--- /dev/null
+From 196aad37b0a3b77b0e3ccae9b24345b35a94b725 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Aug 2023 10:52:13 +0800
+Subject: ALSA: ac97: Fix possible error value of *rac97
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 67de40c9df94037769967ba28c7d951afb45b7fb ]
+
+Before committing 79597c8bf64c, *rac97 always be NULL if there is
+an error. When error happens, make sure *rac97 is NULL is safer.
+
+For examble, in snd_vortex_mixer():
+ err = snd_ac97_mixer(pbus, &ac97, &vortex->codec);
+ vortex->isquad = ((vortex->codec == NULL) ?
+ 0 : (vortex->codec->ext_id&0x80));
+If error happened but vortex->codec isn't NULL, this may cause some
+problems.
+
+Move the judgement order to be clearer and better.
+
+Fixes: 79597c8bf64c ("ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer")
+Suggested-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Link: https://lore.kernel.org/r/20230823025212.1000961-1-suhui@nfschina.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/ac97/ac97_codec.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
+index 3f13666a01904..64a1bd4206379 100644
+--- a/sound/pci/ac97/ac97_codec.c
++++ b/sound/pci/ac97/ac97_codec.c
+@@ -2026,10 +2026,9 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
+ .dev_disconnect = snd_ac97_dev_disconnect,
+ };
+
+- if (!rac97)
+- return -EINVAL;
+- if (snd_BUG_ON(!bus || !template))
++ if (snd_BUG_ON(!bus || !template || !rac97))
+ return -EINVAL;
++ *rac97 = NULL;
+ if (snd_BUG_ON(template->num >= 4))
+ return -EINVAL;
+ if (bus->codec[template->num])
+--
+2.40.1
+
--- /dev/null
+From d8c40eb6014fa59d6531e06aae14b8175b47d4dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Aug 2023 10:39:27 +0800
+Subject: amba: bus: fix refcount leak
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit e312cbdc11305568554a9e18a2ea5c2492c183f3 ]
+
+commit 5de1540b7bc4 ("drivers/amba: create devices from device tree")
+increases the refcount of of_node, but not releases it in
+amba_device_release, so there is refcount leak. By using of_node_put
+to avoid refcount leak.
+
+Fixes: 5de1540b7bc4 ("drivers/amba: create devices from device tree")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20230821023928.3324283-1-peng.fan@oss.nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/amba/bus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
+index e1992f361c9a6..2aaec96f83849 100644
+--- a/drivers/amba/bus.c
++++ b/drivers/amba/bus.c
+@@ -349,6 +349,7 @@ static void amba_device_release(struct device *dev)
+ {
+ struct amba_device *d = to_amba_device(dev);
+
++ of_node_put(d->dev.of_node);
+ if (d->res.parent)
+ release_resource(&d->res);
+ kfree(d);
+--
+2.40.1
+
--- /dev/null
+From ce4ce9b04615d766635f92104df33388dcefa45f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2019 23:22:37 +0100
+Subject: arch: um: drivers: Kconfig: pedantic formatting
+
+From: Enrico Weigelt, metux IT consult <info@metux.net>
+
+[ Upstream commit 75f24f78721048a271e2e50a563f51bcfd6f5c1c ]
+
+Formatting of Kconfig files doesn't look so pretty, so just
+take damp cloth and clean it up. Just indention changes.
+
+Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Stable-dep-of: db4bfcba7bb8 ("um: Fix hostaudio build errors")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/Kconfig | 352 ++++++++++++++++++++--------------------
+ 1 file changed, 176 insertions(+), 176 deletions(-)
+
+diff --git a/arch/um/drivers/Kconfig b/arch/um/drivers/Kconfig
+index 2b1aaf7755aac..2638e46f50ccd 100644
+--- a/arch/um/drivers/Kconfig
++++ b/arch/um/drivers/Kconfig
+@@ -11,58 +11,58 @@ config STDERR_CONSOLE
+ config SSL
+ bool "Virtual serial line"
+ help
+- The User-Mode Linux environment allows you to create virtual serial
+- lines on the UML that are usually made to show up on the host as
+- ttys or ptys.
++ The User-Mode Linux environment allows you to create virtual serial
++ lines on the UML that are usually made to show up on the host as
++ ttys or ptys.
+
+- See <http://user-mode-linux.sourceforge.net/old/input.html> for more
+- information and command line examples of how to use this facility.
++ See <http://user-mode-linux.sourceforge.net/old/input.html> for more
++ information and command line examples of how to use this facility.
+
+- Unless you have a specific reason for disabling this, say Y.
++ Unless you have a specific reason for disabling this, say Y.
+
+ config NULL_CHAN
+ bool "null channel support"
+ help
+- This option enables support for attaching UML consoles and serial
+- lines to a device similar to /dev/null. Data written to it disappears
+- and there is never any data to be read.
++ This option enables support for attaching UML consoles and serial
++ lines to a device similar to /dev/null. Data written to it disappears
++ and there is never any data to be read.
+
+ config PORT_CHAN
+ bool "port channel support"
+ help
+- This option enables support for attaching UML consoles and serial
+- lines to host portals. They may be accessed with 'telnet <host>
+- <port number>'. Any number of consoles and serial lines may be
+- attached to a single portal, although what UML device you get when
+- you telnet to that portal will be unpredictable.
+- It is safe to say 'Y' here.
++ This option enables support for attaching UML consoles and serial
++ lines to host portals. They may be accessed with 'telnet <host>
++ <port number>'. Any number of consoles and serial lines may be
++ attached to a single portal, although what UML device you get when
++ you telnet to that portal will be unpredictable.
++ It is safe to say 'Y' here.
+
+ config PTY_CHAN
+ bool "pty channel support"
+ help
+- This option enables support for attaching UML consoles and serial
+- lines to host pseudo-terminals. Access to both traditional
+- pseudo-terminals (/dev/pty*) and pts pseudo-terminals are controlled
+- with this option. The assignment of UML devices to host devices
+- will be announced in the kernel message log.
+- It is safe to say 'Y' here.
++ This option enables support for attaching UML consoles and serial
++ lines to host pseudo-terminals. Access to both traditional
++ pseudo-terminals (/dev/pty*) and pts pseudo-terminals are controlled
++ with this option. The assignment of UML devices to host devices
++ will be announced in the kernel message log.
++ It is safe to say 'Y' here.
+
+ config TTY_CHAN
+ bool "tty channel support"
+ help
+- This option enables support for attaching UML consoles and serial
+- lines to host terminals. Access to both virtual consoles
+- (/dev/tty*) and the slave side of pseudo-terminals (/dev/ttyp* and
+- /dev/pts/*) are controlled by this option.
+- It is safe to say 'Y' here.
++ This option enables support for attaching UML consoles and serial
++ lines to host terminals. Access to both virtual consoles
++ (/dev/tty*) and the slave side of pseudo-terminals (/dev/ttyp* and
++ /dev/pts/*) are controlled by this option.
++ It is safe to say 'Y' here.
+
+ config XTERM_CHAN
+ bool "xterm channel support"
+ help
+- This option enables support for attaching UML consoles and serial
+- lines to xterms. Each UML device so assigned will be brought up in
+- its own xterm.
+- It is safe to say 'Y' here.
++ This option enables support for attaching UML consoles and serial
++ lines to xterms. Each UML device so assigned will be brought up in
++ its own xterm.
++ It is safe to say 'Y' here.
+
+ config NOCONFIG_CHAN
+ bool
+@@ -72,43 +72,43 @@ config CON_ZERO_CHAN
+ string "Default main console channel initialization"
+ default "fd:0,fd:1"
+ help
+- This is the string describing the channel to which the main console
+- will be attached by default. This value can be overridden from the
+- command line. The default value is "fd:0,fd:1", which attaches the
+- main console to stdin and stdout.
