
+hwmon-pmbus-adm1275-fix-problems-with-temperature-mo.patch
+arm-dts-bcm5301x-fix-duplex-full-full-duplex.patch
+clk-export-clk_hw_forward_rate_request.patch
+mips-dts-ci20-fix-act8600-regulator-node-names.patch
+drm-amd-display-fix-a-test-calculateprefetchschedule.patch
+drm-amd-display-fix-a-test-dml32_rq_dlg_get_rq_reg.patch
+drm-amdkfd-fix-potential-deallocation-of-previously-.patch
+soc-mediatek-svs-fix-mt8192-gpu-node-name.patch
+drm-amd-display-fix-artifacting-on-edp-panels-when-e.patch
+drm-radeon-fix-possible-division-by-zero-errors.patch
+hid-input-map-battery-system-charging.patch
+hid-uclogic-modular-kunit-tests-should-not-depend-on.patch
+rdma-rxe-add-ibdev_dbg-macros-for-rxe.patch
+rdma-rxe-replace-pr_xxx-by-rxe_dbg_xxx-in-rxe_mw.c.patch
+rdma-rxe-fix-access-checks-in-rxe_check_bind_mw.patch
+amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_va.patch
+drm-msm-a5xx-really-check-for-a510-in-a5xx_gpu_init.patch
+rdma-bnxt_re-wraparound-mbox-producer-index.patch
+rdma-bnxt_re-avoid-calling-wake_up-threads-from-spin.patch
+clk-imx-clk-imxrt1050-fix-memory-leak-in-imxrt1050_c.patch
+clk-imx-clk-imx8mn-fix-memory-leak-in-imx8mn_clocks_.patch
+clk-imx93-fix-memory-leak-and-missing-unwind-goto-in.patch
+clk-imx-clk-imx8mp-improve-error-handling-in-imx8mp_.patch
+clk-mediatek-mt8192-correctly-unregister-and-free-cl.patch
+clk-mediatek-mt8192-propagate-struct-device-for-gate.patch
+clk-mediatek-clk-gate-propagate-struct-device-with-m.patch
+clk-mediatek-clk-mtk-propagate-struct-device-for-com.patch
+clk-mediatek-clk-mux-propagate-struct-device-for-mtk.patch
+clk-mediatek-clk-mtk-extend-mtk_clk_simple_probe.patch
+clk-mediatek-fix-of_iomap-memory-leak.patch
+arm64-dts-qcom-sdm845-flush-rsc-sleep-wake-votes.patch
+arm64-dts-qcom-sm8250-edo-panel-framebuffer-is-2.5k-.patch
+clk-bcm-rpi-fix-off-by-one-in-raspberrypi_discover_c.patch
+clk-clocking-wizard-fix-oops-in-clk_wzrd_register_di.patch
+clk-tegra-tegra124-emc-fix-potential-memory-leak.patch
+alsa-ac97-fix-possible-null-dereference-in-snd_ac97_.patch
+drm-msm-dpu-do-not-enable-color-management-if-dspps-.patch
+drm-msm-dpu-fix-slice_last_group_size-calculation.patch
+drm-msm-dsi-use-dsc-slice-s-packet-size-to-compute-w.patch
+drm-msm-dsi-flip-greater-than-check-for-slice_count-.patch
+drm-msm-dsi-remove-incorrect-references-to-slice_cou.patch
+drm-msm-dp-free-resources-after-unregistering-them.patch
+arm64-dts-mediatek-add-cpufreq-nodes-for-mt8192.patch
+arm64-dts-mediatek-mt8192-fix-cpus-capacity-dmips-mh.patch
+drm-amdgpu-fix-memcpy-in-sienna_cichlid_append_power.patch
+drm-amdgpu-fix-usage-of-umc-fill-record-in-ras.patch
+drm-msm-dpu-correct-merge_3d-length.patch
+clk-vc5-check-memory-returned-by-kasprintf.patch
+clk-cdce925-check-return-value-of-kasprintf.patch
+clk-si5341-return-error-if-one-synth-clock-registrat.patch
+clk-si5341-check-return-value-of-devm_-kasprintf.patch
+clk-si5341-free-unused-memory-on-probe-failure.patch
+clk-keystone-sci-clk-check-return-value-of-kasprintf.patch
+clk-ti-clkctrl-check-return-value-of-kasprintf.patch
+clocking-wizard-support-higher-frequency-accuracy.patch
+clk-clocking-wizard-check-return-value-of-devm_kaspr.patch
+drivers-meson-secure-pwrc-always-enable-dma-domain.patch
+ovl-update-of-dentry-revalidate-flags-after-copy-up.patch
+asoc-imx-audmix-check-return-value-of-devm_kasprintf.patch
+clk-fix-memory-leak-in-devm_clk_notifier_register.patch
+arm-dts-lan966x-kontron-d10-fix-board-reset.patch
+arm-dts-lan966x-kontron-d10-fix-spi-cs.patch
+asoc-amd-acp-clear-pdm-dma-interrupt-mask.patch
+mips-dts-ci20-add-parent-supplies-to-act8600-regulat.patch
+mips-dts-ci20-raise-vddcore-voltage-to-1.125-volts.patch
+pci-cadence-fix-gen2-link-retraining-process.patch
+pci-vmd-reset-vmd-config-register-between-soft-reboo.patch
+scsi-qedf-fix-null-dereference-in-error-handling.patch
+pinctrl-bcm2835-handle-gpiochip_add_pin_range-errors.patch
+platform-x86-lenovo-yogabook-fix-work-race-on-remove.patch
+platform-x86-lenovo-yogabook-reprobe-devices-on-remo.patch
+platform-x86-lenovo-yogabook-set-default-keyboard-ba.patch
+pci-aspm-disable-aspm-on-mfd-function-removal-to-avo.patch
+scsi-3w-xxxx-add-error-handling-for-initialization-f.patch
+pci-pciehp-cancel-bringup-sequence-if-card-is-not-pr.patch
+pci-ftpci100-release-the-clock-resources.patch
+pinctrl-sunplus-add-check-for-kmalloc.patch
+pci-add-pci_clear_master-stub-for-non-config_pci.patch
+scsi-lpfc-revise-npiv-els-unsol-rcv-cmpl-logic-to-dr.patch
+perf-bench-add-missing-setlocale-call-to-allow-usage.patch
+pinctrl-cherryview-return-correct-value-if-pin-in-pu.patch
+platform-x86-think-lmi-mutex-protection-around-multi.patch
+platform-x86-think-lmi-correct-system-password-inter.patch
+platform-x86-think-lmi-correct-nvme-password-handlin.patch
+pinctrl-sunplus-add-check-for-kmalloc.patch-1604
+pinctrl-npcm7xx-add-missing-check-for-ioremap.patch
+kcsan-don-t-expect-64-bits-atomic-builtins-from-32-b.patch
+powerpc-interrupt-don-t-read-msr-from-interrupt_exit.patch
+powerpc-signal32-force-inlining-of-__unsafe_save_use.patch
+perf-script-fix-allocation-of-evsel-priv-related-to-.patch
+platform-x86-thinkpad_acpi-fix-lkp-tests-warnings-fo.patch
+perf-dwarf-aux-fix-off-by-one-in-die_get_varname.patch
+acpi-make-remove-callback-of-acpi-driver-void.patch
+platform-x86-dell-dell-rbtn-fix-resources-leaking-on.patch
+perf-tool-x86-consolidate-is_amd-check-into-single-f.patch
+perf-tool-x86-fix-perf_env-memory-leak.patch
+powerpc-64s-fix-vas-mm-use-after-free.patch
+pinctrl-microchip-sgpio-check-return-value-of-devm_k.patch
+pinctrl-at91-pio4-check-return-value-of-devm_kasprin.patch
+powerpc-powernv-sriov-perform-null-check-on-iov-befo.patch
+powerpc-simplify-ppc_save_regs.patch
+powerpc-update-ppc_save_regs-to-save-current-r1-in-p.patch
+pci-qcom-remove-pcie20_-prefix-from-register-definit.patch
+pci-qcom-sort-and-group-registers-and-bitfield-defin.patch
+pci-qcom-use-lower-case-for-hex.patch
+pci-qcom-use-dwc-helpers-for-modifying-the-read-only.patch
+pci-qcom-disable-write-access-to-read-only-registers.patch
+riscv-uprobes-restore-thread.bad_cause.patch
+powerpc-book3s64-mm-fix-directmap-stats-in-proc-memi.patch
+powerpc-mm-dax-fix-the-condition-when-checking-if-al.patch
+pci-endpoint-fix-kconfig-indent-style.patch
+pci-endpoint-fix-a-kconfig-prompt-of-vntb-driver.patch
+pci-endpoint-functions-pci-epf-test-fix-dma_chan-dir.patch
+pci-vmd-fix-uninitialized-variable-usage-in-vmd_enab.patch
+vfio-mdev-move-the-compat_class-initialization-to-mo.patch
+hwrng-virtio-fix-race-on-data_avail-and-actual-data.patch
+modpost-remove-broken-calculation-of-exception_table.patch
+crypto-nx-fix-build-warnings-when-debug_fs-is-not-en.patch
+modpost-fix-section-mismatch-message-for-r_arm_abs32.patch
+modpost-fix-section-mismatch-message-for-r_arm_-pc24.patch
+crypto-marvell-cesa-fix-type-mismatch-warning.patch
+crypto-jitter-correct-health-test-during-initializat.patch
+modpost-fix-off-by-one-in-is_executable_section.patch
+arc-define-asm_nl-and-__align-_str-outside-ifdef-__a.patch
+crypto-kpp-add-helper-to-set-reqsize.patch
+crypto-qat-use-helper-to-set-reqsize.patch
+crypto-qat-unmap-buffer-before-free-for-dh.patch
+crypto-qat-unmap-buffers-before-free-for-rsa.patch
+nfsv4.2-fix-wrong-shrinker_id.patch
+nfsv4.1-freeze-the-session-table-upon-receiving-nfs4.patch
+smb3-do-not-send-lease-break-acknowledgment-if-all-f.patch
+dax-fix-dax_mapping_release-use-after-free.patch
+dax-introduce-alloc_dev_dax_id.patch
+dax-kmem-pass-valid-argument-to-memory_group_registe.patch
+hwrng-st-keep-clock-enabled-while-hwrng-is-registere.patch
+kbuild-disable-gcov-for-.mod.o.patch
+efi-libstub-disable-pci-dma-before-grabbing-the-efi-.patch
+cifs-prevent-use-after-free-by-freeing-the-cfile-lat.patch
+cifs-do-all-necessary-checks-for-credits-within-or-b.patch
+smb-client-fix-broken-file-attrs-with-nodfs-mounts.patch
+ksmbd-avoid-field-overflow-warning.patch
+arm64-sme-use-str-p-to-clear-ffr-context-field-in-st.patch
+x86-efi-make-efi_set_virtual_address_map-ibt-safe.patch
--- /dev/null
+From ee5aa246c50e27c6aa505b3d65ed36beb5e71301 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jun 2023 15:34:48 +0100
+Subject: sfc: fix crash when reading stats while NIC is resetting
+
+From: Edward Cree <ecree.xilinx@gmail.com>
+
+[ Upstream commit d1b355438b8325a486f087e506d412c4e852f37b ]
+
+efx_net_stats() (.ndo_get_stats64) can be called during an ethtool
+ selftest, during which time nic_data->mc_stats is NULL as the NIC has
+ been fini'd. In this case do not attempt to fetch the latest stats
+ from the hardware, else we will crash on a NULL dereference:
+ BUG: kernel NULL pointer dereference, address: 0000000000000038
+ RIP efx_nic_update_stats
+ abridged calltrace:
+ efx_ef10_update_stats_pf
+ efx_net_stats
+ dev_get_stats
+ dev_seq_printf_stats
+Skipping the read is safe, we will simply give out stale stats.
+To ensure that the free in efx_ef10_fini_nic() does not race against
+ efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the
+ efx->stats_lock in fini_nic (it is already held across update_stats).
+
+Fixes: d3142c193dca ("sfc: refactor EF10 stats handling")
+Reviewed-by: Pieter Jansen van Vuuren <pieter.jansen-van-vuuren@amd.com>
+Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index b63e47af63655..8c019f382a7f3 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -1297,8 +1297,10 @@ static void efx_ef10_fini_nic(struct efx_nic *efx)
+ {
+ struct efx_ef10_nic_data *nic_data = efx->nic_data;
+
++ spin_lock_bh(&efx->stats_lock);
+ kfree(nic_data->mc_stats);
+ nic_data->mc_stats = NULL;
++ spin_unlock_bh(&efx->stats_lock);
+ }
+
+ static int efx_ef10_init_nic(struct efx_nic *efx)
+@@ -1852,9 +1854,14 @@ static size_t efx_ef10_update_stats_pf(struct efx_nic *efx, u64 *full_stats,
+
+ efx_ef10_get_stat_mask(efx, mask);
+
+- efx_nic_copy_stats(efx, nic_data->mc_stats);
+- efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT,
+- mask, stats, nic_data->mc_stats, false);
++ /* If NIC was fini'd (probably resetting), then we can't read
++ * updated stats right now.
++ */
++ if (nic_data->mc_stats) {
++ efx_nic_copy_stats(efx, nic_data->mc_stats);
++ efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT,
++ mask, stats, nic_data->mc_stats, false);
++ }
+
+ /* Update derived statistics */
+ efx_nic_fix_nodesc_drop_stat(efx,
+--
+2.39.2
+
--- /dev/null
+From 1a78eb37a341ea50715c7d01ee59d9e8b50a53f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 21:24:49 -0300
+Subject: smb: client: fix broken file attrs with nodfs mounts
+
+From: Paulo Alcantara <pc@manguebit.com>
+
+[ Upstream commit d439b29057e26464120fc6c18f97433aa003b5fe ]
+
+*_get_inode_info() functions expect -EREMOTE when query path info
+calls find a DFS link, regardless whether !CONFIG_CIFS_DFS_UPCALL or
+'nodfs' mount option. Otherwise, those files will miss the fake DFS
+file attributes.
+
+Before patch
+
+ $ mount.cifs //srv/dfs /mnt/1 -o ...,nodfs
+ $ ls -l /mnt/1
+ ls: cannot access '/mnt/1/link': Operation not supported
+ total 0
+ -rwxr-xr-x 1 root root 0 Jul 26 2022 dfstest2_file1.txt
+ drwxr-xr-x 2 root root 0 Aug 8 2022 dir1
+ d????????? ? ? ? ? ? link
+
+After patch
+
+ $ mount.cifs //srv/dfs /mnt/1 -o ...,nodfs
+ $ ls -l /mnt/1
+ total 0
+ -rwxr-xr-x 1 root root 0 Jul 26 2022 dfstest2_file1.txt
+ drwxr-xr-x 2 root root 0 Aug 8 2022 dir1
+ drwx--x--x 2 root root 0 Jun 26 20:29 link
+
+Fixes: c877ce47e137 ("cifs: reduce roundtrips on create/qinfo requests")
+Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2inode.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
+index 57526bdbab171..5ddc629e62168 100644
+--- a/fs/smb/client/smb2inode.c
++++ b/fs/smb/client/smb2inode.c
+@@ -592,9 +592,6 @@ int smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
+ if (islink)
+ rc = -EREMOTE;
+ }
+- if (rc == -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && cifs_sb &&
+- (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS))
+- rc = -EOPNOTSUPP;
+ }
+
+ out:
+--
+2.39.2
+
--- /dev/null
+From f3a0d9422c5355d9a7c8109c5dc847f65cb40f87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Jun 2023 19:02:24 +0000
+Subject: SMB3: Do not send lease break acknowledgment if all file handles have
+ been closed
+
+From: Bharath SM <bharathsm@microsoft.com>
+
+[ Upstream commit da787d5b74983f7525d1eb4b9c0b4aff2821511a ]
+
+In case if all existing file handles are deferred handles and if all of
+them gets closed due to handle lease break then we dont need to send
+lease break acknowledgment to server, because last handle close will be
+considered as lease break ack.
+After closing deferred handels, we check for openfile list of inode,
+if its empty then we skip sending lease break ack.
+
+Fixes: 59a556aebc43 ("SMB3: drop reference to cfile before sending oplock break")
+Reviewed-by: Tom Talpey <tom@talpey.com>
+Signed-off-by: Bharath SM <bharathsm@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/file.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c
+index 87dcffece7623..9a367d4c74e47 100644
+--- a/fs/smb/client/file.c
++++ b/fs/smb/client/file.c
+@@ -5140,20 +5140,19 @@ void cifs_oplock_break(struct work_struct *work)
+
+ _cifsFileInfo_put(cfile, false /* do not wait for ourself */, false);
+ /*
+- * releasing stale oplock after recent reconnect of smb session using
+- * a now incorrect file handle is not a data integrity issue but do
+- * not bother sending an oplock release if session to server still is
+- * disconnected since oplock already released by the server
++ * MS-SMB2 3.2.5.19.1 and 3.2.5.19.2 (and MS-CIFS 3.2.5.42) do not require
++ * an acknowledgment to be sent when the file has already been closed.
++ * check for server null, since can race with kill_sb calling tree disconnect.
+ */
+- if (!oplock_break_cancelled) {
+- /* check for server null since can race with kill_sb calling tree disconnect */
+- if (tcon->ses && tcon->ses->server) {
+- rc = tcon->ses->server->ops->oplock_response(tcon, persistent_fid,
+- volatile_fid, net_fid, cinode);
+- cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
+- } else
+- pr_warn_once("lease break not sent for unmounted share\n");
+- }
++ spin_lock(&cinode->open_file_lock);
++ if (tcon->ses && tcon->ses->server && !oplock_break_cancelled &&
++ !list_empty(&cinode->openFileList)) {
++ spin_unlock(&cinode->open_file_lock);
++ rc = tcon->ses->server->ops->oplock_response(tcon, persistent_fid,
++ volatile_fid, net_fid, cinode);
++ cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
++ } else
++ spin_unlock(&cinode->open_file_lock);
+
+ cifs_done_oplock_break(cinode);
+ }
+--
+2.39.2
+
--- /dev/null
+From a631165bd44d862b54fdbf1c4c0edd4cecd69f1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 May 2023 15:52:16 -0700
+Subject: soc/fsl/qe: fix usb.c build errors
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7b1a78babd0d2cd27aa07255dee0c2d7ac0f31e3 ]
+
+Fix build errors in soc/fsl/qe/usb.c when QUICC_ENGINE is not set.