+- It is safe to leave this unchanged.
++ This is the string describing the channel to which the main console
++ will be attached by default. This value can be overridden from the
++ command line. The default value is "fd:0,fd:1", which attaches the
++ main console to stdin and stdout.
++ It is safe to leave this unchanged.
+
+ config CON_CHAN
+ string "Default console channel initialization"
+ default "xterm"
+ help
+- This is the string describing the channel to which all consoles
+- except the main console will be attached by default. This value can
+- be overridden from the command line. The default value is "xterm",
+- which brings them up in xterms.
+- It is safe to leave this unchanged, although you may wish to change
+- this if you expect the UML that you build to be run in environments
+- which don't have X or xterm available.
++ This is the string describing the channel to which all consoles
++ except the main console will be attached by default. This value can
++ be overridden from the command line. The default value is "xterm",
++ which brings them up in xterms.
++ It is safe to leave this unchanged, although you may wish to change
++ this if you expect the UML that you build to be run in environments
++ which don't have X or xterm available.
+
+ config SSL_CHAN
+ string "Default serial line channel initialization"
+ default "pty"
+ help
+- This is the string describing the channel to which the serial lines
+- will be attached by default. This value can be overridden from the
+- command line. The default value is "pty", which attaches them to
+- traditional pseudo-terminals.
+- It is safe to leave this unchanged, although you may wish to change
+- this if you expect the UML that you build to be run in environments
+- which don't have a set of /dev/pty* devices.
++ This is the string describing the channel to which the serial lines
++ will be attached by default. This value can be overridden from the
++ command line. The default value is "pty", which attaches them to
++ traditional pseudo-terminals.
++ It is safe to leave this unchanged, although you may wish to change
++ this if you expect the UML that you build to be run in environments
++ which don't have a set of /dev/pty* devices.
+
+ config UML_SOUND
+ tristate "Sound support"
+ help
+- This option enables UML sound support. If enabled, it will pull in
+- soundcore and the UML hostaudio relay, which acts as a intermediary
+- between the host's dsp and mixer devices and the UML sound system.
+- It is safe to say 'Y' here.
++ This option enables UML sound support. If enabled, it will pull in
++ soundcore and the UML hostaudio relay, which acts as a intermediary
++ between the host's dsp and mixer devices and the UML sound system.
++ It is safe to say 'Y' here.
+
+ config SOUND
+ tristate
+@@ -131,107 +131,107 @@ menu "UML Network Devices"
+ config UML_NET
+ bool "Virtual network device"
+ help
+- While the User-Mode port cannot directly talk to any physical
+- hardware devices, this choice and the following transport options
+- provide one or more virtual network devices through which the UML
+- kernels can talk to each other, the host, and with the host's help,
+- machines on the outside world.
++ While the User-Mode port cannot directly talk to any physical
++ hardware devices, this choice and the following transport options
++ provide one or more virtual network devices through which the UML
++ kernels can talk to each other, the host, and with the host's help,
++ machines on the outside world.
+
+- For more information, including explanations of the networking and
+- sample configurations, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html>.
++ For more information, including explanations of the networking and
++ sample configurations, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html>.
+
+- If you'd like to be able to enable networking in the User-Mode
+- linux environment, say Y; otherwise say N. Note that you must
+- enable at least one of the following transport options to actually
+- make use of UML networking.
++ If you'd like to be able to enable networking in the User-Mode
++ linux environment, say Y; otherwise say N. Note that you must
++ enable at least one of the following transport options to actually
++ make use of UML networking.
+
+ config UML_NET_ETHERTAP
+ bool "Ethertap transport"
+ depends on UML_NET
+ help
+- The Ethertap User-Mode Linux network transport allows a single
+- running UML to exchange packets with its host over one of the
+- host's Ethertap devices, such as /dev/tap0. Additional running
+- UMLs can use additional Ethertap devices, one per running UML.
+- While the UML believes it's on a (multi-device, broadcast) virtual
+- Ethernet network, it's in fact communicating over a point-to-point
+- link with the host.
+-
+- To use this, your host kernel must have support for Ethertap
+- devices. Also, if your host kernel is 2.4.x, it must have
+- CONFIG_NETLINK_DEV configured as Y or M.
+-
+- For more information, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html> That site
+- has examples of the UML command line to use to enable Ethertap
+- networking.
+-
+- If you'd like to set up an IP network with the host and/or the
+- outside world, say Y to this, the Daemon Transport and/or the
+- Slip Transport. You'll need at least one of them, but may choose
+- more than one without conflict. If you don't need UML networking,
+- say N.
++ The Ethertap User-Mode Linux network transport allows a single
++ running UML to exchange packets with its host over one of the
++ host's Ethertap devices, such as /dev/tap0. Additional running
++ UMLs can use additional Ethertap devices, one per running UML.
++ While the UML believes it's on a (multi-device, broadcast) virtual
++ Ethernet network, it's in fact communicating over a point-to-point
++ link with the host.
++
++ To use this, your host kernel must have support for Ethertap
++ devices. Also, if your host kernel is 2.4.x, it must have
++ CONFIG_NETLINK_DEV configured as Y or M.
++
++ For more information, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html> That site
++ has examples of the UML command line to use to enable Ethertap
++ networking.
++
++ If you'd like to set up an IP network with the host and/or the
++ outside world, say Y to this, the Daemon Transport and/or the
++ Slip Transport. You'll need at least one of them, but may choose
++ more than one without conflict. If you don't need UML networking,
++ say N.
+
+ config UML_NET_TUNTAP
+ bool "TUN/TAP transport"
+ depends on UML_NET
+ help
+- The UML TUN/TAP network transport allows a UML instance to exchange
+- packets with the host over a TUN/TAP device. This option will only
+- work with a 2.4 host, unless you've applied the TUN/TAP patch to
+- your 2.2 host kernel.
++ The UML TUN/TAP network transport allows a UML instance to exchange
++ packets with the host over a TUN/TAP device. This option will only
++ work with a 2.4 host, unless you've applied the TUN/TAP patch to
++ your 2.2 host kernel.
+
+- To use this transport, your host kernel must have support for TUN/TAP
+- devices, either built-in or as a module.
++ To use this transport, your host kernel must have support for TUN/TAP
++ devices, either built-in or as a module.
+
+ config UML_NET_SLIP
+ bool "SLIP transport"
+ depends on UML_NET
+ help
+- The slip User-Mode Linux network transport allows a running UML to
+- network with its host over a point-to-point link. Unlike Ethertap,
+- which can carry any Ethernet frame (and hence even non-IP packets),
+- the slip transport can only carry IP packets.
+-
+- To use this, your host must support slip devices.
+-
+- For more information, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html>.
+- has examples of the UML command line to use to enable slip
+- networking, and details of a few quirks with it.
+-
+- The Ethertap Transport is preferred over slip because of its
+- limitations. If you prefer slip, however, say Y here. Otherwise
+- choose the Multicast transport (to network multiple UMLs on
+- multiple hosts), Ethertap (to network with the host and the
+- outside world), and/or the Daemon transport (to network multiple
+- UMLs on a single host). You may choose more than one without
+- conflict. If you don't need UML networking, say N.
++ The slip User-Mode Linux network transport allows a running UML to
++ network with its host over a point-to-point link. Unlike Ethertap,
++ which can carry any Ethernet frame (and hence even non-IP packets),
++ the slip transport can only carry IP packets.
++
++ To use this, your host must support slip devices.
++
++ For more information, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html>.
++ has examples of the UML command line to use to enable slip
++ networking, and details of a few quirks with it.
++
++ The Ethertap Transport is preferred over slip because of its
++ limitations. If you prefer slip, however, say Y here. Otherwise
++ choose the Multicast transport (to network multiple UMLs on
++ multiple hosts), Ethertap (to network with the host and the
++ outside world), and/or the Daemon transport (to network multiple
++ UMLs on a single host). You may choose more than one without
++ conflict. If you don't need UML networking, say N.
+
+ config UML_NET_DAEMON
+ bool "Daemon transport"
+ depends on UML_NET
+ help
+- This User-Mode Linux network transport allows one or more running
+- UMLs on a single host to communicate with each other, but not to
+- the host.
+-
+- To use this form of networking, you'll need to run the UML
+- networking daemon on the host.
+-
+- For more information, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html> That site
+- has examples of the UML command line to use to enable Daemon
+- networking.
+-
+- If you'd like to set up a network with other UMLs on a single host,
+- say Y. If you need a network between UMLs on multiple physical
+- hosts, choose the Multicast Transport. To set up a network with
+- the host and/or other IP machines, say Y to the Ethertap or Slip
+- transports. You'll need at least one of them, but may choose
+- more than one without conflict. If you don't need UML networking,
+- say N.
++ This User-Mode Linux network transport allows one or more running
++ UMLs on a single host to communicate with each other, but not to
++ the host.
++
++ To use this form of networking, you'll need to run the UML
++ networking daemon on the host.
++
++ For more information, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html> That site
++ has examples of the UML command line to use to enable Daemon
++ networking.
++
++ If you'd like to set up a network with other UMLs on a single host,
++ say Y. If you need a network between UMLs on multiple physical
++ hosts, choose the Multicast Transport. To set up a network with
++ the host and/or other IP machines, say Y to the Ethertap or Slip
++ transports. You'll need at least one of them, but may choose
++ more than one without conflict. If you don't need UML networking,
++ say N.
+
+ config UML_NET_VECTOR
+ bool "Vector I/O high performance network devices"
+@@ -270,26 +270,26 @@ config UML_NET_MCAST
+ bool "Multicast transport"
+ depends on UML_NET
+ help
+- This Multicast User-Mode Linux network transport allows multiple
+- UMLs (even ones running on different host machines!) to talk to
+- each other over a virtual ethernet network. However, it requires
+- at least one UML with one of the other transports to act as a
+- bridge if any of them need to be able to talk to their hosts or any
+- other IP machines.
+-
+- To use this, your host kernel(s) must support IP Multicasting.
+-
+- For more information, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html> That site
+- has examples of the UML command line to use to enable Multicast
+- networking, and notes about the security of this approach.
+-
+- If you need UMLs on multiple physical hosts to communicate as if
+- they shared an Ethernet network, say Y. If you need to communicate
+- with other IP machines, make sure you select one of the other
+- transports (possibly in addition to Multicast; they're not
+- exclusive). If you don't need to network UMLs say N to each of
+- the transports.
++ This Multicast User-Mode Linux network transport allows multiple
++ UMLs (even ones running on different host machines!) to talk to
++ each other over a virtual ethernet network. However, it requires
++ at least one UML with one of the other transports to act as a
++ bridge if any of them need to be able to talk to their hosts or any
++ other IP machines.
++
++ To use this, your host kernel(s) must support IP Multicasting.
++
++ For more information, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html> That site
++ has examples of the UML command line to use to enable Multicast
++ networking, and notes about the security of this approach.
++
++ If you need UMLs on multiple physical hosts to communicate as if
++ they shared an Ethernet network, say Y. If you need to communicate
++ with other IP machines, make sure you select one of the other
++ transports (possibly in addition to Multicast; they're not
++ exclusive). If you don't need to network UMLs say N to each of
++ the transports.
+
+ config UML_NET_PCAP
+ bool "pcap transport"
+@@ -300,9 +300,9 @@ config UML_NET_PCAP
+ UML act as a network monitor for the host. You must have libcap
+ installed in order to build the pcap transport into UML.
+
+- For more information, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html> That site
+- has examples of the UML command line to use to enable this option.
++ For more information, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html> That site
++ has examples of the UML command line to use to enable this option.
+
+ If you intend to use UML as a network monitor for the host, say
+ Y here. Otherwise, say N.
+@@ -311,27 +311,27 @@ config UML_NET_SLIRP
+ bool "SLiRP transport"
+ depends on UML_NET
+ help
+- The SLiRP User-Mode Linux network transport allows a running UML
+- to network by invoking a program that can handle SLIP encapsulated
+- packets. This is commonly (but not limited to) the application
+- known as SLiRP, a program that can re-socket IP packets back onto
+- the host on which it is run. Only IP packets are supported,
+- unlike other network transports that can handle all Ethernet
+- frames. In general, slirp allows the UML the same IP connectivity
+- to the outside world that the host user is permitted, and unlike
+- other transports, SLiRP works without the need of root level
+- privleges, setuid binaries, or SLIP devices on the host. This
+- also means not every type of connection is possible, but most
+- situations can be accommodated with carefully crafted slirp
+- commands that can be passed along as part of the network device's
+- setup string. The effect of this transport on the UML is similar
+- that of a host behind a firewall that masquerades all network
+- connections passing through it (but is less secure).
+-
+- To use this you should first have slirp compiled somewhere
+- accessible on the host, and have read its documentation. If you
+- don't need UML networking, say N.
+-
+- Startup example: "eth0=slirp,FE:FD:01:02:03:04,/usr/local/bin/slirp"
++ The SLiRP User-Mode Linux network transport allows a running UML
++ to network by invoking a program that can handle SLIP encapsulated
++ packets. This is commonly (but not limited to) the application
++ known as SLiRP, a program that can re-socket IP packets back onto
++ he host on which it is run. Only IP packets are supported,
++ unlike other network transports that can handle all Ethernet
++ frames. In general, slirp allows the UML the same IP connectivity
++ to the outside world that the host user is permitted, and unlike
++ other transports, SLiRP works without the need of root level
++ privleges, setuid binaries, or SLIP devices on the host. This
++ also means not every type of connection is possible, but most
++ situations can be accommodated with carefully crafted slirp
++ commands that can be passed along as part of the network device's
++ setup string. The effect of this transport on the UML is similar
++ that of a host behind a firewall that masquerades all network
++ connections passing through it (but is less secure).
++
++ To use this you should first have slirp compiled somewhere
++ accessible on the host, and have read its documentation. If you
++ don't need UML networking, say N.
++
++ Startup example: "eth0=slirp,FE:FD:01:02:03:04,/usr/local/bin/slirp"
+
+ endmenu
+--
+2.40.1
+
--- /dev/null
+From 138011b8c6453a010208aa86df2ffc9206893b11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Oct 2020 14:59:37 +0300
+Subject: ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name
+
+From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+
+[ Upstream commit 74abbfe99f43eb7466d26d9e48fbeb46b8f3d804 ]
+
+In accordance with the Generic EHCI/OHCI bindings the corresponding node
+name is suppose to comply with the Generic USB HCD DT schema, which
+requires the USB nodes to have the name acceptable by the regexp:
+"^usb(@.*)?" . Make sure the "generic-ehci" and "generic-ohci"-compatible
+nodes are correctly named.