+This happens when PPC_EP88XC is set, which selects CPM1 & CPM.
+When CPM is set, USB_FSL_QE can be set without QUICC_ENGINE
+being set. When USB_FSL_QE is set, QE_USB deafults to y, which
+causes build errors when QUICC_ENGINE is not set. Making
+QE_USB depend on QUICC_ENGINE prevents QE_USB from defaulting to y.
+
+Fixes these build errors:
+
+drivers/soc/fsl/qe/usb.o: in function `qe_usb_clock_set':
+usb.c:(.text+0x1e): undefined reference to `qe_immr'
+powerpc-linux-ld: usb.c:(.text+0x2a): undefined reference to `qe_immr'
+powerpc-linux-ld: usb.c:(.text+0xbc): undefined reference to `qe_setbrg'
+powerpc-linux-ld: usb.c:(.text+0xca): undefined reference to `cmxgcr_lock'
+powerpc-linux-ld: usb.c:(.text+0xce): undefined reference to `cmxgcr_lock'
+
+Fixes: 5e41486c408e ("powerpc/QE: add support for QE USB clocks routing")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/all/202301101500.pillNv6R-lkp@intel.com/
+Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Leo Li <leoyang.li@nxp.com>
+Cc: Masahiro Yamada <masahiroy@kernel.org>
+Cc: Nicolas Schier <nicolas@fjasle.eu>
+Cc: Qiang Zhao <qiang.zhao@nxp.com>
+Cc: linuxppc-dev <linuxppc-dev@lists.ozlabs.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: Kumar Gala <galak@kernel.crashing.org>
+Acked-by: Nicolas Schier <nicolas@jasle.eu>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qe/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soc/fsl/qe/Kconfig b/drivers/soc/fsl/qe/Kconfig
+index 357c5800b112f..7afa796dbbb89 100644
+--- a/drivers/soc/fsl/qe/Kconfig
++++ b/drivers/soc/fsl/qe/Kconfig
+@@ -39,6 +39,7 @@ config QE_TDM
+
+ config QE_USB
+ bool
++ depends on QUICC_ENGINE
+ default y if USB_FSL_QE
+ help
+ QE USB Controller support
+--
+2.39.2
+
--- /dev/null
+From beeb3ec20f15bcd638ac06de99e6b91fd847e016 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 14:35:30 +0800
+Subject: soc: mediatek: SVS: Fix MT8192 GPU node name
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 95094495401bdf6a0649d220dfd095e6079b5e39 ]
+
+Device tree node names should be generic. The planned device node name
+for the GPU, according to the bindings and posted DT changes, is "gpu",
+not "mali".
+
+Fix the GPU node name in the SVS driver to follow.
+
+Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Link: https://lore.kernel.org/r/20230531063532.2240038-1-wenst@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-svs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
+index e55fb16fdc5ac..f00cd5c723499 100644
+--- a/drivers/soc/mediatek/mtk-svs.c
++++ b/drivers/soc/mediatek/mtk-svs.c
+@@ -2114,9 +2114,9 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ svsb = &svsp->banks[idx];
+
+ if (svsb->type == SVSB_HIGH)
+- svsb->opp_dev = svs_add_device_link(svsp, "mali");
++ svsb->opp_dev = svs_add_device_link(svsp, "gpu");
+ else if (svsb->type == SVSB_LOW)
+- svsb->opp_dev = svs_get_subsys_device(svsp, "mali");
++ svsb->opp_dev = svs_get_subsys_device(svsp, "gpu");
+
+ if (IS_ERR(svsb->opp_dev))
+ return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
+--
+2.39.2
+
--- /dev/null
+From 6ee2d40d8e92847eaf6f0e02238c91621155a5fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 10:47:45 +0000
+Subject: spi: dw: Round of n_bytes to power of 2
+
+From: Joy Chakraborty <joychakr@google.com>
+
+[ Upstream commit 9f34baf67e4d08908fd94ff29c825bb673295336 ]
+
+n_bytes variable in the driver represents the number of bytes per word
+that needs to be sent/copied to fifo. Bits/word can be between 8 and 32
+bits from the client but in memory they are a power of 2, same is mentioned
+in spi.h header:
+"
+ * @bits_per_word: Data transfers involve one or more words; word sizes
+ * like eight or 12 bits are common. In-memory wordsizes are
+ * powers of two bytes (e.g. 20 bit samples use 32 bits).
+ * This may be changed by the device's driver, or left at the
+ * default (0) indicating protocol words are eight bit bytes.
+ * The spi_transfer.bits_per_word can override this for each transfer.
+"
+
+Hence, round of n_bytes to a power of 2 to avoid values like 3 which
+would generate unalligned/odd accesses to memory/fifo.
+
+* tested on Baikal-T1 based system with DW SPI-looped back interface
+transferring a chunk of data with DFS:8,12,16.
+
+Fixes: a51acc2400d4 ("spi: dw: Add support for 32-bits max xfer size")
+Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com
+Signed-off-by: Joy Chakraborty <joychakr@google.com
+Reviewed-by: Serge Semin <fancer.lancer@gmail.com
+Tested-by: Serge Semin <fancer.lancer@gmail.com
+Link: https://lore.kernel.org/r/20230512104746.1797865-4-joychakr@google.com
+Signed-off-by: Mark Brown <broonie@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-dw-core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-dw-core.c b/drivers/spi/spi-dw-core.c
+index c3bfb6c84cab2..4976e3b8923ee 100644
+--- a/drivers/spi/spi-dw-core.c
++++ b/drivers/spi/spi-dw-core.c
+@@ -426,7 +426,10 @@ static int dw_spi_transfer_one(struct spi_controller *master,
+ int ret;
+
+ dws->dma_mapped = 0;
+- dws->n_bytes = DIV_ROUND_UP(transfer->bits_per_word, BITS_PER_BYTE);
++ dws->n_bytes =
++ roundup_pow_of_two(DIV_ROUND_UP(transfer->bits_per_word,
++ BITS_PER_BYTE));
++
+ dws->tx = (void *)transfer->tx_buf;
+ dws->tx_len = transfer->len / dws->n_bytes;
+ dws->rx = transfer->rx_buf;
+--
+2.39.2
+
--- /dev/null
+From 779dde932b00961a93d7a3fe95f2d224a255ebc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 14:12:08 +0530
+Subject: spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
+
+From: Vijaya Krishna Nivarthi <quic_vnivarth@quicinc.com>
+
+[ Upstream commit 5fd7c99ecf45c8ee8a9b1268f0ffc91cc6271da2 ]
+
+The CS_TOGGLE bit when set is supposed to instruct FW to
+toggle CS line between words. The driver with intent of
+disabling this behaviour has been unsetting BIT(0). This has
+not caused any trouble so far because the original BIT(1)
+is untouched and BIT(0) likely wasn't being used.
+
+Correct this to prevent a potential future bug.
+
+Signed-off-by: Vijaya Krishna Nivarthi <quic_vnivarth@quicinc.com
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org
+Fixes: 561de45f72bd ("spi: spi-geni-qcom: Add SPI driver support for GENI based QUP")
+Reviewed-by: Douglas Anderson <dianders@chromium.org
+Link: https://lore.kernel.org/r/1682412128-1913-1-git-send-email-quic_vnivarth@quicinc.com
+Signed-off-by: Mark Brown <broonie@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index dd1581893fe72..689b94fc5570a 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -35,7 +35,7 @@
+ #define CS_DEMUX_OUTPUT_SEL GENMASK(3, 0)
+
+ #define SE_SPI_TRANS_CFG 0x25c
+-#define CS_TOGGLE BIT(0)
++#define CS_TOGGLE BIT(1)
+
+ #define SE_SPI_WORD_LEN 0x268
+ #define WORD_LEN_MSK GENMASK(9, 0)
+--
+2.39.2
+
--- /dev/null
+From a7302893f02720d2f2767fca34f01adeeb775274 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jun 2023 10:10:20 -0400
+Subject: svcrdma: Prevent page release when nothing was received
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit baf6d18b116b7dc84ed5e212c3a89f17cdc3f28c ]
+
+I noticed that svc_rqst_release_pages() was still unnecessarily
+releasing a page when svc_rdma_recvfrom() returns zero.
+
+Fixes: a53d5cb0646a ("svcrdma: Avoid releasing a page in svc_xprt_release()")
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+index 53a7cb2f6c07d..6da6608985ce9 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+@@ -796,6 +796,12 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
+ struct svc_rdma_recv_ctxt *ctxt;
+ int ret;
+
++ /* Prevent svc_xprt_release() from releasing pages in rq_pages
++ * when returning 0 or an error.
++ */
++ rqstp->rq_respages = rqstp->rq_pages;
++ rqstp->rq_next_page = rqstp->rq_respages;
++
+ rqstp->rq_xprt_ctxt = NULL;
+
+ ctxt = NULL;
+@@ -819,12 +825,6 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
+ DMA_FROM_DEVICE);
+ svc_rdma_build_arg_xdr(rqstp, ctxt);
+
+- /* Prevent svc_xprt_release from releasing pages in rq_pages
+- * if we return 0 or an error.
+- */
+- rqstp->rq_respages = rqstp->rq_pages;
+- rqstp->rq_next_page = rqstp->rq_respages;
+-
+ ret = svc_rdma_xdr_decode_req(&rqstp->rq_arg, ctxt);
+ if (ret < 0)
+ goto out_err;
+--
+2.39.2
+
--- /dev/null
+From 0c5ad2b0ede5b59edcbbb1114c18d9f5cdda47a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 11:56:23 +0100
+Subject: thermal/drivers/mediatek: Relocate driver to mediatek folder
+
+From: Balsam CHIHI <bchihi@baylibre.com>
+
+[ Upstream commit fad399ebdd67f602f306b524e6f62c3570943a48 ]
+
+Add MediaTek proprietary folder to upstream more thermal zone and cooler
+drivers, relocate the original thermal controller driver to it, and rename it
+as "auxadc_thermal.c" to show its purpose more clearly.
+
+Signed-off-by: Balsam CHIHI <bchihi@baylibre.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230209105628.50294-2-bchihi@baylibre.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: 86edac7d3888 ("Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe"")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/Kconfig | 14 ++++---------
+ drivers/thermal/Makefile | 2 +-
+ drivers/thermal/mediatek/Kconfig | 21 +++++++++++++++++++
+ drivers/thermal/mediatek/Makefile | 1 +
+ .../auxadc_thermal.c} | 2 +-
+ 5 files changed, 28 insertions(+), 12 deletions(-)
+ create mode 100644 drivers/thermal/mediatek/Kconfig
+ create mode 100644 drivers/thermal/mediatek/Makefile
+ rename drivers/thermal/{mtk_thermal.c => mediatek/auxadc_thermal.c} (99%)
+
+diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
+index e052dae614ebb..d35f63daca3b7 100644
+--- a/drivers/thermal/Kconfig
++++ b/drivers/thermal/Kconfig
+@@ -412,16 +412,10 @@ config DA9062_THERMAL
+ zone.
+ Compatible with the DA9062 and DA9061 PMICs.
+
+-config MTK_THERMAL
+- tristate "Temperature sensor driver for mediatek SoCs"
+- depends on ARCH_MEDIATEK || COMPILE_TEST
+- depends on HAS_IOMEM
+- depends on NVMEM || NVMEM=n
+- depends on RESET_CONTROLLER
+- default y
+- help
+- Enable this option if you want to have support for thermal management
+- controller present in Mediatek SoCs
++menu "Mediatek thermal drivers"
++depends on ARCH_MEDIATEK || COMPILE_TEST
++source "drivers/thermal/mediatek/Kconfig"
++endmenu
+
+ config AMLOGIC_THERMAL
+ tristate "Amlogic Thermal Support"
+diff --git a/drivers/thermal/Makefile b/drivers/thermal/Makefile
+index 2506c6c8ca83a..766ce38ff4f33 100644
+--- a/drivers/thermal/Makefile
++++ b/drivers/thermal/Makefile
+@@ -55,7 +55,7 @@ obj-y += st/
+ obj-y += qcom/
+ obj-y += tegra/
+ obj-$(CONFIG_HISI_THERMAL) += hisi_thermal.o
+-obj-$(CONFIG_MTK_THERMAL) += mtk_thermal.o
++obj-y += mediatek/
+ obj-$(CONFIG_GENERIC_ADC_THERMAL) += thermal-generic-adc.o
+ obj-$(CONFIG_UNIPHIER_THERMAL) += uniphier_thermal.o
+ obj-$(CONFIG_AMLOGIC_THERMAL) += amlogic_thermal.o
+diff --git a/drivers/thermal/mediatek/Kconfig b/drivers/thermal/mediatek/Kconfig
+new file mode 100644
+index 0000000000000..7558a847d4e92
+--- /dev/null
++++ b/drivers/thermal/mediatek/Kconfig
+@@ -0,0 +1,21 @@
++config MTK_THERMAL
++ tristate "MediaTek thermal drivers"
++ depends on THERMAL_OF
++ help
++ This is the option for MediaTek thermal software solutions.
++ Please enable corresponding options to get temperature
++ information from thermal sensors or turn on throttle
++ mechaisms for thermal mitigation.
++
++if MTK_THERMAL
++
++config MTK_SOC_THERMAL
++ tristate "AUXADC temperature sensor driver for MediaTek SoCs"
++ depends on HAS_IOMEM
++ help
++ Enable this option if you want to get SoC temperature
++ information for MediaTek platforms.
++ This driver configures thermal controllers to collect
++ temperature via AUXADC interface.
++
++endif
+diff --git a/drivers/thermal/mediatek/Makefile b/drivers/thermal/mediatek/Makefile
+new file mode 100644
+index 0000000000000..53e86e30b26ff
+--- /dev/null
++++ b/drivers/thermal/mediatek/Makefile
+@@ -0,0 +1 @@
++obj-$(CONFIG_MTK_SOC_THERMAL) += auxadc_thermal.o
+diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mediatek/auxadc_thermal.c
+similarity index 99%
+rename from drivers/thermal/mtk_thermal.c
+rename to drivers/thermal/mediatek/auxadc_thermal.c
+index 8440692e3890d..b4ef57fa9183e 100644
+--- a/drivers/thermal/mtk_thermal.c
++++ b/drivers/thermal/mediatek/auxadc_thermal.c
+@@ -23,7 +23,7 @@
+ #include <linux/reset.h>
+ #include <linux/types.h>
+
+-#include "thermal_hwmon.h"
++#include "../thermal_hwmon.h"
+
+ /* AUXADC Registers */
+ #define AUXADC_CON1_SET_V 0x008
+--
+2.39.2
+
--- /dev/null
+From 538a3db6cf6095d87e4446f6a0d0b58fac1d7ce1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 May 2023 20:46:05 +0200
+Subject: thermal/drivers/sun8i: Fix some error handling paths in
+ sun8i_ths_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 89382022b370dfd34eaae9c863baa123fcd4d132 ]
+
+Should an error occur after calling sun8i_ths_resource_init() in the probe
+function, some resources need to be released, as already done in the
+.remove() function.
+
+Switch to the devm_clk_get_enabled() helper and add a new devm_action to
+turn sun8i_ths_resource_init() into a fully managed function.
+
+Move the place where reset_control_deassert() is called so that the
+recommended order of reset release/clock enable steps is kept.
+A64 manual states that:
+
+ 3.3.6.4. Gating and reset
+
+ Make sure that the reset signal has been released before the release of
+ module clock gating;
+
+This fixes the issue and removes some LoC at the same time.