+
+Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Stable-dep-of: 05d2c3d552b8 ("ARM: dts: BCM53573: Drop nonexistent #usb-cells")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm5301x.dtsi | 4 ++--
+ arch/arm/boot/dts/bcm53573.dtsi | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index a6406a347690e..c331217ce21b3 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -260,7 +260,7 @@ usb2: usb2@21000 {
+
+ interrupt-parent = <&gic>;
+
+- ehci: ehci@21000 {
++ ehci: usb@21000 {
+ #usb-cells = <0>;
+
+ compatible = "generic-ehci";
+@@ -282,7 +282,7 @@ ehci_port2: port@2 {
+ };
+ };
+
+- ohci: ohci@22000 {
++ ohci: usb@22000 {
+ #usb-cells = <0>;
+
+ compatible = "generic-ohci";
+diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
+index 453a2a37dabd3..d38f103db8a64 100644
+--- a/arch/arm/boot/dts/bcm53573.dtsi
++++ b/arch/arm/boot/dts/bcm53573.dtsi
+@@ -135,7 +135,7 @@ usb2: usb2@4000 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+- ehci: ehci@4000 {
++ ehci: usb@4000 {
+ compatible = "generic-ehci";
+ reg = <0x4000 0x1000>;
+ interrupt-parent = <&gic>;
+@@ -155,7 +155,7 @@ ehci_port2: port@2 {
+ };
+ };
+
+- ohci: ohci@d000 {
++ ohci: usb@d000 {
+ #usb-cells = <0>;
+
+ compatible = "generic-ohci";
+--
+2.40.1
+
--- /dev/null
+From 2e0bcfb9ef1f2fe437dc59016e537b8dd7a9c9e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jul 2023 13:40:03 +0200
+Subject: ARM: dts: BCM53573: Add cells sizes to PCIe node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 3392ef368d9b04622fe758b1079b512664b6110a ]
+
+This fixes:
+arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: pcie@2000: '#address-cells' is a required property
+ From schema: /lib/python3.10/site-packages/dtschema/schemas/pci/pci-bus.yaml
+arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: pcie@2000: '#size-cells' is a required property
+ From schema: /lib/python3.10/site-packages/dtschema/schemas/pci/pci-bus.yaml
+
+Two properties that need to be added later are "device_type" and
+"ranges". Adding "device_type" on its own causes a new warning and the
+value of "ranges" needs to be determined yet.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20230707114004.2740-3-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm53573.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
+index c065d6348c015..e44694800052d 100644
+--- a/arch/arm/boot/dts/bcm53573.dtsi
++++ b/arch/arm/boot/dts/bcm53573.dtsi
+@@ -127,6 +127,9 @@ uart0: serial@300 {
+
+ pcie0: pcie@2000 {
+ reg = <0x00002000 0x1000>;
++
++ #address-cells = <3>;
++ #size-cells = <2>;
+ };
+
+ usb2: usb2@4000 {
+--
+2.40.1
+
--- /dev/null
+From f1c3768c5a1e0139593665ffc97c01bcfc103d56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Sep 2021 16:10:23 +0200
+Subject: ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 9fb90ae6cae7f8fe4fbf626945f32cd9da2c3892 ]
+
+BCM53573 family SoC have Ethernet switch connected to the first Ethernet
+controller (accessible over MDIO).
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Stable-dep-of: 05d2c3d552b8 ("ARM: dts: BCM53573: Drop nonexistent #usb-cells")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm53573.dtsi | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
+index d38f103db8a64..5aef9fd651049 100644
+--- a/arch/arm/boot/dts/bcm53573.dtsi
++++ b/arch/arm/boot/dts/bcm53573.dtsi
+@@ -180,6 +180,24 @@ ohci_port2: port@2 {
+
+ gmac0: ethernet@5000 {
+ reg = <0x5000 0x1000>;
++
++ mdio {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ switch: switch@1e {
++ compatible = "brcm,bcm53125";
++ reg = <0x1e>;
++
++ status = "disabled";
++
++ /* ports are defined in board DTS */
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++ };
++ };
++ };
+ };
+
+ gmac1: ethernet@b000 {
+--
+2.40.1
+
--- /dev/null
+From 9aa8ac3e546061348c8349523a237934fbe36aa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jul 2023 13:40:02 +0200
+Subject: ARM: dts: BCM53573: Drop nonexistent #usb-cells
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 05d2c3d552b8c92fc397377d9d1112fc58e2cd59 ]
+
+Such property simply doesn't exist (is not documented or used anywhere).
+
+This fixes:
+arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: usb@d000: Unevaluated properties are not allowed ('#usb-cells' was unexpected)
+ From schema: Documentation/devicetree/bindings/usb/generic-ohci.yaml
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20230707114004.2740-2-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm53573.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
+index 5aef9fd651049..c065d6348c015 100644
+--- a/arch/arm/boot/dts/bcm53573.dtsi
++++ b/arch/arm/boot/dts/bcm53573.dtsi
+@@ -156,8 +156,6 @@ ehci_port2: port@2 {
+ };
+
+ ohci: usb@d000 {
+- #usb-cells = <0>;
+-
+ compatible = "generic-ohci";
+ reg = <0xd000 0x1000>;
+ interrupt-parent = <&gic>;
+--
+2.40.1
+
--- /dev/null
+From 7286b127d8e24061e1002a25d6b6b135066847fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jul 2023 13:11:45 +0200
+Subject: ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 44ad8207806973f4e4f7d870fff36cc01f494250 ]
+
+Both Luxul's XAP devices (XAP-810 and XAP-1440) are access points that
+use a non-default design. They don't include switch but have a single
+Ethernet port and BCM54210E PHY connected to the Ethernet controller's
+MDIO bus.
+
+Support for those devices regressed due to two changes:
+
+1. Describing MDIO bus with switch
+After commit 9fb90ae6cae7 ("ARM: dts: BCM53573: Describe on-SoC BCM53125
+rev 4 switch") Linux stopped probing for MDIO devices.
+
+2. Dropping hardcoded BCM54210E delays
+In commit fea7fda7f50a ("net: phy: broadcom: Fix RGMII delays
+configuration for BCM54210E") support for other PHY modes was added but
+that requires a proper "phy-mode" value in DT.
+
+Both above changes are correct (they don't need to be reverted or
+anything) but they need this fix for DT data to be correct and for Linux
+to work properly.
+
+Fixes: 9fb90ae6cae7 ("ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20230713111145.14864-1-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 13 +++++++++++++
+ arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 13 +++++++++++++
+ 2 files changed, 26 insertions(+)
+
+diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
+index 74c83b0ca54e0..bb7dc00a71e06 100644
+--- a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
+@@ -48,3 +48,16 @@ restart {
+ };
+ };
+ };
++
++&gmac0 {
++ phy-mode = "rgmii";
++ phy-handle = <&bcm54210e>;
++
++ mdio {
++ /delete-node/ switch@1e;
++
++ bcm54210e: ethernet-phy@0 {
++ reg = <0>;
++ };
++ };
++};
+diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
+index 214df18f3a754..6561e3b81b606 100644
+--- a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
+@@ -85,3 +85,16 @@ pcie0_chipcommon: chipcommon@0 {
+ };
+ };
+ };
++
++&gmac0 {
++ phy-mode = "rgmii";
++ phy-handle = <&bcm54210e>;
++
++ mdio {
++ /delete-node/ switch@1e;
++
++ bcm54210e: ethernet-phy@0 {
++ reg = <0>;
++ };
++ };
++};
+--
+2.40.1
+
--- /dev/null
+From e221958f49a7dd58661028ee7a81152fff62f51f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jul 2023 13:40:04 +0200
+Subject: ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 2c0fd6b3d0778ceab40205315ccef74568490f17 ]
+
+Switch away from deprecated properties.