+
+Fixes: dccc5c3b6f30 ("thermal/drivers/sun8i: Add thermal driver for H6/H5/H3/A64/A83T/R40")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/a8ae84bd2dc4b55fe428f8e20f31438bf8bb6762.1684089931.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/sun8i_thermal.c | 55 +++++++++++----------------------
+ 1 file changed, 18 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/thermal/sun8i_thermal.c b/drivers/thermal/sun8i_thermal.c
+index e64d06d1328ce..80614b6adfac5 100644
+--- a/drivers/thermal/sun8i_thermal.c
++++ b/drivers/thermal/sun8i_thermal.c
+@@ -319,6 +319,11 @@ static int sun8i_ths_calibrate(struct ths_device *tmdev)
+ return ret;
+ }
+
++static void sun8i_ths_reset_control_assert(void *data)
++{
++ reset_control_assert(data);
++}
++
+ static int sun8i_ths_resource_init(struct ths_device *tmdev)
+ {
+ struct device *dev = tmdev->dev;
+@@ -339,47 +344,35 @@ static int sun8i_ths_resource_init(struct ths_device *tmdev)
+ if (IS_ERR(tmdev->reset))
+ return PTR_ERR(tmdev->reset);
+
+- tmdev->bus_clk = devm_clk_get(&pdev->dev, "bus");
++ ret = reset_control_deassert(tmdev->reset);
++ if (ret)
++ return ret;
++
++ ret = devm_add_action_or_reset(dev, sun8i_ths_reset_control_assert,
++ tmdev->reset);
++ if (ret)
++ return ret;
++
++ tmdev->bus_clk = devm_clk_get_enabled(&pdev->dev, "bus");
+ if (IS_ERR(tmdev->bus_clk))
+ return PTR_ERR(tmdev->bus_clk);
+ }
+
+ if (tmdev->chip->has_mod_clk) {
+- tmdev->mod_clk = devm_clk_get(&pdev->dev, "mod");
++ tmdev->mod_clk = devm_clk_get_enabled(&pdev->dev, "mod");
+ if (IS_ERR(tmdev->mod_clk))
+ return PTR_ERR(tmdev->mod_clk);
+ }
+
+- ret = reset_control_deassert(tmdev->reset);
+- if (ret)
+- return ret;
+-
+- ret = clk_prepare_enable(tmdev->bus_clk);
+- if (ret)
+- goto assert_reset;
+-
+ ret = clk_set_rate(tmdev->mod_clk, 24000000);
+ if (ret)
+- goto bus_disable;
+-
+- ret = clk_prepare_enable(tmdev->mod_clk);
+- if (ret)
+- goto bus_disable;
++ return ret;
+
+ ret = sun8i_ths_calibrate(tmdev);
+ if (ret)
+- goto mod_disable;
++ return ret;
+
+ return 0;
+-
+-mod_disable:
+- clk_disable_unprepare(tmdev->mod_clk);
+-bus_disable:
+- clk_disable_unprepare(tmdev->bus_clk);
+-assert_reset:
+- reset_control_assert(tmdev->reset);
+-
+- return ret;
+ }
+
+ static int sun8i_h3_thermal_init(struct ths_device *tmdev)
+@@ -530,17 +523,6 @@ static int sun8i_ths_probe(struct platform_device *pdev)
+ return 0;
+ }
+
+-static int sun8i_ths_remove(struct platform_device *pdev)
+-{
+- struct ths_device *tmdev = platform_get_drvdata(pdev);
+-
+- clk_disable_unprepare(tmdev->mod_clk);
+- clk_disable_unprepare(tmdev->bus_clk);
+- reset_control_assert(tmdev->reset);
+-
+- return 0;
+-}
+-
+ static const struct ths_thermal_chip sun8i_a83t_ths = {
+ .sensor_num = 3,
+ .scale = 705,
+@@ -642,7 +624,6 @@ MODULE_DEVICE_TABLE(of, of_ths_match);
+
+ static struct platform_driver ths_driver = {
+ .probe = sun8i_ths_probe,
+- .remove = sun8i_ths_remove,
+ .driver = {
+ .name = "sun8i-thermal",
+ .of_match_table = of_ths_match,
+--
+2.39.2
+
--- /dev/null
+From aec743e88f9876785f416f0bd4e3f99b255adb81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 00:12:53 +0800
+Subject: tick/rcu: Fix bogus ratelimit condition
+
+From: Wen Yang <wenyang.linux@foxmail.com>
+
+[ Upstream commit a7e282c77785c7eabf98836431b1f029481085ad ]
+
+The ratelimit logic in report_idle_softirq() is broken because the
+exit condition is always true:
+
+ static int ratelimit;
+
+ if (ratelimit < 10)
+ return false; ---> always returns here
+
+ ratelimit++; ---> no chance to run
+
+Make it check for >= 10 instead.
+
+Fixes: 0345691b24c0 ("tick/rcu: Stop allowing RCU_SOFTIRQ in idle")
+Signed-off-by: Wen Yang <wenyang.linux@foxmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/tencent_5AAA3EEAB42095C9B7740BE62FBF9A67E007@qq.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-sched.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index d6fb6a676bbbb..1ad89eec2a55f 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -1046,7 +1046,7 @@ static bool report_idle_softirq(void)
+ return false;
+ }
+
+- if (ratelimit < 10)
++ if (ratelimit >= 10)
+ return false;
+
+ /* On RT, softirqs handling may be waiting on some lock */
+--
+2.39.2
+
--- /dev/null
+From de58738024f628a7c7f21926ea8a0aac8a081484 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 16:38:54 +0200
+Subject: tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 2951580ba6adb082bb6b7154a5ecb24e7c1f7569 ]
+
+The trace output for the HRTIMER_MODE_.*_HARD modes is seen as a number
+since these modes are not decoded. The author was not aware of the fancy
+decoding function which makes the life easier.
+
+Extend decode_hrtimer_mode() with the additional HRTIMER_MODE_.*_HARD
+modes.
+
+Fixes: ae6683d815895 ("hrtimer: Introduce HARD expiry mode")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Link: https://lore.kernel.org/r/20230418143854.8vHWQKLM@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/timer.h | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h
+index 3e8619c72f774..b4bc2828fa09f 100644
+--- a/include/trace/events/timer.h
++++ b/include/trace/events/timer.h
+@@ -158,7 +158,11 @@ DEFINE_EVENT(timer_class, timer_cancel,
+ { HRTIMER_MODE_ABS_SOFT, "ABS|SOFT" }, \
+ { HRTIMER_MODE_REL_SOFT, "REL|SOFT" }, \
+ { HRTIMER_MODE_ABS_PINNED_SOFT, "ABS|PINNED|SOFT" }, \
+- { HRTIMER_MODE_REL_PINNED_SOFT, "REL|PINNED|SOFT" })
++ { HRTIMER_MODE_REL_PINNED_SOFT, "REL|PINNED|SOFT" }, \
++ { HRTIMER_MODE_ABS_HARD, "ABS|HARD" }, \
++ { HRTIMER_MODE_REL_HARD, "REL|HARD" }, \
++ { HRTIMER_MODE_ABS_PINNED_HARD, "ABS|PINNED|HARD" }, \
++ { HRTIMER_MODE_REL_PINNED_HARD, "REL|PINNED|HARD" })
+
+ /**
+ * hrtimer_init - called when the hrtimer is initialized
+--
+2.39.2
+
--- /dev/null
+From 3607a158ba683189915ab750eec8a0ced96ef13b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jun 2023 15:36:42 +0200
+Subject: vfio/mdev: Move the compat_class initialization to module init
+
+From: Eric Farman <farman@linux.ibm.com>
+
+[ Upstream commit ff598081e5b9d0bdd6874bfe340811bbb75b35e4 ]
+
+The pointer to mdev_bus_compat_class is statically defined at the top
+of mdev_core, and was originally (commit 7b96953bc640 ("vfio: Mediated
+device Core driver") serialized by the parent_list_lock. The blamed
+commit removed this mutex, leaving the pointer initialization
+unserialized. As a result, the creation of multiple MDEVs in parallel
+(such as during boot) can encounter errors during the creation of the
+sysfs entries, such as:
+
+ [ 8.337509] sysfs: cannot create duplicate filename '/class/mdev_bus'
+ [ 8.337514] vfio_ccw 0.0.01d8: MDEV: Registered
+ [ 8.337516] CPU: 13 PID: 946 Comm: driverctl Not tainted 6.4.0-rc7 #20
+ [ 8.337522] Hardware name: IBM 3906 M05 780 (LPAR)
+ [ 8.337525] Call Trace:
+ [ 8.337528] [<0000000162b0145a>] dump_stack_lvl+0x62/0x80
+ [ 8.337540] [<00000001622aeb30>] sysfs_warn_dup+0x78/0x88
+ [ 8.337549] [<00000001622aeca6>] sysfs_create_dir_ns+0xe6/0xf8
+ [ 8.337552] [<0000000162b04504>] kobject_add_internal+0xf4/0x340
+ [ 8.337557] [<0000000162b04d48>] kobject_add+0x78/0xd0
+ [ 8.337561] [<0000000162b04e0a>] kobject_create_and_add+0x6a/0xb8
+ [ 8.337565] [<00000001627a110e>] class_compat_register+0x5e/0x90
+ [ 8.337572] [<000003ff7fd815da>] mdev_register_parent+0x102/0x130 [mdev]
+ [ 8.337581] [<000003ff7fdc7f2c>] vfio_ccw_sch_probe+0xe4/0x178 [vfio_ccw]
+ [ 8.337588] [<0000000162a7833c>] css_probe+0x44/0x80
+ [ 8.337599] [<000000016279f4da>] really_probe+0xd2/0x460
+ [ 8.337603] [<000000016279fa08>] driver_probe_device+0x40/0xf0
+ [ 8.337606] [<000000016279fb78>] __device_attach_driver+0xc0/0x140
+ [ 8.337610] [<000000016279cbe0>] bus_for_each_drv+0x90/0xd8
+ [ 8.337618] [<00000001627a00b0>] __device_attach+0x110/0x190
+ [ 8.337621] [<000000016279c7c8>] bus_rescan_devices_helper+0x60/0xb0
+ [ 8.337626] [<000000016279cd48>] drivers_probe_store+0x48/0x80
+ [ 8.337632] [<00000001622ac9b0>] kernfs_fop_write_iter+0x138/0x1f0
+ [ 8.337635] [<00000001621e5e14>] vfs_write+0x1ac/0x2f8
+ [ 8.337645] [<00000001621e61d8>] ksys_write+0x70/0x100
+ [ 8.337650] [<0000000162b2bdc4>] __do_syscall+0x1d4/0x200
+ [ 8.337656] [<0000000162b3c828>] system_call+0x70/0x98
+ [ 8.337664] kobject: kobject_add_internal failed for mdev_bus with -EEXIST, don't try to register things with the same name in the same directory.
+ [ 8.337668] kobject: kobject_create_and_add: kobject_add error: -17
+ [ 8.337674] vfio_ccw: probe of 0.0.01d9 failed with error -12
+ [ 8.342941] vfio_ccw_mdev aeb9ca91-10c6-42bc-a168-320023570aea: Adding to iommu group 2
+
+Move the initialization of the mdev_bus_compat_class pointer to the
+init path, to match the cleanup in module exit. This way the code
+in mdev_register_parent() can simply link the new parent to it,
+rather than determining whether initialization is required first.
+
+Fixes: 89345d5177aa ("vfio/mdev: embedd struct mdev_parent in the parent data structure")
+Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
+Signed-off-by: Eric Farman <farman@linux.ibm.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Tony Krowiak <akrowiak@linux.ibm.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/r/20230626133642.2939168-1-farman@linux.ibm.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/mdev/mdev_core.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
+index 58f91b3bd670c..ed4737de45289 100644
+--- a/drivers/vfio/mdev/mdev_core.c
++++ b/drivers/vfio/mdev/mdev_core.c
+@@ -72,12 +72,6 @@ int mdev_register_parent(struct mdev_parent *parent, struct device *dev,
+ parent->nr_types = nr_types;
+ atomic_set(&parent->available_instances, mdev_driver->max_instances);
+
+- if (!mdev_bus_compat_class) {
+- mdev_bus_compat_class = class_compat_register("mdev_bus");
+- if (!mdev_bus_compat_class)
+- return -ENOMEM;
+- }
+-
+ ret = parent_create_sysfs_files(parent);
+ if (ret)
+ return ret;
+@@ -251,13 +245,24 @@ int mdev_device_remove(struct mdev_device *mdev)
+
+ static int __init mdev_init(void)
+ {
+- return bus_register(&mdev_bus_type);
++ int ret;
++
++ ret = bus_register(&mdev_bus_type);
++ if (ret)
++ return ret;
++
++ mdev_bus_compat_class = class_compat_register("mdev_bus");
++ if (!mdev_bus_compat_class) {
++ bus_unregister(&mdev_bus_type);
++ return -ENOMEM;
++ }
++
++ return 0;
+ }
+
+ static void __exit mdev_exit(void)
+ {
+- if (mdev_bus_compat_class)
+- class_compat_unregister(mdev_bus_compat_class);
++ class_compat_unregister(mdev_bus_compat_class);
+ bus_unregister(&mdev_bus_type);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 943254c5989af95c94027318be7b7fd77d2f7337 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 18:13:56 +0100
+Subject: virt: sevguest: Add CONFIG_CRYPTO dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 84b9b44b99780d35fe72ac63c4724f158771e898 ]
+
+This driver fails to link when CRYPTO is disabled, or in a loadable
+module:
+
+ WARNING: unmet direct dependencies detected for CRYPTO_GCM
+ WARNING: unmet direct dependencies detected for CRYPTO_AEAD2
+ Depends on [m]: CRYPTO [=m]
+ Selected by [y]:
+ - SEV_GUEST [=y] && VIRT_DRIVERS [=y] && AMD_MEM_ENCRYPT [=y]
+
+x86_64-linux-ld: crypto/aead.o: in function `crypto_register_aeads':
+
+Fixes: fce96cf04430 ("virt: Add SEV-SNP guest driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230117171416.2715125-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virt/coco/sev-guest/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/virt/coco/sev-guest/Kconfig b/drivers/virt/coco/sev-guest/Kconfig
+index f9db0799ae67c..da2d7ca531f0f 100644
+--- a/drivers/virt/coco/sev-guest/Kconfig
++++ b/drivers/virt/coco/sev-guest/Kconfig
+@@ -2,6 +2,7 @@ config SEV_GUEST
+ tristate "AMD SEV Guest driver"
+ default m
+ depends on AMD_MEM_ENCRYPT
++ select CRYPTO
+ select CRYPTO_AEAD2
+ select CRYPTO_GCM
+ help
+--
+2.39.2
+
--- /dev/null
+From d7e3212fc3717c58db3fbc9555827e5857580496 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 May 2023 10:18:25 -0700
+Subject: watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on
+ correct config
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 5e008df11c55228a86a1bae692cc2002503572c9 ]
+
+Patch series "watchdog/hardlockup: Add the buddy hardlockup detector", v5.
+
+This patch series adds the "buddy" hardlockup detector. In brief, the
+buddy hardlockup detector can detect hardlockups without arch-level
+support by having CPUs checkup on a "buddy" CPU periodically.
+
+Given the new design of this patch series, testing all combinations is
+fairly difficult. I've attempted to make sure that all combinations of
+CONFIG_ options are good, but it wouldn't surprise me if I missed
+something. I apologize in advance and I'll do my best to fix any
+problems that are found.
+
+This patch (of 18):
+
+The real watchdog_update_hrtimer_threshold() is defined in
+kernel/watchdog_hld.c. That file is included if
+CONFIG_HARDLOCKUP_DETECTOR_PERF and the function is defined in that file
+if CONFIG_HARDLOCKUP_CHECK_TIMESTAMP.
+
+The dummy version of the function in "nmi.h" didn't get that quite right.
+While this doesn't appear to be a huge deal, it's nice to make it
+consistent.
+
+It doesn't break builds because CHECK_TIMESTAMP is only defined by x86 so
+others don't get a double definition, and x86 uses perf lockup detector,
+so it gets the out of line version.
+
+Link: https://lkml.kernel.org/r/20230519101840.v5.18.Ia44852044cdcb074f387e80df6b45e892965d4a1@changeid
+Link: https://lkml.kernel.org/r/20230519101840.v5.1.I8cbb2f4fa740528fcfade4f5439b6cdcdd059251@changeid
+Fixes: 7edaeb6841df ("kernel/watchdog: Prevent false positives with turbo modes")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Chen-Yu Tsai <wens@csie.org>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Daniel Thompson <daniel.thompson@linaro.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Guenter Roeck <groeck@chromium.org>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Lecopzer Chen <lecopzer.chen@mediatek.com>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Masayoshi Mizuma <msys.mizuma@gmail.com>
+Cc: Matthias Kaehlcke <mka@chromium.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Pingfan Liu <kernelfans@gmail.com>
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
+Cc: Ricardo Neri <ricardo.neri@intel.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Stephen Boyd <swboyd@chromium.org>
+Cc: Sumit Garg <sumit.garg@linaro.org>
+Cc: Tzung-Bi Shih <tzungbi@chromium.org>
+Cc: Will Deacon <will@kernel.org>
+Cc: Colin Cross <ccross@android.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/nmi.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/nmi.h b/include/linux/nmi.h
+index f700ff2df074e..0db377ff8f608 100644
+--- a/include/linux/nmi.h
++++ b/include/linux/nmi.h
+@@ -197,7 +197,7 @@ u64 hw_nmi_get_sample_period(int watchdog_thresh);
+ #endif
+
+ #if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \
+- defined(CONFIG_HARDLOCKUP_DETECTOR)
++ defined(CONFIG_HARDLOCKUP_DETECTOR_PERF)
+ void watchdog_update_hrtimer_threshold(u64 period);
+ #else
+ static inline void watchdog_update_hrtimer_threshold(u64 period) { }
+--
+2.39.2
+
--- /dev/null
+From 958e2e01451053824fbbf476b4e744245ed84624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 May 2023 10:18:26 -0700
+Subject: watchdog/perf: more properly prevent false positives with turbo modes
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 4379e59fe5665cfda737e45b8bf2f05321ef049c ]
+
+Currently, in the watchdog_overflow_callback() we first check to see if
+the watchdog had been touched and _then_ we handle the workaround for
+turbo mode. This order should be reversed.
+
+Specifically, "touching" the hardlockup detector's watchdog should avoid
+lockups being detected for one period that should be roughly the same
+regardless of whether we're running turbo or not. That means that we
+should do the extra accounting for turbo _before_ we look at (and clear)
+the global indicating that we've been touched.
+
+NOTE: this fix is made based on code inspection. I am not aware of any
+reports where the old code would have generated false positives. That
+being said, this order seems more correct and also makes it easier down
+the line to share code with the "buddy" hardlockup detector.
+
+Link: https://lkml.kernel.org/r/20230519101840.v5.2.I843b0d1de3e096ba111a179f3adb16d576bef5c7@changeid
+Fixes: 7edaeb6841df ("kernel/watchdog: Prevent false positives with turbo modes")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Chen-Yu Tsai <wens@csie.org>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Colin Cross <ccross@android.com>
+Cc: Daniel Thompson <daniel.thompson@linaro.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Guenter Roeck <groeck@chromium.org>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Lecopzer Chen <lecopzer.chen@mediatek.com>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Masayoshi Mizuma <msys.mizuma@gmail.com>
+Cc: Matthias Kaehlcke <mka@chromium.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Pingfan Liu <kernelfans@gmail.com>
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
+Cc: Ricardo Neri <ricardo.neri@intel.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Stephen Boyd <swboyd@chromium.org>
+Cc: Sumit Garg <sumit.garg@linaro.org>
+Cc: Tzung-Bi Shih <tzungbi@chromium.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/watchdog_hld.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
+index 247bf0b1582ca..1e8a49dc956e2 100644
+--- a/kernel/watchdog_hld.c
++++ b/kernel/watchdog_hld.c
+@@ -114,14 +114,14 @@ static void watchdog_overflow_callback(struct perf_event *event,
+ /* Ensure the watchdog never gets throttled */
+ event->hw.interrupts = 0;
+
++ if (!watchdog_check_timestamp())
++ return;
++
+ if (__this_cpu_read(watchdog_nmi_touch) == true) {
+ __this_cpu_write(watchdog_nmi_touch, false);
+ return;
+ }
+
+- if (!watchdog_check_timestamp())
+- return;
+-
+ /* check for a hardlockup
+ * This is done by making sure our timer interrupt
+ * is incrementing. The timer interrupt should have
+--
+2.39.2
+
--- /dev/null
+From 82c0f0cdca98d83591171e27836cff6e88712cfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 May 2023 12:41:08 +0300
+Subject: wifi: ath10k: Trigger STA disconnect after reconfig complete on
+ hardware restart
+
+From: Youghandhar Chintala <quic_youghand@quicinc.com>
+
+[ Upstream commit 75bd32f5ce94bc365ba0b9b68bcf9de84a391d37 ]
+
+Currently, on WCN3990, the station disconnect after hardware recovery is
+not working as expected. This is because of setting the
+IEEE80211_SDATA_DISCONNECT_HW_RESTART flag very early in the hardware
+recovery process even before the driver invokes ieee80211_hw_restart().