+
+This fixes:
+arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-sck: False schema does not allow [[3, 21, 0]]
+ From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml
+arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-miso: False schema does not allow [[3, 22, 0]]
+ From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml
+arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-mosi: False schema does not allow [[3, 23, 0]]
+ From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml
+arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: 'sck-gpios' is a required property
+ From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml
+arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: Unevaluated properties are not allowed ('gpio-miso', 'gpio-mosi', 'gpio-sck' were unexpected)
+ From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20230707114004.2740-4-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm947189acdbmr.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/bcm947189acdbmr.dts b/arch/arm/boot/dts/bcm947189acdbmr.dts
+index ef263412fea51..02c916bedd281 100644
+--- a/arch/arm/boot/dts/bcm947189acdbmr.dts
++++ b/arch/arm/boot/dts/bcm947189acdbmr.dts
+@@ -61,9 +61,9 @@ wps {
+ spi {
+ compatible = "spi-gpio";
+ num-chipselects = <1>;
+- gpio-sck = <&chipcommon 21 0>;
+- gpio-miso = <&chipcommon 22 0>;
+- gpio-mosi = <&chipcommon 23 0>;
++ sck-gpios = <&chipcommon 21 0>;
++ miso-gpios = <&chipcommon 22 0>;
++ mosi-gpios = <&chipcommon 23 0>;
+ cs-gpios = <&chipcommon 24 0>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+--
+2.40.1
+
--- /dev/null
+From faff396bc18148025233ba94b4065efbdbe777c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Sep 2020 20:33:06 +0200
+Subject: ARM: dts: s3c6410: align node SROM bus node name with dtschema in
+ Mini6410
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 5911622eff5134c4bf1e16e4e1e2fd18c4f24889 ]
+
+The SROM controller is modeled with a bus so align the device node name
+with dtschema to fix warning:
+
+ srom-cs1@18000000: $nodename:0: 'srom-cs1@18000000'
+ does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20200907183313.29234-5-krzk@kernel.org
+Stable-dep-of: cf0cb2af6a18 ("ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/s3c6410-mini6410.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts
+index 75067dbcf7e83..285555b9ed943 100644
+--- a/arch/arm/boot/dts/s3c6410-mini6410.dts
++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts
+@@ -42,7 +42,7 @@ xusbxti: oscillator-1 {
+ #clock-cells = <0>;
+ };
+
+- srom-cs1@18000000 {
++ srom-cs1-bus@18000000 {
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+--
+2.40.1
+
--- /dev/null
+From 0af3c121364d61226937290685c5c342b5c82444 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Sep 2020 20:33:04 +0200
+Subject: ARM: dts: s3c6410: move fixed clocks under root node in Mini6410
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 8b81a8decea77bf2ca3c718732184d4aaf949096 ]
+
+The fixed clocks are kept under dedicated 'clocks' node but this causes
+multiple dtschema warnings:
+
+ clocks: $nodename:0: 'clocks' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
+ clocks: #size-cells:0:0: 0 is not one of [1, 2]
+ clocks: oscillator@0:reg:0: [0] is too short
+ clocks: oscillator@1:reg:0: [1] is too short
+ clocks: 'ranges' is a required property
+ oscillator@0: 'reg' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20200907183313.29234-3-krzk@kernel.org
+Stable-dep-of: cf0cb2af6a18 ("ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/s3c6410-mini6410.dts | 30 ++++++++++----------------
+ 1 file changed, 11 insertions(+), 19 deletions(-)
+
+diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts
+index 1aeac33b0d341..75067dbcf7e83 100644
+--- a/arch/arm/boot/dts/s3c6410-mini6410.dts
++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts
+@@ -28,26 +28,18 @@ chosen {
+ bootargs = "console=ttySAC0,115200n8 earlyprintk rootwait root=/dev/mmcblk0p1";
+ };
+
+- clocks {
+- compatible = "simple-bus";
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- fin_pll: oscillator@0 {
+- compatible = "fixed-clock";
+- reg = <0>;
+- clock-frequency = <12000000>;
+- clock-output-names = "fin_pll";
+- #clock-cells = <0>;
+- };
++ fin_pll: oscillator-0 {
++ compatible = "fixed-clock";
++ clock-frequency = <12000000>;
++ clock-output-names = "fin_pll";
++ #clock-cells = <0>;
++ };
+
+- xusbxti: oscillator@1 {
+- compatible = "fixed-clock";
+- reg = <1>;
+- clock-output-names = "xusbxti";
+- clock-frequency = <48000000>;
+- #clock-cells = <0>;
+- };
++ xusbxti: oscillator-1 {
++ compatible = "fixed-clock";
++ clock-output-names = "xusbxti";
++ clock-frequency = <48000000>;
++ #clock-cells = <0>;
+ };
+
+ srom-cs1@18000000 {
+--
+2.40.1
+
--- /dev/null
+From 6b74987de8f599020496f7b965de2b427a73eee4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jan 2022 21:17:16 +0100
+Subject: ARM: dts: s3c64xx: align pinctrl with dtschema
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit 9e47ccc01284aba7fe5fbf6ee2a7abc29bf2a740 ]
+
+Align the pin controller related nodes with dtschema. No functional
+change expected.
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/20220111201722.327219-16-krzysztof.kozlowski@canonical.com
+Stable-dep-of: cf0cb2af6a18 ("ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/s3c6410-mini6410.dts | 4 +-
+ arch/arm/boot/dts/s3c64xx-pinctrl.dtsi | 210 ++++++++++++-------------
+ 2 files changed, 107 insertions(+), 107 deletions(-)
+
+diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts
+index 285555b9ed943..17097da36f5ed 100644
+--- a/arch/arm/boot/dts/s3c6410-mini6410.dts
++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts
+@@ -193,12 +193,12 @@ &uart3 {
+ };
+
+ &pinctrl0 {
+- gpio_leds: gpio-leds {
++ gpio_leds: gpio-leds-pins {
+ samsung,pins = "gpk-4", "gpk-5", "gpk-6", "gpk-7";
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- gpio_keys: gpio-keys {
++ gpio_keys: gpio-keys-pins {
+ samsung,pins = "gpn-0", "gpn-1", "gpn-2", "gpn-3",
+ "gpn-4", "gpn-5", "gpl-11", "gpl-12";
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+diff --git a/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi b/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi
+index 8e9594d64b579..0a3186d57cb56 100644
+--- a/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi
++++ b/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi
+@@ -16,111 +16,111 @@ &pinctrl0 {
+ * Pin banks
+ */
+
+- gpa: gpa {
++ gpa: gpa-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpb: gpb {
++ gpb: gpb-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpc: gpc {
++ gpc: gpc-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpd: gpd {
++ gpd: gpd-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpe: gpe {
++ gpe: gpe-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ };
+
+- gpf: gpf {
++ gpf: gpf-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpg: gpg {
++ gpg: gpg-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gph: gph {
++ gph: gph-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpi: gpi {
++ gpi: gpi-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ };
+
+- gpj: gpj {
++ gpj: gpj-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ };
+
+- gpk: gpk {
++ gpk: gpk-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ };
+
+- gpl: gpl {
++ gpl: gpl-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpm: gpm {
++ gpm: gpm-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpn: gpn {
++ gpn: gpn-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpo: gpo {
++ gpo: gpo-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpp: gpp {
++ gpp: gpp-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpq: gpq {
++ gpq: gpq-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+@@ -131,225 +131,225 @@ gpq: gpq {
+ * Pin groups
+ */
+
+- uart0_data: uart0-data {
++ uart0_data: uart0-data-pins {
+ samsung,pins = "gpa-0", "gpa-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- uart0_fctl: uart0-fctl {
++ uart0_fctl: uart0-fctl-pins {
+ samsung,pins = "gpa-2", "gpa-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- uart1_data: uart1-data {
++ uart1_data: uart1-data-pins {
+ samsung,pins = "gpa-4", "gpa-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- uart1_fctl: uart1-fctl {
++ uart1_fctl: uart1-fctl-pins {
+ samsung,pins = "gpa-6", "gpa-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- uart2_data: uart2-data {
++ uart2_data: uart2-data-pins {
+ samsung,pins = "gpb-0", "gpb-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- uart3_data: uart3-data {
++ uart3_data: uart3-data-pins {
+ samsung,pins = "gpb-2", "gpb-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- ext_dma_0: ext-dma-0 {
++ ext_dma_0: ext-dma-0-pins {
+ samsung,pins = "gpb-0", "gpb-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- ext_dma_1: ext-dma-1 {
++ ext_dma_1: ext-dma-1-pins {
+ samsung,pins = "gpb-2", "gpb-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- irda_data_0: irda-data-0 {
++ irda_data_0: irda-data-0-pins {
+ samsung,pins = "gpb-0", "gpb-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- irda_data_1: irda-data-1 {
++ irda_data_1: irda-data-1-pins {
+ samsung,pins = "gpb-2", "gpb-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- irda_sdbw: irda-sdbw {
++ irda_sdbw: irda-sdbw-pins {
+ samsung,pins = "gpb-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2c0_bus: i2c0-bus {
++ i2c0_bus: i2c0-bus-pins {
+ samsung,pins = "gpb-5", "gpb-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- i2c1_bus: i2c1-bus {
++ i2c1_bus: i2c1-bus-pins {
+ /* S3C6410-only */
+ samsung,pins = "gpb-2", "gpb-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_6>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- spi0_bus: spi0-bus {
++ spi0_bus: spi0-bus-pins {
+ samsung,pins = "gpc-0", "gpc-1", "gpc-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- spi0_cs: spi0-cs {
++ spi0_cs: spi0-cs-pins {
+ samsung,pins = "gpc-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- spi1_bus: spi1-bus {
++ spi1_bus: spi1-bus-pins {
+ samsung,pins = "gpc-4", "gpc-5", "gpc-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- spi1_cs: spi1-cs {
++ spi1_cs: spi1-cs-pins {
+ samsung,pins = "gpc-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd0_cmd: sd0-cmd {
++ sd0_cmd: sd0-cmd-pins {
+ samsung,pins = "gpg-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd0_clk: sd0-clk {
++ sd0_clk: sd0-clk-pins {
+ samsung,pins = "gpg-0";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd0_bus1: sd0-bus1 {
++ sd0_bus1: sd0-bus1-pins {
+ samsung,pins = "gpg-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd0_bus4: sd0-bus4 {
++ sd0_bus4: sd0-bus4-pins {
+ samsung,pins = "gpg-2", "gpg-3", "gpg-4", "gpg-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd0_cd: sd0-cd {
++ sd0_cd: sd0-cd-pins {
+ samsung,pins = "gpg-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- sd1_cmd: sd1-cmd {
++ sd1_cmd: sd1-cmd-pins {
+ samsung,pins = "gph-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd1_clk: sd1-clk {
++ sd1_clk: sd1-clk-pins {
+ samsung,pins = "gph-0";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd1_bus1: sd1-bus1 {
++ sd1_bus1: sd1-bus1-pins {
+ samsung,pins = "gph-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd1_bus4: sd1-bus4 {
++ sd1_bus4: sd1-bus4-pins {
+ samsung,pins = "gph-2", "gph-3", "gph-4", "gph-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd1_bus8: sd1-bus8 {
++ sd1_bus8: sd1-bus8-pins {
+ samsung,pins = "gph-2", "gph-3", "gph-4", "gph-5",
+ "gph-6", "gph-7", "gph-8", "gph-9";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd1_cd: sd1-cd {
++ sd1_cd: sd1-cd-pins {
+ samsung,pins = "gpg-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- sd2_cmd: sd2-cmd {
++ sd2_cmd: sd2-cmd-pins {
+ samsung,pins = "gpc-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd2_clk: sd2-clk {
++ sd2_clk: sd2-clk-pins {
+ samsung,pins = "gpc-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd2_bus1: sd2-bus1 {
++ sd2_bus1: sd2-bus1-pins {
+ samsung,pins = "gph-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd2_bus4: sd2-bus4 {
++ sd2_bus4: sd2-bus4-pins {
+ samsung,pins = "gph-6", "gph-7", "gph-8", "gph-9";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s0_bus: i2s0-bus {
++ i2s0_bus: i2s0-bus-pins {
+ samsung,pins = "gpd-0", "gpd-2", "gpd-3", "gpd-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s0_cdclk: i2s0-cdclk {
++ i2s0_cdclk: i2s0-cdclk-pins {
+ samsung,pins = "gpd-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s1_bus: i2s1-bus {
++ i2s1_bus: i2s1-bus-pins {
+ samsung,pins = "gpe-0", "gpe-2", "gpe-3", "gpe-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s1_cdclk: i2s1-cdclk {
++ i2s1_cdclk: i2s1-cdclk-pins {
+ samsung,pins = "gpe-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s2_bus: i2s2-bus {
++ i2s2_bus: i2s2-bus-pins {
+ /* S3C6410-only */
+ samsung,pins = "gpc-4", "gpc-5", "gpc-6", "gph-6",
+ "gph-8", "gph-9";
+@@ -357,50 +357,50 @@ i2s2_bus: i2s2-bus {
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s2_cdclk: i2s2-cdclk {
++ i2s2_cdclk: i2s2-cdclk-pins {
+ /* S3C6410-only */
+ samsung,pins = "gph-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_5>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pcm0_bus: pcm0-bus {
++ pcm0_bus: pcm0-bus-pins {
+ samsung,pins = "gpd-0", "gpd-2", "gpd-3", "gpd-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pcm0_extclk: pcm0-extclk {
++ pcm0_extclk: pcm0-extclk-pins {
+ samsung,pins = "gpd-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pcm1_bus: pcm1-bus {
++ pcm1_bus: pcm1-bus-pins {
+ samsung,pins = "gpe-0", "gpe-2", "gpe-3", "gpe-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pcm1_extclk: pcm1-extclk {
++ pcm1_extclk: pcm1-extclk-pins {
+ samsung,pins = "gpe-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- ac97_bus_0: ac97-bus-0 {
++ ac97_bus_0: ac97-bus-0-pins {
+ samsung,pins = "gpd-0", "gpd-1", "gpd-2", "gpd-3", "gpd-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- ac97_bus_1: ac97-bus-1 {
++ ac97_bus_1: ac97-bus-1-pins {
+ samsung,pins = "gpe-0", "gpe-1", "gpe-2", "gpe-3", "gpe-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- cam_port: cam-port {
++ cam_port: cam-port-pins {
+ samsung,pins = "gpf-0", "gpf-1", "gpf-2", "gpf-4",
+ "gpf-5", "gpf-6", "gpf-7", "gpf-8",
+ "gpf-9", "gpf-10", "gpf-11", "gpf-12";
+@@ -408,242 +408,242 @@ cam_port: cam-port {
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- cam_rst: cam-rst {
++ cam_rst: cam-rst-pins {
+ samsung,pins = "gpf-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- cam_field: cam-field {
++ cam_field: cam-field-pins {
+ /* S3C6410-only */
+ samsung,pins = "gpb-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pwm_extclk: pwm-extclk {
++ pwm_extclk: pwm-extclk-pins {
+ samsung,pins = "gpf-13";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pwm0_out: pwm0-out {
++ pwm0_out: pwm0-out-pins {
+ samsung,pins = "gpf-14";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pwm1_out: pwm1-out {