+On the contrary, mac80211 expects this flag to be set after
+ieee80211_hw_restart() is invoked for it to trigger station disconnect.
+
+Set the IEEE80211_SDATA_DISCONNECT_HW_RESTART flag in
+ath10k_reconfig_complete() instead to fix this.
+
+The other targets are not affected by this change, since the hardware
+params flag is not set.
+
+Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2.c10-00754-QCAHLSWMTPL-1
+
+Fixes: 2c3fc50591ff ("ath10k: Trigger sta disconnect on hardware restart")
+Signed-off-by: Youghandhar Chintala <quic_youghand@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230518101515.3820-1-quic_youghand@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/core.c | 9 ---------
+ drivers/net/wireless/ath/ath10k/mac.c | 7 +++++++
+ 2 files changed, 7 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
+index 5eb131ab916fd..b6052dcc45ebf 100644
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -2504,7 +2504,6 @@ EXPORT_SYMBOL(ath10k_core_napi_sync_disable);
+ static void ath10k_core_restart(struct work_struct *work)
+ {
+ struct ath10k *ar = container_of(work, struct ath10k, restart_work);
+- struct ath10k_vif *arvif;
+ int ret;
+
+ set_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags);
+@@ -2543,14 +2542,6 @@ static void ath10k_core_restart(struct work_struct *work)
+ ar->state = ATH10K_STATE_RESTARTING;
+ ath10k_halt(ar);
+ ath10k_scan_finish(ar);
+- if (ar->hw_params.hw_restart_disconnect) {
+- list_for_each_entry(arvif, &ar->arvifs, list) {
+- if (arvif->is_up &&
+- arvif->vdev_type == WMI_VDEV_TYPE_STA)
+- ieee80211_hw_restart_disconnect(arvif->vif);
+- }
+- }
+-
+ ieee80211_restart_hw(ar->hw);
+ break;
+ case ATH10K_STATE_OFF:
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index ec8d5b29bc72c..f0729acdec50a 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -8108,6 +8108,7 @@ static void ath10k_reconfig_complete(struct ieee80211_hw *hw,
+ enum ieee80211_reconfig_type reconfig_type)
+ {
+ struct ath10k *ar = hw->priv;
++ struct ath10k_vif *arvif;
+
+ if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART)
+ return;
+@@ -8122,6 +8123,12 @@ static void ath10k_reconfig_complete(struct ieee80211_hw *hw,
+ ar->state = ATH10K_STATE_ON;
+ ieee80211_wake_queues(ar->hw);
+ clear_bit(ATH10K_FLAG_RESTARTING, &ar->dev_flags);
++ if (ar->hw_params.hw_restart_disconnect) {
++ list_for_each_entry(arvif, &ar->arvifs, list) {
++ if (arvif->is_up && arvif->vdev_type == WMI_VDEV_TYPE_STA)
++ ieee80211_hw_restart_disconnect(arvif->vif);
++ }
++ }
+ }
+
+ mutex_unlock(&ar->conf_mutex);
+--
+2.39.2
+
--- /dev/null
+From 995598c010c5fbe2d5f2bf3539e7aea76000c3d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jun 2023 12:19:40 +0300
+Subject: wifi: ath11k: Add missing check for ioremap
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 16e0077e14a73866e9b0f4a6bf4ad3d4a5cb0f2a ]
+
+Add check for ioremap() and return the error if it fails in order to
+guarantee the success of ioremap(), same as in
+ath11k_qmi_load_file_target_mem().
+
+Fixes: 6ac04bdc5edb ("ath11k: Use reserved host DDR addresses from DT for PCI devices")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230608022858.27405-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c
+index 381c6b390dd78..01b02c03fa89c 100644
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -2058,6 +2058,9 @@ static int ath11k_qmi_assign_target_mem_chunk(struct ath11k_base *ab)
+ ab->qmi.target_mem[idx].iaddr =
+ ioremap(ab->qmi.target_mem[idx].paddr,
+ ab->qmi.target_mem[i].size);
++ if (!ab->qmi.target_mem[idx].iaddr)
++ return -EIO;
++
+ ab->qmi.target_mem[idx].size = ab->qmi.target_mem[i].size;
+ host_ddr_sz = ab->qmi.target_mem[i].size;
+ ab->qmi.target_mem[idx].type = ab->qmi.target_mem[i].type;
+@@ -2083,6 +2086,8 @@ static int ath11k_qmi_assign_target_mem_chunk(struct ath11k_base *ab)
+ ab->qmi.target_mem[idx].iaddr =
+ ioremap(ab->qmi.target_mem[idx].paddr,
+ ab->qmi.target_mem[i].size);
++ if (!ab->qmi.target_mem[idx].iaddr)
++ return -EIO;
+ } else {
+ ab->qmi.target_mem[idx].paddr =
+ ATH11K_QMI_CALDB_ADDRESS;
+--
+2.39.2
+
--- /dev/null
+From 968fa1985486baa0eb283134a02d2402f13aefda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 17:35:01 +0300
+Subject: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit f24292e827088bba8de7158501ac25a59b064953 ]
+
+For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid
+uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should
+validate pkt_len before accessing the SKB.
+
+For example, the obtained SKB may have been badly constructed with
+pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr
+but after being processed in ath9k_htc_rx_msg() and passed to
+ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI
+command header which should be located inside its data payload.
+
+Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit
+memory can be referenced.
+
+Tested on Qualcomm Atheros Communications AR9271 802.11n .
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Reported-and-tested-by: syzbot+f2cb6e0ffdb961921e4d@syzkaller.appspotmail.com
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230424183348.111355-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
+index 19345b8f7bfd5..d652c647d56b5 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.c
++++ b/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -221,6 +221,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
+ if (unlikely(wmi->stopped))
+ goto free_skb;
+
++ /* Validate the obtained SKB. */
++ if (unlikely(skb->len < sizeof(struct wmi_cmd_hdr)))
++ goto free_skb;
++
+ hdr = (struct wmi_cmd_hdr *) skb->data;
+ cmd_id = be16_to_cpu(hdr->command_id);
+
+--
+2.39.2
+
--- /dev/null
+From f52437221fcfeb24157b521d19ea346412b9c82d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jun 2023 16:46:55 +0300
+Subject: wifi: ath9k: convert msecs to jiffies where needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 2aa083acea9f61be3280184384551178f510ff51 ]
+
+Since 'ieee80211_queue_delayed_work()' expects timeout in
+jiffies and not milliseconds, 'msecs_to_jiffies()' should
+be used in 'ath_restart_work()' and '__ath9k_flush()'.
+
+Fixes: d63ffc45c5d3 ("ath9k: rename tx_complete_work to hw_check_work")
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230613134655.248728-1-dmantipov@yandex.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 7f9f06ea8a05f..6360d3356e256 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -203,7 +203,7 @@ void ath_cancel_work(struct ath_softc *sc)
+ void ath_restart_work(struct ath_softc *sc)
+ {
+ ieee80211_queue_delayed_work(sc->hw, &sc->hw_check_work,
+- ATH_HW_CHECK_POLL_INT);
++ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT));
+
+ if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah))
+ ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
+@@ -2240,7 +2240,7 @@ void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop,
+ }
+
+ ieee80211_queue_delayed_work(hw, &sc->hw_check_work,
+- ATH_HW_CHECK_POLL_INT);
++ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT));
+ }
+
+ static bool ath9k_tx_frames_pending(struct ieee80211_hw *hw)
+--
+2.39.2
+
--- /dev/null
+From b88dce85085c13d65bc987731600f45cd49ab225 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 18:03:17 +0300
+Subject: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 061b0cb9327b80d7a0f63a33e7c3e2a91a71f142 ]
+
+A bad USB device is able to construct a service connection response
+message with target endpoint being ENDPOINT0 which is reserved for
+HTC_CTRL_RSVD_SVC and should not be modified to be used for any other
+services.
+
+Reject such service connection responses.
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Reported-by: syzbot+b68fbebe56d8362907e8@syzkaller.appspotmail.com
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230516150427.79469-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/htc_hst.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index fe62ff668f757..99667aba289df 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -114,7 +114,13 @@ static void htc_process_conn_rsp(struct htc_target *target,
+
+ if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) {
+ epid = svc_rspmsg->endpoint_id;
+- if (epid < 0 || epid >= ENDPOINT_MAX)
++
++ /* Check that the received epid for the endpoint to attach
++ * a new service is valid. ENDPOINT0 can't be used here as it
++ * is already reserved for HTC_CTRL_RSVD_SVC service and thus
++ * should not be modified.
++ */
++ if (epid <= ENDPOINT0 || epid >= ENDPOINT_MAX)
+ return;
+
+ service_id = be16_to_cpu(svc_rspmsg->service_id);
+--
+2.39.2
+
--- /dev/null
+From 8a1b505a0a34350d02700e4d7c8b35a9081f7f26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 17:35:00 +0300
+Subject: wifi: ath9k: fix AR9003 mac hardware hang check register offset
+ calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Seiderer <ps.report@gmx.net>
+
+[ Upstream commit 3e56c80931c7615250fe4bf83f93b57881969266 ]
+
+Fix ath9k_hw_verify_hang()/ar9003_hw_detect_mac_hang() register offset
+calculation (do not overflow the shift for the second register/queues
+above five, use the register layout described in the comments above
+ath9k_hw_verify_hang() instead).
+
+Fixes: 222e04830ff0 ("ath9k: Fix MAC HW hang check for AR9003")
+
+Reported-by: Gregg Wonderly <greggwonderly@seqtechllc.com>
+Link: https://lore.kernel.org/linux-wireless/E3A9C354-0CB7-420C-ADEF-F0177FB722F4@seqtechllc.com/
+Signed-off-by: Peter Seiderer <ps.report@gmx.net>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230422212423.26065-1-ps.report@gmx.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/ar9003_hw.c | 27 ++++++++++++++--------
+ 1 file changed, 18 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+index 42f00a2a8c800..cf5648188459c 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+@@ -1099,17 +1099,22 @@ static bool ath9k_hw_verify_hang(struct ath_hw *ah, unsigned int queue)
+ {
+ u32 dma_dbg_chain, dma_dbg_complete;
+ u8 dcu_chain_state, dcu_complete_state;
++ unsigned int dbg_reg, reg_offset;
+ int i;
+
+- for (i = 0; i < NUM_STATUS_READS; i++) {
+- if (queue < 6)
+- dma_dbg_chain = REG_READ(ah, AR_DMADBG_4);
+- else
+- dma_dbg_chain = REG_READ(ah, AR_DMADBG_5);
++ if (queue < 6) {
++ dbg_reg = AR_DMADBG_4;
++ reg_offset = queue * 5;
++ } else {
++ dbg_reg = AR_DMADBG_5;
++ reg_offset = (queue - 6) * 5;
++ }
+
++ for (i = 0; i < NUM_STATUS_READS; i++) {
++ dma_dbg_chain = REG_READ(ah, dbg_reg);
+ dma_dbg_complete = REG_READ(ah, AR_DMADBG_6);
+
+- dcu_chain_state = (dma_dbg_chain >> (5 * queue)) & 0x1f;
++ dcu_chain_state = (dma_dbg_chain >> reg_offset) & 0x1f;
+ dcu_complete_state = dma_dbg_complete & 0x3;
+
+ if ((dcu_chain_state != 0x6) || (dcu_complete_state != 0x1))
+@@ -1128,6 +1133,7 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah)
+ u8 dcu_chain_state, dcu_complete_state;
+ bool dcu_wait_frdone = false;
+ unsigned long chk_dcu = 0;
++ unsigned int reg_offset;
+ unsigned int i = 0;
+
+ dma_dbg_4 = REG_READ(ah, AR_DMADBG_4);
+@@ -1139,12 +1145,15 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah)
+ goto exit;
+
+ for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+- if (i < 6)
++ if (i < 6) {
+ chk_dbg = dma_dbg_4;
+- else
++ reg_offset = i * 5;
++ } else {
+ chk_dbg = dma_dbg_5;
++ reg_offset = (i - 6) * 5;
++ }
+
+- dcu_chain_state = (chk_dbg >> (5 * i)) & 0x1f;
++ dcu_chain_state = (chk_dbg >> reg_offset) & 0x1f;
+ if (dcu_chain_state == 0x6) {
+ dcu_wait_frdone = true;
+ chk_dcu |= BIT(i);
+--
+2.39.2
+
--- /dev/null
+From 63520b05ce2a1923d422bfccdb2ecc7af2e91bdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 11:37:44 +0200
+Subject: wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Remi Pommarel <repk@triplefau.lt>
+
+[ Upstream commit 75086cc6dee046e3fbb3dba148b376d8802f83bc ]
+
+On EDMA capable hardware, ath9k_txq_list_has_key() can enter infinite
+loop if it is called while all txq_fifos have packets that use different
+key that the one we are looking for. Fix it by exiting the loop if all
+txq_fifos have been checked already.
+
+Because this loop is called under spin_lock_bh() (see ath_txq_lock) it
+causes the following rcu stall:
+
+rcu: INFO: rcu_sched self-detected stall on CPU
+ath10k_pci 0000:01:00.0: failed to read temperature -11
+rcu: 1-....: (5254 ticks this GP) idle=189/1/0x4000000000000002 softirq=8442983/8442984 fqs=2579
+ (t=5257 jiffies g=17983297 q=334)
+Task dump for CPU 1:
+task:hostapd state:R running task stack: 0 pid: 297 ppid: 289 flags:0x0000000a
+Call trace:
+ dump_backtrace+0x0/0x170
+ show_stack+0x1c/0x24
+ sched_show_task+0x140/0x170
+ dump_cpu_task+0x48/0x54
+ rcu_dump_cpu_stacks+0xf0/0x134
+ rcu_sched_clock_irq+0x8d8/0x9fc
+ update_process_times+0xa0/0xec
+ tick_sched_timer+0x5c/0xd0
+ __hrtimer_run_queues+0x154/0x320
+ hrtimer_interrupt+0x120/0x2f0
+ arch_timer_handler_virt+0x38/0x44
+ handle_percpu_devid_irq+0x9c/0x1e0
+ handle_domain_irq+0x64/0x90
+ gic_handle_irq+0x78/0xb0
+ call_on_irq_stack+0x28/0x38
+ do_interrupt_handler+0x54/0x5c
+ el1_interrupt+0x2c/0x4c
+ el1h_64_irq_handler+0x14/0x1c
+ el1h_64_irq+0x74/0x78
+ ath9k_txq_has_key+0x1bc/0x250 [ath9k]
+ ath9k_set_key+0x1cc/0x3dc [ath9k]
+ drv_set_key+0x78/0x170
+ ieee80211_key_replace+0x564/0x6cc
+ ieee80211_key_link+0x174/0x220
+ ieee80211_add_key+0x11c/0x300
+ nl80211_new_key+0x12c/0x330
+ genl_family_rcv_msg_doit+0xbc/0x11c
+ genl_rcv_msg+0xd8/0x1c4
+ netlink_rcv_skb+0x40/0x100
+ genl_rcv+0x3c/0x50
+ netlink_unicast+0x1ec/0x2c0
+ netlink_sendmsg+0x198/0x3c0
+ ____sys_sendmsg+0x210/0x250
+ ___sys_sendmsg+0x78/0xc4
+ __sys_sendmsg+0x4c/0x90
+ __arm64_sys_sendmsg+0x28/0x30
+ invoke_syscall.constprop.0+0x60/0x100
+ do_el0_svc+0x48/0xd0
+ el0_svc+0x14/0x50
+ el0t_64_sync_handler+0xa8/0xb0
+ el0t_64_sync+0x158/0x15c
+
+This rcu stall is hard to reproduce as is, but changing ATH_TXFIFO_DEPTH
+from 8 to 2 makes it reasonably easy to reproduce.
+
+Fixes: ca2848022c12 ("ath9k: Postpone key cache entry deletion for TXQ frames reference it")
+Signed-off-by: Remi Pommarel <repk@triplefau.lt>
+Tested-by: Nicolas Escande <nico.escande@gmail.com>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230609093744.1985-1-repk@triplefau.lt
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/main.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index a4197c14f0a92..7f9f06ea8a05f 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -850,7 +850,7 @@ static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix)
+ static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix)
+ {
+ struct ath_hw *ah = sc->sc_ah;
+- int i;
++ int i, j;
+ struct ath_txq *txq;
+ bool key_in_use = false;
+
+@@ -868,8 +868,9 @@ static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix)
+ if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+ int idx = txq->txq_tailidx;
+
+- while (!key_in_use &&
+- !list_empty(&txq->txq_fifo[idx])) {
++ for (j = 0; !key_in_use &&
++ !list_empty(&txq->txq_fifo[idx]) &&
++ j < ATH_TXFIFO_DEPTH; j++) {
+ key_in_use = ath9k_txq_list_has_key(
+ &txq->txq_fifo[idx], keyix);
+ INCR(idx, ATH_TXFIFO_DEPTH);
+--
+2.39.2
+
--- /dev/null
+From 97f50db3dc68fe69b87fcb96900afb8f0813199d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 May 2023 09:53:14 +0200
+Subject: wifi: atmel: Fix an error handling path in atmel_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 6b92e4351a29af52c285fe235e6e4d1a75de04b2 ]
+
+Should atmel_config() fail, some resources need to be released as already
+done in the remove function.
+
+While at it, remove a useless and erroneous comment. The probe is
+atmel_probe(), not atmel_attach().
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/1e65f174607a83348034197fa7d603bab10ba4a9.1684569156.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/atmel/atmel_cs.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/atmel/atmel_cs.c b/drivers/net/wireless/atmel/atmel_cs.c
+index 453bb84cb3386..58bba9875d366 100644
+--- a/drivers/net/wireless/atmel/atmel_cs.c
++++ b/drivers/net/wireless/atmel/atmel_cs.c
+@@ -72,6 +72,7 @@ struct local_info {
+ static int atmel_probe(struct pcmcia_device *p_dev)
+ {
+ struct local_info *local;
++ int ret;
+
+ dev_dbg(&p_dev->dev, "atmel_attach()\n");
+
+@@ -82,8 +83,16 @@ static int atmel_probe(struct pcmcia_device *p_dev)
+
+ p_dev->priv = local;
+
+- return atmel_config(p_dev);
+-} /* atmel_attach */
++ ret = atmel_config(p_dev);
++ if (ret)
++ goto err_free_priv;
++
++ return 0;
++
++err_free_priv:
++ kfree(p_dev->priv);
++ return ret;
++}
+
+ static void atmel_detach(struct pcmcia_device *link)
+ {
+--
+2.39.2
+
--- /dev/null
+From 8209d65a47db44640b47173eae3a7bb9272d0fca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jun 2023 09:54:04 +0300
+Subject: wifi: cfg80211: drop incorrect nontransmitted BSS update code
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 39432f8a3752a87a53fd8d5e51824a43aaae5cab ]
+
+The removed code ran for any BSS that was not included in the MBSSID
+element in order to update it. However, instead of using the correct
+inheritance rules, it would simply copy the elements from the
+transmitting AP. The result is that we would report incorrect elements
+in this case.
+
+After some discussions, it seems that there are likely not even APs
+actually using this feature. Either way, removing the code decreases
+complexity and makes the cfg80211 behaviour more correct.
+
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230616094949.cfd6d8db1f26.Ia1044902b86cd7d366400a4bfb93691b8f05d68c@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 154 ++++----------------------------------------
+ 1 file changed, 11 insertions(+), 143 deletions(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 9fcb6f06b8cbe..efe9283e98935 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -2308,118 +2308,6 @@ cfg80211_inform_bss_data(struct wiphy *wiphy,
+ }
+ EXPORT_SYMBOL(cfg80211_inform_bss_data);
+
+-static void
+-cfg80211_parse_mbssid_frame_data(struct wiphy *wiphy,
+- struct cfg80211_inform_bss *data,
+- struct ieee80211_mgmt *mgmt, size_t len,
+- struct cfg80211_non_tx_bss *non_tx_data,
+- gfp_t gfp)
+-{
+- enum cfg80211_bss_frame_type ftype;
+- const u8 *ie = mgmt->u.probe_resp.variable;
+- size_t ielen = len - offsetof(struct ieee80211_mgmt,
+- u.probe_resp.variable);
+-
+- ftype = ieee80211_is_beacon(mgmt->frame_control) ?
+- CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP;
+-
+- cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid,
+- le64_to_cpu(mgmt->u.probe_resp.timestamp),
+- le16_to_cpu(mgmt->u.probe_resp.beacon_int),
+- ie, ielen, non_tx_data, gfp);
+-}
+-
+-static void
+-cfg80211_update_notlisted_nontrans(struct wiphy *wiphy,
+- struct cfg80211_bss *nontrans_bss,
+- struct ieee80211_mgmt *mgmt, size_t len)
+-{
+- u8 *ie, *new_ie, *pos;
+- const struct element *nontrans_ssid;
+- const u8 *trans_ssid, *mbssid;
+- size_t ielen = len - offsetof(struct ieee80211_mgmt,
+- u.probe_resp.variable);
+- size_t new_ie_len;
+- struct cfg80211_bss_ies *new_ies;
+- const struct cfg80211_bss_ies *old;
+- size_t cpy_len;
+-
+- lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
+-
+- ie = mgmt->u.probe_resp.variable;
+-
+- new_ie_len = ielen;
+- trans_ssid = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
+- if (!trans_ssid)
+- return;
+- new_ie_len -= trans_ssid[1];
+- mbssid = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen);
+- /*
+- * It's not valid to have the MBSSID element before SSID
+- * ignore if that happens - the code below assumes it is
+- * after (while copying things inbetween).
+- */
+- if (!mbssid || mbssid < trans_ssid)
+- return;
+- new_ie_len -= mbssid[1];
+-
+- nontrans_ssid = ieee80211_bss_get_elem(nontrans_bss, WLAN_EID_SSID);
+- if (!nontrans_ssid)
+- return;
+-
+- new_ie_len += nontrans_ssid->datalen;
+-
+- /* generate new ie for nontrans BSS
+- * 1. replace SSID with nontrans BSS' SSID
+- * 2. skip MBSSID IE
+- */
+- new_ie = kzalloc(new_ie_len, GFP_ATOMIC);
+- if (!new_ie)
+- return;
+-
+- new_ies = kzalloc(sizeof(*new_ies) + new_ie_len, GFP_ATOMIC);
+- if (!new_ies)
+- goto out_free;
+-
+- pos = new_ie;
+-
+- /* copy the nontransmitted SSID */
+- cpy_len = nontrans_ssid->datalen + 2;
+- memcpy(pos, nontrans_ssid, cpy_len);
+- pos += cpy_len;
+- /* copy the IEs between SSID and MBSSID */
+- cpy_len = trans_ssid[1] + 2;
+- memcpy(pos, (trans_ssid + cpy_len), (mbssid - (trans_ssid + cpy_len)));
+- pos += (mbssid - (trans_ssid + cpy_len));
+- /* copy the IEs after MBSSID */
+- cpy_len = mbssid[1] + 2;
+- memcpy(pos, mbssid + cpy_len, ((ie + ielen) - (mbssid + cpy_len)));
+-
+- /* update ie */
+- new_ies->len = new_ie_len;
+- new_ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
+- new_ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control);
+- memcpy(new_ies->data, new_ie, new_ie_len);
+- if (ieee80211_is_probe_resp(mgmt->frame_control)) {
+- old = rcu_access_pointer(nontrans_bss->proberesp_ies);
+- rcu_assign_pointer(nontrans_bss->proberesp_ies, new_ies);
+- rcu_assign_pointer(nontrans_bss->ies, new_ies);
+- if (old)
+- kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
+- } else {
+- old = rcu_access_pointer(nontrans_bss->beacon_ies);
+- rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies);
+- cfg80211_update_hidden_bsses(bss_from_pub(nontrans_bss),
+- new_ies, old);
+- rcu_assign_pointer(nontrans_bss->ies, new_ies);
+- if (old)
+- kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
+- }
+-
+-out_free:
+- kfree(new_ie);
+-}
+-
+ /* cfg80211_inform_bss_width_frame helper */
+ static struct cfg80211_bss *
+ cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
+@@ -2561,51 +2449,31 @@ cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
+ struct ieee80211_mgmt *mgmt, size_t len,
+ gfp_t gfp)
+ {
+- struct cfg80211_bss *res, *tmp_bss;
++ struct cfg80211_bss *res;
+ const u8 *ie = mgmt->u.probe_resp.variable;
+- const struct cfg80211_bss_ies *ies1, *ies2;
+ size_t ielen = len - offsetof(struct ieee80211_mgmt,
+ u.probe_resp.variable);
++ enum cfg80211_bss_frame_type ftype;
+ struct cfg80211_non_tx_bss non_tx_data = {};
+
+ res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt,
+ len, gfp);
++ if (!res)
++ return NULL;
+
+ /* don't do any further MBSSID handling for S1G */
+ if (ieee80211_is_s1g_beacon(mgmt->frame_control))
+ return res;
+
+- if (!res || !wiphy->support_mbssid ||
+- !cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
+- return res;
+- if (wiphy->support_only_he_mbssid &&
+- !cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen))
+- return res;
+-
++ ftype = ieee80211_is_beacon(mgmt->frame_control) ?
++ CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP;
+ non_tx_data.tx_bss = res;
+- /* process each non-transmitting bss */
+- cfg80211_parse_mbssid_frame_data(wiphy, data, mgmt, len,
+- &non_tx_data, gfp);
+-
+- spin_lock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
+
+- /* check if the res has other nontransmitting bss which is not
+- * in MBSSID IE
+- */
+- ies1 = rcu_access_pointer(res->ies);
+-
+- /* go through nontrans_list, if the timestamp of the BSS is
+- * earlier than the timestamp of the transmitting BSS then
+- * update it
+- */
+- list_for_each_entry(tmp_bss, &res->nontrans_list,
+- nontrans_list) {
+- ies2 = rcu_access_pointer(tmp_bss->ies);
+- if (ies2->tsf < ies1->tsf)
+- cfg80211_update_notlisted_nontrans(wiphy, tmp_bss,
+- mgmt, len);
+- }
+- spin_unlock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
++ /* process each non-transmitting bss */
++ cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid,
++ le64_to_cpu(mgmt->u.probe_resp.timestamp),
++ le16_to_cpu(mgmt->u.probe_resp.beacon_int),
++ ie, ielen, &non_tx_data, gfp);
+
+ return res;
+ }
+--
+2.39.2
+
--- /dev/null
+From f7d9ff206869276e75b9682adb2e205857c353a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jun 2023 22:28:45 +0200
+Subject: wifi: cfg80211: fix regulatory disconnect with OCB/NAN
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit e8c2af660ba0790afd14d5cbc2fd05c6dc85e207 ]
+
+Since regulatory disconnect was added, OCB and NAN interface
+types were added, which made it completely unusable for any
+driver that allowed OCB/NAN. Add OCB/NAN (though NAN doesn't
+do anything, we don't have any info) and also remove all the
+logic that opts out, so it won't be broken again if/when new
+interface types are added.
+
+Fixes: 6e0bd6c35b02 ("cfg80211: 802.11p OCB mode handling")
+Fixes: cb3b7d87652a ("cfg80211: add start / stop NAN commands")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://lore.kernel.org/r/20230616222844.2794d1625a26.I8e78a3789a29e6149447b3139df724a6f1b46fc3@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/regulatory.h | 13 +------------
+ net/wireless/core.c | 16 ----------------
+ net/wireless/reg.c | 14 ++++++++++----
+ 3 files changed, 11 insertions(+), 32 deletions(-)
+
+diff --git a/include/net/regulatory.h b/include/net/regulatory.h
+index 896191f420d50..b2cb4a9eb04dc 100644
+--- a/include/net/regulatory.h
++++ b/include/net/regulatory.h
+@@ -140,17 +140,6 @@ struct regulatory_request {
+ * otherwise initiating radiation is not allowed. This will enable the
+ * relaxations enabled under the CFG80211_REG_RELAX_NO_IR configuration
+ * option
+- * @REGULATORY_IGNORE_STALE_KICKOFF: the regulatory core will _not_ make sure
+- * all interfaces on this wiphy reside on allowed channels. If this flag
+- * is not set, upon a regdomain change, the interfaces are given a grace
+- * period (currently 60 seconds) to disconnect or move to an allowed
+- * channel. Interfaces on forbidden channels are forcibly disconnected.
+- * Currently these types of interfaces are supported for enforcement:
+- * NL80211_IFTYPE_ADHOC, NL80211_IFTYPE_STATION, NL80211_IFTYPE_AP,
+- * NL80211_IFTYPE_AP_VLAN, NL80211_IFTYPE_MONITOR,
+- * NL80211_IFTYPE_P2P_CLIENT, NL80211_IFTYPE_P2P_GO,
+- * NL80211_IFTYPE_P2P_DEVICE. The flag will be set by default if a device
+- * includes any modes unsupported for enforcement checking.
+ * @REGULATORY_WIPHY_SELF_MANAGED: for devices that employ wiphy-specific
+ * regdom management. These devices will ignore all regdom changes not
+ * originating from their own wiphy.
+@@ -177,7 +166,7 @@ enum ieee80211_regulatory_flags {
+ REGULATORY_COUNTRY_IE_FOLLOW_POWER = BIT(3),
+ REGULATORY_COUNTRY_IE_IGNORE = BIT(4),
+ REGULATORY_ENABLE_RELAX_NO_IR = BIT(5),
+- REGULATORY_IGNORE_STALE_KICKOFF = BIT(6),
++ /* reuse bit 6 next time */
+ REGULATORY_WIPHY_SELF_MANAGED = BIT(7),
+ };
+
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index b3ec9eaec36b3..609b79fe4a748 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -721,22 +721,6 @@ int wiphy_register(struct wiphy *wiphy)
+ return -EINVAL;
+ }
+
+- /*
+- * if a wiphy has unsupported modes for regulatory channel enforcement,
+- * opt-out of enforcement checking
+- */
+- if (wiphy->interface_modes & ~(BIT(NL80211_IFTYPE_STATION) |
+- BIT(NL80211_IFTYPE_P2P_CLIENT) |
+- BIT(NL80211_IFTYPE_AP) |
+- BIT(NL80211_IFTYPE_MESH_POINT) |
+- BIT(NL80211_IFTYPE_P2P_GO) |
+- BIT(NL80211_IFTYPE_ADHOC) |
+- BIT(NL80211_IFTYPE_P2P_DEVICE) |
+- BIT(NL80211_IFTYPE_NAN) |
+- BIT(NL80211_IFTYPE_AP_VLAN) |
+- BIT(NL80211_IFTYPE_MONITOR)))
+- wiphy->regulatory_flags |= REGULATORY_IGNORE_STALE_KICKOFF;
+-
+ if (WARN_ON((wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) &&
+ (wiphy->regulatory_flags &
+ (REGULATORY_CUSTOM_REG |
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 522180919a1a3..3b44fa59dbbab 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2429,9 +2429,17 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
+ case NL80211_IFTYPE_P2P_DEVICE:
+ /* no enforcement required */
+ break;
++ case NL80211_IFTYPE_OCB:
++ if (!wdev->u.ocb.chandef.chan)
++ continue;
++ chandef = wdev->u.ocb.chandef;
++ break;
++ case NL80211_IFTYPE_NAN:
++ /* we have no info, but NAN is also pretty universal */
++ continue;
+ default:
+ /* others not implemented for now */
+- WARN_ON(1);
++ WARN_ON_ONCE(1);
+ break;
+ }
+
+@@ -2490,9 +2498,7 @@ static void reg_check_chans_work(struct work_struct *work)
+ rtnl_lock();
+
+ list_for_each_entry(rdev, &cfg80211_rdev_list, list)
+- if (!(rdev->wiphy.regulatory_flags &
+- REGULATORY_IGNORE_STALE_KICKOFF))
+- reg_leave_invalid_chans(&rdev->wiphy);
++ reg_leave_invalid_chans(&rdev->wiphy);
+
+ rtnl_unlock();
+ }
+--
+2.39.2
+
--- /dev/null
+From c3fb19dde537b842a67b161d64e56c741265ccc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Sep 2022 17:23:09 +0300
+Subject: wifi: cfg80211/mac80211: Fix ML element common size calculation
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 1403b109c9a5244dc6ab79154f04eecc209ef3d2 ]
+
+The common size is part of the length in the data
+so don't add it again.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Stable-dep-of: ce6e1f600b0c ("wifi: ieee80211: Fix the common size calculation for reconfiguration ML")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/ieee80211.h | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index d3088666f3f44..470fafce2e707 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -4573,18 +4573,17 @@ static inline u8 ieee80211_mle_common_size(const u8 *data)
+
+ switch (u16_get_bits(control, IEEE80211_ML_CONTROL_TYPE)) {
+ case IEEE80211_ML_CONTROL_TYPE_BASIC:
+- common += sizeof(struct ieee80211_mle_basic_common_info);
+- break;
+ case IEEE80211_ML_CONTROL_TYPE_PREQ:
+- common += sizeof(struct ieee80211_mle_preq_common_info);
++ case IEEE80211_ML_CONTROL_TYPE_TDLS:
++ /*
++ * The length is the first octet pointed by mle->variable so no
++ * need to add anything
++ */
+ break;
+ case IEEE80211_ML_CONTROL_TYPE_RECONF:
+ if (control & IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR)
+ common += ETH_ALEN;
+ return common;
+- case IEEE80211_ML_CONTROL_TYPE_TDLS:
+- common += sizeof(struct ieee80211_mle_tdls_common_info);
+- break;
+ case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:
+ if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR)
+ common += ETH_ALEN;
+--
+2.39.2
+
--- /dev/null
+From d680b674f4012918be4944f06291bec140fbbce0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jun 2023 09:54:03 +0300
+Subject: wifi: cfg80211: rewrite merging of inherited elements
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit dfd9aa3e7a456d57b18021d66472ab7ff8373ab7 ]
+
+The cfg80211_gen_new_ie function merges the IEs using inheritance rules.
+Rewrite this function to fix issues around inheritance rules. In
+particular, vendor elements do not require any special handling, as they
+are either all inherited or overridden by the subprofile.
+Also, add fragmentation handling as this may be needed in some cases.
+
+This also changes the function to not require making a copy. The new
+version could be optimized a bit by explicitly tracking which IEs have
+been handled already rather than looking that up again every time.
+
+Note that a small behavioural change is the removal of the SSID special
+handling. This should be fine for the MBSSID element, as the SSID must
+be included in the subelement.