++ pwm1_out: pwm1-out-pins {
+ samsung,pins = "gpf-15";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- clkout0: clkout-0 {
++ clkout0: clkout-0-pins {
+ samsung,pins = "gpf-14";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col0_0: keypad-col0-0 {
++ keypad_col0_0: keypad-col0-0-pins {
+ samsung,pins = "gph-0";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col1_0: keypad-col1-0 {
++ keypad_col1_0: keypad-col1-0-pins {
+ samsung,pins = "gph-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col2_0: keypad-col2-0 {
++ keypad_col2_0: keypad-col2-0-pins {
+ samsung,pins = "gph-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col3_0: keypad-col3-0 {
++ keypad_col3_0: keypad-col3-0-pins {
+ samsung,pins = "gph-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col4_0: keypad-col4-0 {
++ keypad_col4_0: keypad-col4-0-pins {
+ samsung,pins = "gph-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col5_0: keypad-col5-0 {
++ keypad_col5_0: keypad-col5-0-pins {
+ samsung,pins = "gph-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col6_0: keypad-col6-0 {
++ keypad_col6_0: keypad-col6-0-pins {
+ samsung,pins = "gph-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col7_0: keypad-col7-0 {
++ keypad_col7_0: keypad-col7-0-pins {
+ samsung,pins = "gph-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col0_1: keypad-col0-1 {
++ keypad_col0_1: keypad-col0-1-pins {
+ samsung,pins = "gpl-0";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col1_1: keypad-col1-1 {
++ keypad_col1_1: keypad-col1-1-pins {
+ samsung,pins = "gpl-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col2_1: keypad-col2-1 {
++ keypad_col2_1: keypad-col2-1-pins {
+ samsung,pins = "gpl-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col3_1: keypad-col3-1 {
++ keypad_col3_1: keypad-col3-1-pins {
+ samsung,pins = "gpl-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col4_1: keypad-col4-1 {
++ keypad_col4_1: keypad-col4-1-pins {
+ samsung,pins = "gpl-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col5_1: keypad-col5-1 {
++ keypad_col5_1: keypad-col5-1-pins {
+ samsung,pins = "gpl-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col6_1: keypad-col6-1 {
++ keypad_col6_1: keypad-col6-1-pins {
+ samsung,pins = "gpl-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col7_1: keypad-col7-1 {
++ keypad_col7_1: keypad-col7-1-pins {
+ samsung,pins = "gpl-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row0_0: keypad-row0-0 {
++ keypad_row0_0: keypad-row0-0-pins {
+ samsung,pins = "gpk-8";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row1_0: keypad-row1-0 {
++ keypad_row1_0: keypad-row1-0-pins {
+ samsung,pins = "gpk-9";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row2_0: keypad-row2-0 {
++ keypad_row2_0: keypad-row2-0-pins {
+ samsung,pins = "gpk-10";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row3_0: keypad-row3-0 {
++ keypad_row3_0: keypad-row3-0-pins {
+ samsung,pins = "gpk-11";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row4_0: keypad-row4-0 {
++ keypad_row4_0: keypad-row4-0-pins {
+ samsung,pins = "gpk-12";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row5_0: keypad-row5-0 {
++ keypad_row5_0: keypad-row5-0-pins {
+ samsung,pins = "gpk-13";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row6_0: keypad-row6-0 {
++ keypad_row6_0: keypad-row6-0-pins {
+ samsung,pins = "gpk-14";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row7_0: keypad-row7-0 {
++ keypad_row7_0: keypad-row7-0-pins {
+ samsung,pins = "gpk-15";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row0_1: keypad-row0-1 {
++ keypad_row0_1: keypad-row0-1-pins {
+ samsung,pins = "gpn-0";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row1_1: keypad-row1-1 {
++ keypad_row1_1: keypad-row1-1-pins {
+ samsung,pins = "gpn-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row2_1: keypad-row2-1 {
++ keypad_row2_1: keypad-row2-1-pins {
+ samsung,pins = "gpn-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row3_1: keypad-row3-1 {
++ keypad_row3_1: keypad-row3-1-pins {
+ samsung,pins = "gpn-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row4_1: keypad-row4-1 {
++ keypad_row4_1: keypad-row4-1-pins {
+ samsung,pins = "gpn-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row5_1: keypad-row5-1 {
++ keypad_row5_1: keypad-row5-1-pins {
+ samsung,pins = "gpn-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row6_1: keypad-row6-1 {
++ keypad_row6_1: keypad-row6-1-pins {
+ samsung,pins = "gpn-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row7_1: keypad-row7-1 {
++ keypad_row7_1: keypad-row7-1-pins {
+ samsung,pins = "gpn-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- lcd_ctrl: lcd-ctrl {
++ lcd_ctrl: lcd-ctrl-pins {
+ samsung,pins = "gpj-8", "gpj-9", "gpj-10", "gpj-11";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- lcd_data16: lcd-data-width16 {
++ lcd_data16: lcd-data-width16-pins {
+ samsung,pins = "gpi-3", "gpi-4", "gpi-5", "gpi-6",
+ "gpi-7", "gpi-10", "gpi-11", "gpi-12",
+ "gpi-13", "gpi-14", "gpi-15", "gpj-3",
+@@ -652,7 +652,7 @@ lcd_data16: lcd-data-width16 {
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- lcd_data18: lcd-data-width18 {
++ lcd_data18: lcd-data-width18-pins {
+ samsung,pins = "gpi-2", "gpi-3", "gpi-4", "gpi-5",
+ "gpi-6", "gpi-7", "gpi-10", "gpi-11",
+ "gpi-12", "gpi-13", "gpi-14", "gpi-15",
+@@ -662,7 +662,7 @@ lcd_data18: lcd-data-width18 {
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- lcd_data24: lcd-data-width24 {
++ lcd_data24: lcd-data-width24-pins {
+ samsung,pins = "gpi-0", "gpi-1", "gpi-2", "gpi-3",
+ "gpi-4", "gpi-5", "gpi-6", "gpi-7",
+ "gpi-8", "gpi-9", "gpi-10", "gpi-11",
+@@ -673,7 +673,7 @@ lcd_data24: lcd-data-width24 {
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- hsi_bus: hsi-bus {
++ hsi_bus: hsi-bus-pins {
+ samsung,pins = "gpk-0", "gpk-1", "gpk-2", "gpk-3",
+ "gpk-4", "gpk-5", "gpk-6", "gpk-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+--
+2.40.1
+
--- /dev/null
+From 5cae2b6b75dae36ed80bd1955e64dc0141594d25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 11:57:21 +0200
+Subject: ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b77904ba177a9c67b6dbc3637fdf1faa22df6e5c ]
+
+Backlight is supplied by DC5V regulator. The DTS has no PMIC node, so
+just add a regulator-fixed to solve it and fix dtbs_check warning:
+
+ s5pv210-smdkv210.dtb: backlight: 'power-supply' is a required property
+
+Link: https://lore.kernel.org/r/20230421095721.31857-4-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/s5pv210-smdkv210.dts | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+index 7459e41e8ef13..ec5e18c59d3cf 100644
+--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts
++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+@@ -55,6 +55,14 @@ backlight {
+ default-brightness-level = <6>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pwm3_out>;
++ power-supply = <&dc5v_reg>;
++ };
++
++ dc5v_reg: regulator-0 {
++ compatible = "regulator-fixed";
++ regulator-name = "DC5V";
++ regulator-min-microvolt = <5000000>;
++ regulator-max-microvolt = <5000000>;
+ };
+ };
+
+--
+2.40.1
+
--- /dev/null
+From 85add9747524a76d14a3455395729e5a8be39957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Sep 2020 18:11:30 +0200
+Subject: ARM: dts: s5pv210: add RTC 32 KHz clock in SMDKV210
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 7260b363457a22b8723d5cbc43fee67397896d07 ]
+
+The S3C RTC requires 32768 Hz clock as input which is provided by PMIC.