+
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230616094949.bc6152e146db.I2b5f3bc45085e1901e5b5192a674436adaf94748@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 213 ++++++++++++++++++++++++++------------------
+ 1 file changed, 124 insertions(+), 89 deletions(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 6c2b73c0d36e8..9fcb6f06b8cbe 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -262,117 +262,152 @@ bool cfg80211_is_element_inherited(const struct element *elem,
+ }
+ EXPORT_SYMBOL(cfg80211_is_element_inherited);
+
+-static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
+- const u8 *subelement, size_t subie_len,
+- u8 *new_ie, gfp_t gfp)
++static size_t cfg80211_copy_elem_with_frags(const struct element *elem,
++ const u8 *ie, size_t ie_len,
++ u8 **pos, u8 *buf, size_t buf_len)
+ {
+- u8 *pos, *tmp;
+- const u8 *tmp_old, *tmp_new;
+- const struct element *non_inherit_elem;
+- u8 *sub_copy;
++ if (WARN_ON((u8 *)elem < ie || elem->data > ie + ie_len ||
++ elem->data + elem->datalen > ie + ie_len))
++ return 0;
+
+- /* copy subelement as we need to change its content to
+- * mark an ie after it is processed.
+- */
+- sub_copy = kmemdup(subelement, subie_len, gfp);
+- if (!sub_copy)
++ if (elem->datalen + 2 > buf + buf_len - *pos)
+ return 0;
+
+- pos = &new_ie[0];
++ memcpy(*pos, elem, elem->datalen + 2);
++ *pos += elem->datalen + 2;
+
+- /* set new ssid */
+- tmp_new = cfg80211_find_ie(WLAN_EID_SSID, sub_copy, subie_len);
+- if (tmp_new) {
+- memcpy(pos, tmp_new, tmp_new[1] + 2);
+- pos += (tmp_new[1] + 2);
++ /* Finish if it is not fragmented */
++ if (elem->datalen != 255)
++ return *pos - buf;
++
++ ie_len = ie + ie_len - elem->data - elem->datalen;
++ ie = (const u8 *)elem->data + elem->datalen;
++
++ for_each_element(elem, ie, ie_len) {
++ if (elem->id != WLAN_EID_FRAGMENT)
++ break;
++
++ if (elem->datalen + 2 > buf + buf_len - *pos)
++ return 0;
++
++ memcpy(*pos, elem, elem->datalen + 2);
++ *pos += elem->datalen + 2;
++
++ if (elem->datalen != 255)
++ break;
+ }
+
+- /* get non inheritance list if exists */
+- non_inherit_elem =
+- cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
+- sub_copy, subie_len);
++ return *pos - buf;
++}
+
+- /* go through IEs in ie (skip SSID) and subelement,
+- * merge them into new_ie
++static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
++ const u8 *subie, size_t subie_len,
++ u8 *new_ie, size_t new_ie_len)
++{
++ const struct element *non_inherit_elem, *parent, *sub;
++ u8 *pos = new_ie;
++ u8 id, ext_id;
++ unsigned int match_len;
++
++ non_inherit_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
++ subie, subie_len);
++
++ /* We copy the elements one by one from the parent to the generated
++ * elements.
++ * If they are not inherited (included in subie or in the non
++ * inheritance element), then we copy all occurrences the first time
++ * we see this element type.
+ */
+- tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
+- tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;
+-
+- while (tmp_old + 2 - ie <= ielen &&
+- tmp_old + tmp_old[1] + 2 - ie <= ielen) {
+- if (tmp_old[0] == 0) {
+- tmp_old++;
++ for_each_element(parent, ie, ielen) {
++ if (parent->id == WLAN_EID_FRAGMENT)
+ continue;
++
++ if (parent->id == WLAN_EID_EXTENSION) {
++ if (parent->datalen < 1)
++ continue;
++
++ id = WLAN_EID_EXTENSION;
++ ext_id = parent->data[0];
++ match_len = 1;
++ } else {
++ id = parent->id;
++ match_len = 0;
+ }
+
+- if (tmp_old[0] == WLAN_EID_EXTENSION)
+- tmp = (u8 *)cfg80211_find_ext_ie(tmp_old[2], sub_copy,
+- subie_len);
+- else
+- tmp = (u8 *)cfg80211_find_ie(tmp_old[0], sub_copy,
+- subie_len);
++ /* Find first occurrence in subie */
++ sub = cfg80211_find_elem_match(id, subie, subie_len,
++ &ext_id, match_len, 0);
+
+- if (!tmp) {
+- const struct element *old_elem = (void *)tmp_old;
++ /* Copy from parent if not in subie and inherited */
++ if (!sub &&
++ cfg80211_is_element_inherited(parent, non_inherit_elem)) {
++ if (!cfg80211_copy_elem_with_frags(parent,
++ ie, ielen,
++ &pos, new_ie,
++ new_ie_len))
++ return 0;
+
+- /* ie in old ie but not in subelement */
+- if (cfg80211_is_element_inherited(old_elem,
+- non_inherit_elem)) {
+- memcpy(pos, tmp_old, tmp_old[1] + 2);
+- pos += tmp_old[1] + 2;
+- }
+- } else {
+- /* ie in transmitting ie also in subelement,
+- * copy from subelement and flag the ie in subelement
+- * as copied (by setting eid field to WLAN_EID_SSID,
+- * which is skipped anyway).
+- * For vendor ie, compare OUI + type + subType to
+- * determine if they are the same ie.
+- */
+- if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) {
+- if (tmp_old[1] >= 5 && tmp[1] >= 5 &&
+- !memcmp(tmp_old + 2, tmp + 2, 5)) {
+- /* same vendor ie, copy from
+- * subelement
+- */
+- memcpy(pos, tmp, tmp[1] + 2);
+- pos += tmp[1] + 2;
+- tmp[0] = WLAN_EID_SSID;
+- } else {
+- memcpy(pos, tmp_old, tmp_old[1] + 2);
+- pos += tmp_old[1] + 2;
+- }
+- } else {
+- /* copy ie from subelement into new ie */
+- memcpy(pos, tmp, tmp[1] + 2);
+- pos += tmp[1] + 2;
+- tmp[0] = WLAN_EID_SSID;
+- }
++ continue;
+ }
+
+- if (tmp_old + tmp_old[1] + 2 - ie == ielen)
+- break;
++ /* Already copied if an earlier element had the same type */
++ if (cfg80211_find_elem_match(id, ie, (u8 *)parent - ie,
++ &ext_id, match_len, 0))
++ continue;
+
+- tmp_old += tmp_old[1] + 2;
++ /* Not inheriting, copy all similar elements from subie */
++ while (sub) {
++ if (!cfg80211_copy_elem_with_frags(sub,
++ subie, subie_len,
++ &pos, new_ie,
++ new_ie_len))
++ return 0;
++
++ sub = cfg80211_find_elem_match(id,
++ sub->data + sub->datalen,
++ subie_len + subie -
++ (sub->data +
++ sub->datalen),
++ &ext_id, match_len, 0);
++ }
+ }
+
+- /* go through subelement again to check if there is any ie not
+- * copied to new ie, skip ssid, capability, bssid-index ie
++ /* The above misses elements that are included in subie but not in the
++ * parent, so do a pass over subie and append those.
++ * Skip the non-tx BSSID caps and non-inheritance element.
+ */
+- tmp_new = sub_copy;
+- while (tmp_new + 2 - sub_copy <= subie_len &&
+- tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
+- if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||
+- tmp_new[0] == WLAN_EID_SSID)) {
+- memcpy(pos, tmp_new, tmp_new[1] + 2);
+- pos += tmp_new[1] + 2;
++ for_each_element(sub, subie, subie_len) {
++ if (sub->id == WLAN_EID_NON_TX_BSSID_CAP)
++ continue;
++
++ if (sub->id == WLAN_EID_FRAGMENT)
++ continue;
++
++ if (sub->id == WLAN_EID_EXTENSION) {
++ if (sub->datalen < 1)
++ continue;
++
++ id = WLAN_EID_EXTENSION;
++ ext_id = sub->data[0];
++ match_len = 1;
++
++ if (ext_id == WLAN_EID_EXT_NON_INHERITANCE)
++ continue;
++ } else {
++ id = sub->id;
++ match_len = 0;
+ }
+- if (tmp_new + tmp_new[1] + 2 - sub_copy == subie_len)
+- break;
+- tmp_new += tmp_new[1] + 2;
++
++ /* Processed if one was included in the parent */
++ if (cfg80211_find_elem_match(id, ie, ielen,
++ &ext_id, match_len, 0))
++ continue;
++
++ if (!cfg80211_copy_elem_with_frags(sub, subie, subie_len,
++ &pos, new_ie, new_ie_len))
++ return 0;
+ }
+
+- kfree(sub_copy);
+ return pos - new_ie;
+ }
+
+@@ -2224,7 +2259,7 @@ static void cfg80211_parse_mbssid_data(struct wiphy *wiphy,
+ new_ie_len = cfg80211_gen_new_ie(ie, ielen,
+ profile,
+ profile_len, new_ie,
+- gfp);
++ IEEE80211_MAX_DATA_LEN);
+ if (!new_ie_len)
+ continue;
+
+--
+2.39.2
+
--- /dev/null
+From b0b2a462d2de9cb2fa01554aaed326deddb9cc5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Jun 2023 21:49:45 +0300
+Subject: wifi: ieee80211: Fix the common size calculation for reconfiguration
+ ML
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit ce6e1f600b0cfc563a7d607de702262a58cd835d ]
+
+The common information length is found in the first octet of the common
+information.
+
+Fixes: 0f48b8b88aa9 ("wifi: ieee80211: add definitions for multi-link element")
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230618214435.3c7ed4817338.I42ef706cb827b4dade6e4ffbb6e7f341eaccd398@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/ieee80211.h | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index 470fafce2e707..870ae4cd82029 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -4575,15 +4575,12 @@ static inline u8 ieee80211_mle_common_size(const u8 *data)
+ case IEEE80211_ML_CONTROL_TYPE_BASIC:
+ case IEEE80211_ML_CONTROL_TYPE_PREQ:
+ case IEEE80211_ML_CONTROL_TYPE_TDLS:
++ case IEEE80211_ML_CONTROL_TYPE_RECONF:
+ /*
+ * The length is the first octet pointed by mle->variable so no
+ * need to add anything
+ */
+ break;
+- case IEEE80211_ML_CONTROL_TYPE_RECONF:
+- if (control & IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR)
+- common += ETH_ALEN;
+- return common;
+ case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:
+ if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR)
+ common += ETH_ALEN;
+--
+2.39.2
+
--- /dev/null
+From ed9b085aa3e0231daab016e369d62cb9227208e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 13:04:01 +0300
+Subject: wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 2db72b8a700943aa54dce0aabe6ff1b72b615162 ]
+
+We've already done the 'decryption' here, so tell
+mac80211 it need not do it again.
+
+Fixes: b1fdc2505abc ("iwlwifi: mvm: advertise BIGTK client support if available")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230620125813.a50cf68fbf2e.Ieceacbe3789d81ea02ae085ad8d1f8813a33c31b@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index 02c2a06301076..f268a31ce26d9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -296,7 +296,8 @@ static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm,
+ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ struct ieee80211_hdr *hdr,
+ struct iwl_rx_mpdu_desc *desc,
+- u32 status)
++ u32 status,
++ struct ieee80211_rx_status *stats)
+ {
+ struct iwl_mvm_sta *mvmsta;
+ struct iwl_mvm_vif *mvmvif;
+@@ -325,8 +326,10 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+
+ /* good cases */
+ if (likely(status & IWL_RX_MPDU_STATUS_MIC_OK &&
+- !(status & IWL_RX_MPDU_STATUS_REPLAY_ERROR)))
++ !(status & IWL_RX_MPDU_STATUS_REPLAY_ERROR))) {
++ stats->flag |= RX_FLAG_DECRYPTED;
+ return 0;
++ }
+
+ if (!sta)
+ return -1;
+@@ -395,7 +398,7 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+
+ if (unlikely(ieee80211_is_mgmt(hdr->frame_control) &&
+ !ieee80211_has_protected(hdr->frame_control)))
+- return iwl_mvm_rx_mgmt_prot(sta, hdr, desc, status);
++ return iwl_mvm_rx_mgmt_prot(sta, hdr, desc, status, stats);
+
+ if (!ieee80211_has_protected(hdr->frame_control) ||
+ (status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
+--
+2.39.2
+
--- /dev/null
+From 520946028e9e2e48e32e4a6aa6aca2e31a9db922 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 12:41:32 +0300
+Subject: wifi: iwlwifi: pcie: fix NULL pointer dereference in
+ iwl_pcie_irq_rx_msix_handler()
+
+From: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
+
+[ Upstream commit 1902f1953b8ba100ee8705cb8a6f1a9795550eca ]
+
+rxq can be NULL only when trans_pcie->rxq is NULL and entry->entry
+is zero. For the case when entry->entry is not equal to 0, rxq
+won't be NULL even if trans_pcie->rxq is NULL. Modify checker to
+check for trans_pcie->rxq.
+
+Fixes: abc599efa67b ("iwlwifi: pcie: don't crash when rx queues aren't allocated in interrupt")
+Signed-off-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230614123446.5a5eb3889a4a.I375a1d58f16b48cd2044e7b7caddae512d7c86fd@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index 9c9f87fe83777..b455e981faa1f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1620,14 +1620,14 @@ irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id)
+ struct msix_entry *entry = dev_id;
+ struct iwl_trans_pcie *trans_pcie = iwl_pcie_get_trans_pcie(entry);
+ struct iwl_trans *trans = trans_pcie->trans;
+- struct iwl_rxq *rxq = &trans_pcie->rxq[entry->entry];
++ struct iwl_rxq *rxq;
+
+ trace_iwlwifi_dev_irq_msix(trans->dev, entry, false, 0, 0);
+
+ if (WARN_ON(entry->entry >= trans->num_rx_queues))
+ return IRQ_NONE;
+
+- if (!rxq) {
++ if (!trans_pcie->rxq) {
+ if (net_ratelimit())
+ IWL_ERR(trans,
+ "[%d] Got MSI-X interrupt before we have Rx queues\n",
+@@ -1635,6 +1635,7 @@ irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id)
+ return IRQ_NONE;
+ }
+
++ rxq = &trans_pcie->rxq[entry->entry];
+ lock_map_acquire(&trans->sync_cmd_lockdep_map);
+ IWL_DEBUG_ISR(trans, "[%d] Got interrupt\n", entry->entry);
+
+--
+2.39.2
+
--- /dev/null
+From d16afe657d8d1dca0c3864389594c856910c58f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 12:41:22 +0300
+Subject: wifi: iwlwifi: pull from TXQs with softirqs disabled
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 96fb6f47db24a712d650b0a9b9074873f273fb0e ]
+
+In mac80211, it's required that we pull from TXQs by calling
+ieee80211_tx_dequeue() only with softirqs disabled. However,
+in iwl_mvm_queue_state_change() we're often called with them
+enabled, e.g. from flush if anything was flushed, triggering
+a mac80211 warning.
+
+Fix that by disabling the softirqs across the TX call.
+
+Fixes: cfbc6c4c5b91 ("iwlwifi: mvm: support mac80211 TXQs model")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230614123446.0feef7fa81db.I4dd62542d955b40dd8f0af34fa4accb9d0d17c7e@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+index 994f597a7102a..864f5fb260409 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+@@ -1686,8 +1686,11 @@ static void iwl_mvm_queue_state_change(struct iwl_op_mode *op_mode,
+ else
+ set_bit(IWL_MVM_TXQ_STATE_STOP_FULL, &mvmtxq->state);
+
+- if (start && mvmsta->sta_state != IEEE80211_STA_NOTEXIST)
++ if (start && mvmsta->sta_state != IEEE80211_STA_NOTEXIST) {
++ local_bh_disable();
+ iwl_mvm_mac_itxq_xmit(mvm->hw, txq);
++ local_bh_enable();
++ }
+ }
+
+ out:
+--
+2.39.2
+
--- /dev/null
+From 98f34c2163c86ff015e2e4a055cef5f91ee018c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jun 2023 12:14:28 +0300
+Subject: wifi: mac80211: Fix permissions for valid_links debugfs entry
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 4cacadc0dbd8013e6161aa8843d8e9d8ad435b47 ]
+
+The entry should be a read only one and not a write only one. Fix it.
+
+Fixes: 3d9011029227 ("wifi: mac80211: implement link switching")
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230611121219.c75316990411.I1565a7fcba8a37f83efffb0cc6b71c572b896e94@changeid
+[remove x16 change since it doesn't work yet]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/debugfs_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index 5b014786fd2d0..08a1d7564b7f2 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -694,7 +694,7 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
+ DEBUGFS_ADD_MODE(uapsd_queues, 0600);
+ DEBUGFS_ADD_MODE(uapsd_max_sp_len, 0600);
+ DEBUGFS_ADD_MODE(tdls_wider_bw, 0600);
+- DEBUGFS_ADD_MODE(valid_links, 0200);
++ DEBUGFS_ADD_MODE(valid_links, 0400);
+ DEBUGFS_ADD_MODE(active_links, 0600);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From fbc0bb7990ddc2c70fed9aa99fde8c864c22612b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 12:11:20 +0300
+Subject: wifi: mac80211: recalc min chandef for new STA links
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit ba7af2654e3b7b810c750b3c6106f6f20b81cc88 ]
+
+When adding a new link to a station, this needs to cause a
+recalculation of the minimum chandef since otherwise we can
+have a higher bandwidth station connected on that link than
+the link is operating at. Do the appropriate recalc.
+
+Fixes: cb71f1d136a6 ("wifi: mac80211: add sta link addition/removal")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230604120651.377adf3c789a.I91bf28f399e16e6ac1f83bacd1029a698b4e6685@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 30efa26f977f6..b8c6f6a668fc9 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2861,6 +2861,8 @@ int ieee80211_sta_activate_link(struct sta_info *sta, unsigned int link_id)
+ if (!test_sta_flag(sta, WLAN_STA_INSERTED))
+ goto hash;
+
++ ieee80211_recalc_min_chandef(sdata, link_id);
++
+ /* Ensure the values are updated for the driver,
+ * redone by sta_remove_link on failure.
+ */
+--
+2.39.2
+
--- /dev/null
+From fdde0e8e7d5b745d5cbed5e676f067976a07ce25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 15:26:48 +0200
+Subject: wifi: mac80211: Remove "Missing iftype sband data/EHT cap" spam
+
+From: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
+
+[ Upstream commit 6e21e7b8cd897193cee3c2649640efceb3004ba5 ]
+
+In mesh mode, ieee80211_chandef_he_6ghz_oper() is called by
+mesh_matches_local() for every received mesh beacon.
+
+On a 6 GHz mesh of a HE-only phy, this spams that the hardware does not
+have EHT capabilities, even if the received mesh beacon does not have an
+EHT element.
+
+Unlike HE, not supporting EHT in the 6 GHz band is not an error so do
+not print anything in this case.
+
+Fixes: 5dca295dd767 ("mac80211: Add initial support for EHT and 320 MHz channels")
+
+Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230614132648.28995-1-nicolas.cavallari@green-communications.fr
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/util.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 784b9ba61581e..98806c359b173 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -3599,10 +3599,8 @@ bool ieee80211_chandef_he_6ghz_oper(struct ieee80211_sub_if_data *sdata,
+ }
+
+ eht_cap = ieee80211_get_eht_iftype_cap(sband, iftype);
+- if (!eht_cap) {
+- sdata_info(sdata, "Missing iftype sband data/EHT cap");
++ if (!eht_cap)
+ eht_oper = NULL;
+- }
+
+ he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper);
+
+--
+2.39.2
+
--- /dev/null
+From fa8adf2bced6722c52e3be7353beabe157fec3bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 May 2023 15:53:15 +0200
+Subject: wifi: mwifiex: Fix the size of a memory allocation in
+ mwifiex_ret_802_11_scan()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit d9aef04fcfa81ee4fb2804a21a3712b7bbd936af ]
+
+The type of "mwifiex_adapter->nd_info" is "struct cfg80211_wowlan_nd_info",
+not "struct cfg80211_wowlan_nd_match".
+
+Use struct_size() to ease the computation of the needed size.
+
+The current code over-allocates some memory, so is safe.
+But it wastes 32 bytes.
+
+Fixes: 7d7f07d8c5d3 ("mwifiex: add wowlan net-detect support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/7a6074fb056d2181e058a3cc6048d8155c20aec7.1683371982.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/scan.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index ac8001c842935..644b1e134b01c 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -2187,9 +2187,9 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
+
+ if (nd_config) {
+ adapter->nd_info =
+- kzalloc(sizeof(struct cfg80211_wowlan_nd_match) +
+- sizeof(struct cfg80211_wowlan_nd_match *) *
+- scan_rsp->number_of_sets, GFP_ATOMIC);
++ kzalloc(struct_size(adapter->nd_info, matches,
++ scan_rsp->number_of_sets),
++ GFP_ATOMIC);
+
+ if (adapter->nd_info)
+ adapter->nd_info->n_matches = scan_rsp->number_of_sets;
+--
+2.39.2
+
--- /dev/null
+From 4872281dd6488e4149adb62fca6eb43f572c8807 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 May 2023 09:38:22 +0200
+Subject: wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 67a81d911c01225f426cc6bee2373df044c1a9b7 ]
+
+Should orinoco_cs_config() fail, some resources need to be released as
+already done in the remove function.
+
+While at it, remove a useless and erroneous comment. The probe is
+orinoco_cs_probe(), not orinoco_cs_attach().
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/e24735ce4d82901d5f7ea08419eea53bfdde3d65.1684568286.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intersil/orinoco/orinoco_cs.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c
+index a956f965a1e5e..03bfd2482656c 100644
+--- a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c
++++ b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c
+@@ -96,6 +96,7 @@ orinoco_cs_probe(struct pcmcia_device *link)
+ {
+ struct orinoco_private *priv;
+ struct orinoco_pccard *card;
++ int ret;
+
+ priv = alloc_orinocodev(sizeof(*card), &link->dev,
+ orinoco_cs_hard_reset, NULL);
+@@ -107,8 +108,16 @@ orinoco_cs_probe(struct pcmcia_device *link)
+ card->p_dev = link;
+ link->priv = priv;
+
+- return orinoco_cs_config(link);
+-} /* orinoco_cs_attach */
++ ret = orinoco_cs_config(link);
++ if (ret)
++ goto err_free_orinocodev;
++
++ return 0;
++
++err_free_orinocodev:
++ free_orinocodev(priv);
++ return ret;
++}
+
+ static void orinoco_cs_detach(struct pcmcia_device *link)
+ {
+--
+2.39.2
+
--- /dev/null
+From d170b4694b14cb2516b983b59a6b2f6668cc8683 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 May 2023 09:29:46 +0200
+Subject: wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 925244325159824385209e3e0e3f91fa6bf0646c ]
+
+Should spectrum_cs_config() fail, some resources need to be released as
+already done in the remove function.
+
+While at it, remove a useless and erroneous comment. The probe is
+spectrum_cs_probe(), not spectrum_cs_attach().
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/c0bc0c21c58ca477fc5521607615bafbf2aef8eb.1684567733.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intersil/orinoco/spectrum_cs.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c
+index 291ef97ed45ec..841d623c621ac 100644
+--- a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c
++++ b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c
+@@ -157,6 +157,7 @@ spectrum_cs_probe(struct pcmcia_device *link)
+ {
+ struct orinoco_private *priv;
+ struct orinoco_pccard *card;
++ int ret;
+
+ priv = alloc_orinocodev(sizeof(*card), &link->dev,
+ spectrum_cs_hard_reset,
+@@ -169,8 +170,16 @@ spectrum_cs_probe(struct pcmcia_device *link)
+ card->p_dev = link;
+ link->priv = priv;
+
+- return spectrum_cs_config(link);
+-} /* spectrum_cs_attach */
++ ret = spectrum_cs_config(link);
++ if (ret)
++ goto err_free_orinocodev;
++
++ return 0;
++
++err_free_orinocodev:
++ free_orinocodev(priv);
++ return ret;
++}
+
+ static void spectrum_cs_detach(struct pcmcia_device *link)
+ {
+--
+2.39.2
+
--- /dev/null
+From f25d01de9736c2123a556e9e9ba266199d225e1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 May 2023 10:13:22 +0200
+Subject: wifi: ray_cs: Fix an error handling path in ray_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 4f8d66a9fb2edcd05c1e563456a55a08910bfb37 ]
+
+Should ray_config() fail, some resources need to be released as already
+done in the remove function.
+
+While at it, remove a useless and erroneous comment. The probe is
+ray_probe(), not ray_attach().
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/8c544d18084f8b37dd108e844f7e79e85ff708ff.1684570373.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ray_cs.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
+index 1f57a0055bbd8..38782d4c4694a 100644
+--- a/drivers/net/wireless/ray_cs.c
++++ b/drivers/net/wireless/ray_cs.c
+@@ -270,13 +270,14 @@ static int ray_probe(struct pcmcia_device *p_dev)
+ {
+ ray_dev_t *local;
+ struct net_device *dev;
++ int ret;
+
+ dev_dbg(&p_dev->dev, "ray_attach()\n");
+
+ /* Allocate space for private device-specific data */
+ dev = alloc_etherdev(sizeof(ray_dev_t));
+ if (!dev)
+- goto fail_alloc_dev;
++ return -ENOMEM;
+
+ local = netdev_priv(dev);
+ local->finder = p_dev;
+@@ -313,11 +314,16 @@ static int ray_probe(struct pcmcia_device *p_dev)
+ timer_setup(&local->timer, NULL, 0);
+
+ this_device = p_dev;
+- return ray_config(p_dev);
++ ret = ray_config(p_dev);
++ if (ret)
++ goto err_free_dev;
++
++ return 0;
+
+-fail_alloc_dev:
+- return -ENOMEM;
+-} /* ray_attach */
++err_free_dev:
++ free_netdev(dev);
++ return ret;
++}
+
+ static void ray_detach(struct pcmcia_device *link)
+ {
+--
+2.39.2
+
--- /dev/null
+From 13e7c6d22371e4bbeff51b261155596150a79b1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 May 2023 00:28:33 +0200
+Subject: wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit b241e260820b68c09586e8a0ae0fc23c0e3215bd ]
+
+In case WoWlan was never configured during the operation of the system,
+the hw->wiphy->wowlan_config will be NULL. rsi_config_wowlan() checks
+whether wowlan_config is non-NULL and if it is not, then WARNs about it.
+The warning is valid, as during normal operation the rsi_config_wowlan()
+should only ever be called with non-NULL wowlan_config. In shutdown this
+rsi_config_wowlan() should only ever be called if WoWlan was configured
+before by the user.
+
+Add checks for non-NULL wowlan_config into the shutdown hook. While at it,
+check whether the wiphy is also non-NULL before accessing wowlan_config .
+Drop the single-use wowlan_config variable, just inline it into function
+call.
+
+Fixes: 16bbc3eb8372 ("rsi: fix null pointer dereference during rsi_shutdown()")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230527222833.273741-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_sdio.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+index d09998796ac08..6e33a2563fdbd 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -1463,10 +1463,8 @@ static void rsi_shutdown(struct device *dev)
+
+ rsi_dbg(ERR_ZONE, "SDIO Bus shutdown =====>\n");
+
+- if (hw) {
+- struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
+-
+- if (rsi_config_wowlan(adapter, wowlan))
++ if (hw && hw->wiphy && hw->wiphy->wowlan_config) {
++ if (rsi_config_wowlan(adapter, hw->wiphy->wowlan_config))
+ rsi_dbg(ERR_ZONE, "Failed to configure WoWLAN\n");
+ }
+
+--
+2.39.2
+
--- /dev/null
+From bb743190b0b80d807d85017b96c7e9e92bee1fdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 May 2023 00:28:59 +0200
+Subject: wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit e74f562328b03fbe9cf438f958464dff3a644dfc ]
+
+It makes no sense to set MMC_PM_KEEP_POWER in shutdown. The flag
+indicates to the MMC subsystem to keep the slot powered on during
+suspend, but in shutdown the slot should actually be powered off.
+Drop this call.
+
+Fixes: 063848c3e155 ("rsi: sdio: Add WOWLAN support for S5 shutdown state")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230527222859.273768-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_sdio.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+index 6e33a2563fdbd..1911fef3bbad6 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -1479,9 +1479,6 @@ static void rsi_shutdown(struct device *dev)
+ if (sdev->write_fail)
+ rsi_dbg(INFO_ZONE, "###### Device is not ready #######\n");
+
+- if (rsi_set_sdio_pm_caps(adapter))
+- rsi_dbg(INFO_ZONE, "Setting power management caps failed\n");
+-
+ rsi_dbg(INFO_ZONE, "***** RSI module shut down *****\n");
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 0b1c4f0c5f31e05b3cb8fb4554b9b76a5e9c66e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 18:10:20 +0000
+Subject: wifi: wilc1000: fix for absent RSN capabilities WFA testcase
+
+From: Amisha Patel <amisha.patel@microchip.com>
+
+[ Upstream commit 9ce4bb09123e9754996e358bd808d39f5d112899 ]
+
+Mandatory WFA testcase
+CT_Security_WPA2Personal_STA_RSNEBoundsVerification-AbsentRSNCap,
+performs bounds verfication on Beacon and/or Probe response frames. It
+failed and observed the reason to be absence of cipher suite and AKM
+suite in RSN information. To fix this, enable the RSN flag before extracting RSN
+capabilities.
+
+Fixes: cd21d99e595e ("wifi: wilc1000: validate pairwise and authentication suite offsets")
+Signed-off-by: Amisha Patel <amisha.patel@microchip.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230421181005.4865-1-amisha.patel@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/hif.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c
+index 67df8221b5aeb..a1b75feec6edf 100644
+--- a/drivers/net/wireless/microchip/wilc1000/hif.c
++++ b/drivers/net/wireless/microchip/wilc1000/hif.c
+@@ -485,6 +485,9 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ int rsn_ie_len = sizeof(struct element) + rsn_ie[1];
+ int offset = 8;
+
++ param->mode_802_11i = 2;
++ param->rsn_found = true;
++
+ /* extract RSN capabilities */
+ if (offset < rsn_ie_len) {
+ /* skip over pairwise suites */
+@@ -494,11 +497,8 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ /* skip over authentication suites */
+ offset += (rsn_ie[offset] * 4) + 2;
+
+- if (offset + 1 < rsn_ie_len) {
+- param->mode_802_11i = 2;
+- param->rsn_found = true;
++ if (offset + 1 < rsn_ie_len)
+ memcpy(param->rsn_cap, &rsn_ie[offset], 2);
+- }
+ }
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 31905dd9792205bcca60997d3f95badeb5f34206 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 May 2023 10:05:08 +0200
+Subject: wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 391af06a02e7642039ac5f6c4b2c034ab0992b5d ]
+
+Should wl3501_config() fail, some resources need to be released as already
+done in the remove function.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/7cc9c9316489b7d69b36aeb0edd3123538500b41.1684569865.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/wl3501_cs.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
+index 7fb2f95134760..c45c4b7cbbaf1 100644
+--- a/drivers/net/wireless/wl3501_cs.c
++++ b/drivers/net/wireless/wl3501_cs.c
+@@ -1862,6 +1862,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
+ {
+ struct net_device *dev;
+ struct wl3501_card *this;
++ int ret;
+
+ /* The io structure describes IO port mapping */
+ p_dev->resource[0]->end = 16;
+@@ -1873,8 +1874,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
+
+ dev = alloc_etherdev(sizeof(struct wl3501_card));
+ if (!dev)
+- goto out_link;
+-
++ return -ENOMEM;
+
+ dev->netdev_ops = &wl3501_netdev_ops;
+ dev->watchdog_timeo = 5 * HZ;
+@@ -1887,9 +1887,15 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
+ netif_stop_queue(dev);
+ p_dev->priv = dev;
+
+- return wl3501_config(p_dev);
+-out_link:
+- return -ENOMEM;
++ ret = wl3501_config(p_dev);
++ if (ret)
++ goto out_free_etherdev;
++
++ return 0;
++
++out_free_etherdev:
++ free_netdev(dev);
++ return ret;
+ }
+
+ static int wl3501_config(struct pcmcia_device *link)
+--
+2.39.2
+
--- /dev/null
+From 73a7788a3288bd71ad780326a7320681482a03be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 21:35:19 +0200
+Subject: x86/efi: Make efi_set_virtual_address_map IBT safe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 0303c9729afc4094ef53e552b7b8cff7436028d6 ]
+
+Niklāvs reported a boot regression on an Alderlake machine and bisected it
+to commit 9df9d2f0471b ("init: Invoke arch_cpu_finalize_init() earlier").
+
+By moving the invocation of arch_cpu_finalize_init() further down he
+identified that efi_enter_virtual_mode() is the function which causes the
+boot hang.
+
+The main difference of the earlier invocation is that the boot CPU is
+already fully initialized and mitigations and alternatives are applied.
+
+But the only really interesting change turned out to be IBT, which is now
+enabled before efi_enter_virtual_mode(). "ibt=off" on the kernel command
+line cured the problem.
+
+Inspection of the involved calls in efi_enter_virtual_mode() unearthed that
+efi_set_virtual_address_map() is the only place in the kernel which invokes
+an EFI call without the IBT safe wrapper. This went obviously unnoticed so
+far as IBT was enabled later.
+
+Use arch_efi_call_virt() instead of efi_call() to cure that.
+
+Fixes: fe379fa4d199 ("x86/ibt: Disable IBT around firmware")
+Fixes: 9df9d2f0471b ("init: Invoke arch_cpu_finalize_init() earlier")
+Reported-by: Niklāvs Koļesņikovs <pinkflames.linux@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217602
+Link: https://lore.kernel.org/r/87jzvm12q0.ffs@tglx
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/efi/efi_64.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index b36596bf0fc38..601908bdbeadc 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -847,9 +847,9 @@ efi_set_virtual_address_map(unsigned long memory_map_size,
+
+ /* Disable interrupts around EFI calls: */
+ local_irq_save(flags);
+- status = efi_call(efi.runtime->set_virtual_address_map,
+- memory_map_size, descriptor_size,
+- descriptor_version, virtual_map);
++ status = arch_efi_call_virt(efi.runtime, set_virtual_address_map,
++ memory_map_size, descriptor_size,
++ descriptor_version, virtual_map);
+ local_irq_restore(flags);
+
+ efi_fpu_end();
+--
+2.39.2
+
--- /dev/null
+From 53cb1bf92c13f0131705d4ab075f3a658585234d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 12:56:20 +0300
+Subject: x86/mm: Allow guest.enc_status_change_prepare() to fail
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit 3f6819dd192ef4f0c568ec3e9d6d408b3fa1ad3d ]
+
+TDX code is going to provide guest.enc_status_change_prepare() that is
+able to fail. TDX will use the call to convert the GPA range from shared
+to private. This operation can fail.
+
+Add a way to return an error from the callback.
+
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Link: https://lore.kernel.org/all/20230606095622.1939-2-kirill.shutemov%40linux.intel.com
+Stable-dep-of: 195edce08b63 ("x86/tdx: Fix race between set_memory_encrypted() and load_unaligned_zeropad()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/x86_init.h | 2 +-
+ arch/x86/kernel/x86_init.c | 2 +-
+ arch/x86/mm/mem_encrypt_amd.c | 4 +++-
+ arch/x86/mm/pat/set_memory.c | 3 ++-
+ 4 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
+index c1c8c581759d6..034e62838b284 100644
+--- a/arch/x86/include/asm/x86_init.h
++++ b/arch/x86/include/asm/x86_init.h
+@@ -150,7 +150,7 @@ struct x86_init_acpi {
+ * @enc_cache_flush_required Returns true if a cache flush is needed before changing page encryption status
+ */
+ struct x86_guest {
+- void (*enc_status_change_prepare)(unsigned long vaddr, int npages, bool enc);
++ bool (*enc_status_change_prepare)(unsigned long vaddr, int npages, bool enc);
+ bool (*enc_status_change_finish)(unsigned long vaddr, int npages, bool enc);
+ bool (*enc_tlb_flush_required)(bool enc);
+ bool (*enc_cache_flush_required)(void);
+diff --git a/arch/x86/kernel/x86_init.c b/arch/x86/kernel/x86_init.c
+index 10622cf2b30f4..41e5b4cb898c3 100644
+--- a/arch/x86/kernel/x86_init.c
++++ b/arch/x86/kernel/x86_init.c
+@@ -130,7 +130,7 @@ struct x86_cpuinit_ops x86_cpuinit = {
+
+ static void default_nmi_init(void) { };
+
+-static void enc_status_change_prepare_noop(unsigned long vaddr, int npages, bool enc) { }
++static bool enc_status_change_prepare_noop(unsigned long vaddr, int npages, bool enc) { return true; }
+ static bool enc_status_change_finish_noop(unsigned long vaddr, int npages, bool enc) { return false; }
+ static bool enc_tlb_flush_required_noop(bool enc) { return false; }
+ static bool enc_cache_flush_required_noop(void) { return false; }
+diff --git a/arch/x86/mm/mem_encrypt_amd.c b/arch/x86/mm/mem_encrypt_amd.c
+index 9c4d8dbcb1296..ff6c0462beee7 100644
+--- a/arch/x86/mm/mem_encrypt_amd.c
++++ b/arch/x86/mm/mem_encrypt_amd.c
+@@ -319,7 +319,7 @@ static void enc_dec_hypercall(unsigned long vaddr, int npages, bool enc)
+ #endif
+ }
+
+-static void amd_enc_status_change_prepare(unsigned long vaddr, int npages, bool enc)
++static bool amd_enc_status_change_prepare(unsigned long vaddr, int npages, bool enc)
+ {
+ /*
+ * To maintain the security guarantees of SEV-SNP guests, make sure
+@@ -327,6 +327,8 @@ static void amd_enc_status_change_prepare(unsigned long vaddr, int npages, bool
+ */
+ if (cc_platform_has(CC_ATTR_GUEST_SEV_SNP) && !enc)
+ snp_set_memory_shared(vaddr, npages);
++
++ return true;
+ }
+
+ /* Return true unconditionally: return value doesn't matter for the SEV side */
+diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
+index 2e5a045731dec..5f0ce77a259d8 100644
+--- a/arch/x86/mm/pat/set_memory.c
++++ b/arch/x86/mm/pat/set_memory.c
+@@ -2096,7 +2096,8 @@ static int __set_memory_enc_pgtable(unsigned long addr, int numpages, bool enc)
+ cpa_flush(&cpa, x86_platform.guest.enc_cache_flush_required());
+
+ /* Notify hypervisor that we are about to set/clr encryption attribute. */
+- x86_platform.guest.enc_status_change_prepare(addr, numpages, enc);
++ if (!x86_platform.guest.enc_status_change_prepare(addr, numpages, enc))
++ return -EIO;
+
+ ret = __change_page_attr_set_clr(&cpa, 1);
+
+--
+2.39.2
+
--- /dev/null
+From 8e6c372f5adb72d55b8a43e616c23f0b3a29aee5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 13:32:59 +0100
+Subject: x86/mm: Fix __swp_entry_to_pte() for Xen PV guests
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit 0f88130e8a6fd185b0aeb5d8e286083735f2585a ]
+
+Normally __swp_entry_to_pte() is never called with a value translating
+to a valid PTE. The only known exception is pte_swap_tests(), resulting
+in a WARN splat in Xen PV guests, as __pte_to_swp_entry() did
+translate the PFN of the valid PTE to a guest local PFN, while
+__swp_entry_to_pte() doesn't do the opposite translation.
+
+Fix that by using __pte() in __swp_entry_to_pte() instead of open
+coding the native variant of it.
+
+For correctness do the similar conversion for __swp_entry_to_pmd().
+
+Fixes: 05289402d717 ("mm/debug_vm_pgtable: add tests validating arch helpers for core MM features")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230306123259.12461-1-jgross@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/pgtable_64.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
+index e479491da8d51..07cd53eeec770 100644
+--- a/arch/x86/include/asm/pgtable_64.h
++++ b/arch/x86/include/asm/pgtable_64.h
+@@ -237,8 +237,8 @@ static inline void native_pgd_clear(pgd_t *pgd)
+
+ #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val((pte)) })
+ #define __pmd_to_swp_entry(pmd) ((swp_entry_t) { pmd_val((pmd)) })
+-#define __swp_entry_to_pte(x) ((pte_t) { .pte = (x).val })
+-#define __swp_entry_to_pmd(x) ((pmd_t) { .pmd = (x).val })
++#define __swp_entry_to_pte(x) (__pte((x).val))
++#define __swp_entry_to_pmd(x) (__pmd((x).val))
+
+ extern int kern_addr_valid(unsigned long addr);
+ extern void cleanup_highmap(void);
+--
+2.39.2
+
--- /dev/null
+From e055ce0e7a15c475c14e010a1023ae33fb03d8ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 14:04:48 +0800
+Subject: x86/resctrl: Only show tasks' pid in current pid namespace
+
+From: Shawn Wang <shawnwang@linux.alibaba.com>
+
+[ Upstream commit 2997d94b5dd0e8b10076f5e0b6f18410c73e28bd ]
+
+When writing a task id to the "tasks" file in an rdtgroup,
+rdtgroup_tasks_write() treats the pid as a number in the current pid
+namespace. But when reading the "tasks" file, rdtgroup_tasks_show() shows
+the list of global pids from the init namespace, which is confusing and
+incorrect.
+
+To be more robust, let the "tasks" file only show pids in the current pid
+namespace.
+
+Fixes: e02737d5b826 ("x86/intel_rdt: Add tasks files")
+Signed-off-by: Shawn Wang <shawnwang@linux.alibaba.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Acked-by: Reinette Chatre <reinette.chatre@intel.com>
+Acked-by: Fenghua Yu <fenghua.yu@intel.com>
+Tested-by: Reinette Chatre <reinette.chatre@intel.com>
+Link: https://lore.kernel.org/all/20230116071246.97717-1-shawnwang@linux.alibaba.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/resctrl/rdtgroup.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
+index c7f1c7cb1963b..15ee89ce8c68c 100644
+--- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c
++++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
+@@ -731,11 +731,15 @@ static ssize_t rdtgroup_tasks_write(struct kernfs_open_file *of,
+ static void show_rdt_tasks(struct rdtgroup *r, struct seq_file *s)
+ {
+ struct task_struct *p, *t;
++ pid_t pid;
+
+ rcu_read_lock();
+ for_each_process_thread(p, t) {
+- if (is_closid_match(t, r) || is_rmid_match(t, r))
+- seq_printf(s, "%d\n", t->pid);
++ if (is_closid_match(t, r) || is_rmid_match(t, r)) {
++ pid = task_pid_vnr(t);
++ if (pid)
++ seq_printf(s, "%d\n", pid);
++ }
+ }
+ rcu_read_unlock();
+ }
+--
+2.39.2
+
--- /dev/null
+From 3f2cdcd9eb0b614e0dd46b64603c24e89581bc5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 09:51:22 -0500
+Subject: x86/sev: Fix calculation of end address based on number of pages
+
+From: Tom Lendacky <thomas.lendacky@amd.com>
+
+[ Upstream commit 5dee19b6b2b194216919b99a1f5af2949a754016 ]
+
+When calculating an end address based on an unsigned int number of pages,
+any value greater than or equal to 0x100000 that is shift PAGE_SHIFT bits
+results in a 0 value, resulting in an invalid end address. Change the
+number of pages variable in various routines from an unsigned int to an
+unsigned long to calculate the end address correctly.
+
+Fixes: 5e5ccff60a29 ("x86/sev: Add helper for validating pages in early enc attribute changes")
+Fixes: dc3f3d2474b8 ("x86/mm: Validate memory when changing the C-bit")
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/6a6e4eea0e1414402bac747744984fa4e9c01bb6.1686063086.git.thomas.lendacky@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/sev.h | 16 ++++++++--------
+ arch/x86/kernel/sev.c | 14 +++++++-------
+ 2 files changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h
+index ebc271bb6d8ed..a0a58c4122ec3 100644
+--- a/arch/x86/include/asm/sev.h
++++ b/arch/x86/include/asm/sev.h
+@@ -187,12 +187,12 @@ static inline int pvalidate(unsigned long vaddr, bool rmp_psize, bool validate)
+ }
+ void setup_ghcb(void);
+ void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr,
+- unsigned int npages);
++ unsigned long npages);
+ void __init early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr,
+- unsigned int npages);
++ unsigned long npages);
+ void __init snp_prep_memory(unsigned long paddr, unsigned int sz, enum psc_op op);
+-void snp_set_memory_shared(unsigned long vaddr, unsigned int npages);
+-void snp_set_memory_private(unsigned long vaddr, unsigned int npages);
++void snp_set_memory_shared(unsigned long vaddr, unsigned long npages);
++void snp_set_memory_private(unsigned long vaddr, unsigned long npages);
+ void snp_set_wakeup_secondary_cpu(void);
+ bool snp_init(struct boot_params *bp);
+ void __init __noreturn snp_abort(void);
+@@ -207,12 +207,12 @@ static inline int pvalidate(unsigned long vaddr, bool rmp_psize, bool validate)
+ static inline int rmpadjust(unsigned long vaddr, bool rmp_psize, unsigned long attrs) { return 0; }
+ static inline void setup_ghcb(void) { }
+ static inline void __init
+-early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr, unsigned int npages) { }
++early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr, unsigned long npages) { }
+ static inline void __init
+-early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr, unsigned int npages) { }
++early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr, unsigned long npages) { }
+ static inline void __init snp_prep_memory(unsigned long paddr, unsigned int sz, enum psc_op op) { }
+-static inline void snp_set_memory_shared(unsigned long vaddr, unsigned int npages) { }
+-static inline void snp_set_memory_private(unsigned long vaddr, unsigned int npages) { }
++static inline void snp_set_memory_shared(unsigned long vaddr, unsigned long npages) { }
++static inline void snp_set_memory_private(unsigned long vaddr, unsigned long npages) { }
+ static inline void snp_set_wakeup_secondary_cpu(void) { }
+ static inline bool snp_init(struct boot_params *bp) { return false; }
+ static inline void snp_abort(void) { }
+diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c
+index c680ac6342bb3..afda719dd7253 100644
+--- a/arch/x86/kernel/sev.c
++++ b/arch/x86/kernel/sev.c
+@@ -643,7 +643,7 @@ static u64 __init get_jump_table_addr(void)
+ return ret;
+ }
+
+-static void pvalidate_pages(unsigned long vaddr, unsigned int npages, bool validate)
++static void pvalidate_pages(unsigned long vaddr, unsigned long npages, bool validate)
+ {
+ unsigned long vaddr_end;
+ int rc;
+@@ -660,7 +660,7 @@ static void pvalidate_pages(unsigned long vaddr, unsigned int npages, bool valid
+ }
+ }
+
+-static void __init early_set_pages_state(unsigned long paddr, unsigned int npages, enum psc_op op)
++static void __init early_set_pages_state(unsigned long paddr, unsigned long npages, enum psc_op op)
+ {
+ unsigned long paddr_end;
+ u64 val;
+@@ -699,7 +699,7 @@ static void __init early_set_pages_state(unsigned long paddr, unsigned int npage
+ }
+
+ void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr,
+- unsigned int npages)
++ unsigned long npages)
+ {
+ /*
+ * This can be invoked in early boot while running identity mapped, so
+@@ -721,7 +721,7 @@ void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long padd
+ }
+
+ void __init early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr,
+- unsigned int npages)
++ unsigned long npages)
+ {
+ /*
+ * This can be invoked in early boot while running identity mapped, so
+@@ -877,7 +877,7 @@ static void __set_pages_state(struct snp_psc_desc *data, unsigned long vaddr,
+ sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_PSC);
+ }
+
+-static void set_pages_state(unsigned long vaddr, unsigned int npages, int op)
++static void set_pages_state(unsigned long vaddr, unsigned long npages, int op)
+ {
+ unsigned long vaddr_end, next_vaddr;
+ struct snp_psc_desc *desc;
+@@ -902,7 +902,7 @@ static void set_pages_state(unsigned long vaddr, unsigned int npages, int op)
+ kfree(desc);
+ }
+
+-void snp_set_memory_shared(unsigned long vaddr, unsigned int npages)
++void snp_set_memory_shared(unsigned long vaddr, unsigned long npages)
+ {
+ if (!cc_platform_has(CC_ATTR_GUEST_SEV_SNP))
+ return;
+@@ -912,7 +912,7 @@ void snp_set_memory_shared(unsigned long vaddr, unsigned int npages)
+ set_pages_state(vaddr, npages, SNP_PAGE_STATE_SHARED);
+ }
+
+-void snp_set_memory_private(unsigned long vaddr, unsigned int npages)
++void snp_set_memory_private(unsigned long vaddr, unsigned long npages)
+ {
+ if (!cc_platform_has(CC_ATTR_GUEST_SEV_SNP))
+ return;
+--
+2.39.2
+
--- /dev/null
+From 037f4660780f57ae22f37ad939c4497f1ddff5b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 12:56:21 +0300
+Subject: x86/tdx: Fix race between set_memory_encrypted() and
+ load_unaligned_zeropad()
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit 195edce08b63d293377f615f4f7f086715d2d212 ]
+
+tl;dr: There is a race in the TDX private<=>shared conversion code
+ which could kill the TDX guest. Fix it by changing conversion
+ ordering to eliminate the window.
+
+TDX hardware maintains metadata to track which pages are private and
+shared. Additionally, TDX guests use the guest x86 page tables to
+specify whether a given mapping is intended to be private or shared.
+Bad things happen when the intent and metadata do not match.
+
+So there are two thing in play:
+ 1. "the page" -- the physical TDX page metadata
+ 2. "the mapping" -- the guest-controlled x86 page table intent
+
+For instance, an unrecoverable exit to VMM occurs if a guest touches a
+private mapping that points to a shared physical page.
+
+In summary:
+ * Private mapping => Private Page == OK (obviously)
+ * Shared mapping => Shared Page == OK (obviously)
+ * Private mapping => Shared Page == BIG BOOM!
+ * Shared mapping => Private Page == OK-ish
+ (It will read generate a recoverable #VE via handle_mmio())
+
+Enter load_unaligned_zeropad(). It can touch memory that is adjacent but
+otherwise unrelated to the memory it needs to touch. It will cause one
+of those unrecoverable exits (aka. BIG BOOM) if it blunders into a
+shared mapping pointing to a private page.
+
+This is a problem when __set_memory_enc_pgtable() converts pages from
+shared to private. It first changes the mapping and second modifies
+the TDX page metadata. It's moving from:
+
+ * Shared mapping => Shared Page == OK
+to:
+ * Private mapping => Shared Page == BIG BOOM!
+
+This means that there is a window with a shared mapping pointing to a
+private page where load_unaligned_zeropad() can strike.
+
+Add a TDX handler for guest.enc_status_change_prepare(). This converts
+the page from shared to private *before* the page becomes private. This
+ensures that there is never a private mapping to a shared page.
+
+Leave a guest.enc_status_change_finish() in place but only use it for
+private=>shared conversions. This will delay updating the TDX metadata
+marking the page private until *after* the mapping matches the metadata.
+This also ensures that there is never a private mapping to a shared page.
+
+[ dhansen: rewrite changelog ]
+
+Fixes: 7dbde7631629 ("x86/mm/cpa: Add support for TDX shared memory")
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Link: https://lore.kernel.org/all/20230606095622.1939-3-kirill.shutemov%40linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/coco/tdx/tdx.c | 51 ++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 48 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
+index b8998cf0508a6..8a1d48b8c2a3e 100644
+--- a/arch/x86/coco/tdx/tdx.c
++++ b/arch/x86/coco/tdx/tdx.c
+@@ -756,6 +756,30 @@ static bool tdx_enc_status_changed(unsigned long vaddr, int numpages, bool enc)
+ return true;
+ }
+
++static bool tdx_enc_status_change_prepare(unsigned long vaddr, int numpages,
++ bool enc)
++{
++ /*
++ * Only handle shared->private conversion here.
++ * See the comment in tdx_early_init().
++ */
++ if (enc)
++ return tdx_enc_status_changed(vaddr, numpages, enc);
++ return true;
++}
++
++static bool tdx_enc_status_change_finish(unsigned long vaddr, int numpages,
++ bool enc)
++{
++ /*
++ * Only handle private->shared conversion here.
++ * See the comment in tdx_early_init().
++ */
++ if (!enc)
++ return tdx_enc_status_changed(vaddr, numpages, enc);
++ return true;
++}
++
+ void __init tdx_early_init(void)
+ {
+ u64 cc_mask;
+@@ -780,9 +804,30 @@ void __init tdx_early_init(void)
+ */
+ physical_mask &= cc_mask - 1;
+
+- x86_platform.guest.enc_cache_flush_required = tdx_cache_flush_required;
+- x86_platform.guest.enc_tlb_flush_required = tdx_tlb_flush_required;
+- x86_platform.guest.enc_status_change_finish = tdx_enc_status_changed;
++ /*
++ * The kernel mapping should match the TDX metadata for the page.
++ * load_unaligned_zeropad() can touch memory *adjacent* to that which is
++ * owned by the caller and can catch even _momentary_ mismatches. Bad
++ * things happen on mismatch:
++ *
++ * - Private mapping => Shared Page == Guest shutdown
++ * - Shared mapping => Private Page == Recoverable #VE
++ *
++ * guest.enc_status_change_prepare() converts the page from
++ * shared=>private before the mapping becomes private.
++ *
++ * guest.enc_status_change_finish() converts the page from
++ * private=>shared after the mapping becomes private.
++ *
++ * In both cases there is a temporary shared mapping to a private page,
++ * which can result in a #VE. But, there is never a private mapping to
++ * a shared page.
++ */
++ x86_platform.guest.enc_status_change_prepare = tdx_enc_status_change_prepare;
++ x86_platform.guest.enc_status_change_finish = tdx_enc_status_change_finish;
++
++ x86_platform.guest.enc_cache_flush_required = tdx_cache_flush_required;
++ x86_platform.guest.enc_tlb_flush_required = tdx_tlb_flush_required;
+
+ pr_info("Guest detected\n");
+ }
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