+However the PMIC is not described in DTS at all so at least add
+a workaround to model its clock with a fixed-clock.
+
+This fixes dtbs_check warnings:
+
+ rtc@e2800000: clocks: [[2, 145]] is too short
+ rtc@e2800000: clock-names: ['rtc'] is too short
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20200907161141.31034-15-krzk@kernel.org
+Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/s5pv210-smdkv210.dts | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+index 84b38f1851991..1f20622da7194 100644
+--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts
++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+@@ -31,6 +31,13 @@ memory@20000000 {
+ reg = <0x20000000 0x40000000>;
+ };
+
++ pmic_ap_clk: clock-0 {
++ /* Workaround for missing PMIC and its clock */
++ compatible = "fixed-clock";
++ #clock-cells = <0>;
++ clock-frequency = <32768>;
++ };
++
+ ethernet@18000000 {
+ compatible = "davicom,dm9000";
+ reg = <0xA8000000 0x2 0xA8000002 0x2>;
+@@ -147,6 +154,8 @@ &uart3 {
+
+ &rtc {
+ status = "okay";
++ clocks = <&clocks CLK_RTC>, <&pmic_ap_clk>;
++ clock-names = "rtc", "rtc_src";
+ };
+
+ &sdhci0 {
+--
+2.40.1
+
--- /dev/null
+From c871645f7ab9e26ba14b886bb55715c763970bc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Sep 2020 20:33:03 +0200
+Subject: ARM: dts: s5pv210: correct ethernet unit address in SMDKV210
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 28ab4caccd17d7b84fd8aa36b13af5e735870bad ]
+
+The SROM bank 5 is at address 0xa8000000, just like the one put in "reg"
+property of ethernet node. Fix the unit address of ethernet node.
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20200907183313.29234-2-krzk@kernel.org
+Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/s5pv210-smdkv210.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+index 1e1570d66d890..7459e41e8ef13 100644
+--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts
++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+@@ -39,7 +39,7 @@ pmic_ap_clk: clock-0 {
+ clock-frequency = <32768>;
+ };
+
+- ethernet@18000000 {
++ ethernet@a8000000 {
+ compatible = "davicom,dm9000";
+ reg = <0xA8000000 0x2 0xA8000002 0x2>;
+ interrupt-parent = <&gph1>;
+--
+2.40.1
+
--- /dev/null
+From 3a9205036f631faed82378135b1d15e6452dac77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Sep 2020 18:11:34 +0200
+Subject: ARM: dts: s5pv210: use defines for IRQ flags in SMDKV210
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit c272f1cc9492d61dac362d2064ec41ca97fcb1e2 ]
+
+Replace hard-coded flags with defines for readability. No functional
+change.
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20200907161141.31034-19-krzk@kernel.org
+Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/s5pv210-smdkv210.dts | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+index 1f20622da7194..1e1570d66d890 100644
+--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts
++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+@@ -15,6 +15,7 @@
+ */
+
+ /dts-v1/;
++#include <dt-bindings/interrupt-controller/irq.h>
+ #include <dt-bindings/input/input.h>
+ #include "s5pv210.dtsi"
+
+@@ -42,7 +43,7 @@ ethernet@18000000 {
+ compatible = "davicom,dm9000";
+ reg = <0xA8000000 0x2 0xA8000002 0x2>;
+ interrupt-parent = <&gph1>;
+- interrupts = <1 4>;
++ interrupts = <1 IRQ_TYPE_LEVEL_HIGH>;
+ local-mac-address = [00 00 de ad be ef];
+ davicom,no-eeprom;
+ };
+--
+2.40.1
+
--- /dev/null
+From f5bf32405a72cd300cf4d533f1d7203830ab7eed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jul 2023 17:29:25 +0200
+Subject: ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses
+ (split)
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit cf0cb2af6a18f28b84f9f1416bff50ca60d6e98a ]
+
+The davicom,dm9000 Ethernet Controller accepts two reg addresses.
+
+Fixes: a43736deb47d ("ARM: dts: Add dts file for S3C6410-based Mini6410 board")
+Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
+Link: https://lore.kernel.org/r/20230713152926.82884-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/s3c6410-mini6410.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts
+index 17097da36f5ed..0b07b3c319604 100644
+--- a/arch/arm/boot/dts/s3c6410-mini6410.dts
++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts
+@@ -51,7 +51,7 @@ srom-cs1-bus@18000000 {
+
+ ethernet@18000000 {
+ compatible = "davicom,dm9000";
+- reg = <0x18000000 0x2 0x18000004 0x2>;
++ reg = <0x18000000 0x2>, <0x18000004 0x2>;
+ interrupt-parent = <&gpn>;
+ interrupts = <7 IRQ_TYPE_LEVEL_HIGH>;
+ davicom,no-eeprom;
+--
+2.40.1
+
--- /dev/null
+From 39e934b82242fbb9d0608590a55a0e061969a316 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jul 2023 17:29:26 +0200
+Subject: ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses
+ (split)
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 982655cb0e7f18934d7532c32366e574ad61dbd7 ]
+
+The davicom,dm9000 Ethernet Controller accepts two reg addresses.
+
+Fixes: b672b27d232e ("ARM: dts: Add Device tree for s5pc110/s5pv210 boards")
+Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
+Link: https://lore.kernel.org/r/20230713152926.82884-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/s5pv210-smdkv210.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+index ec5e18c59d3cf..53a841ecf7a44 100644
+--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts
++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+@@ -41,7 +41,7 @@ pmic_ap_clk: clock-0 {
+
+ ethernet@a8000000 {
+ compatible = "davicom,dm9000";
+- reg = <0xA8000000 0x2 0xA8000002 0x2>;
++ reg = <0xa8000000 0x2>, <0xa8000002 0x2>;
+ interrupt-parent = <&gph1>;
+ interrupts = <1 IRQ_TYPE_LEVEL_HIGH>;
+ local-mac-address = [00 00 de ad be ef];
+--
+2.40.1
+
--- /dev/null
+From 0b990915ee9e34b7e5db8846bdd0f8f1f9677f70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 16:05:28 +0530
+Subject: arm64: dts: msm8996: thermal: Add interrupt support
+
+From: Amit Kucheria <amit.kucheria@linaro.org>
+
+[ Upstream commit 6eb1c8ade5e8665eb97f8416eee0942c9f90b12b ]
+
+Register upper-lower interrupts for each of the two tsens controllers.
+
+Signed-off-by: Amit Kucheria <amit.kucheria@linaro.org>
+Signed-off-by: Andy Gross <agross@kernel.org>
+Stable-dep-of: 36541089c473 ("arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 3e7baabf64507..260adec7980d8 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -382,6 +382,8 @@ tsens0: thermal-sensor@4a9000 {
+ reg = <0x4a9000 0x1000>, /* TM */
+ <0x4a8000 0x1000>; /* SROT */
+ #qcom,sensors = <13>;
++ interrupts = <GIC_SPI 458 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "uplow";
+ #thermal-sensor-cells = <1>;
+ };
+
+@@ -390,6 +392,8 @@ tsens1: thermal-sensor@4ad000 {
+ reg = <0x4ad000 0x1000>, /* TM */
+ <0x4ac000 0x1000>; /* SROT */
+ #qcom,sensors = <8>;
++ interrupts = <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "uplow";
+ #thermal-sensor-cells = <1>;
+ };
+
+--
+2.40.1
+
--- /dev/null
+From 28bd9c0bbb1e2e6c7898de47dbbaa4a15b2d260c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 18:24:27 +0200
+Subject: arm64: dts: qcom: msm8996: Add missing interrupt to the USB2
+ controller
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 36541089c4733355ed844c67eebd0c3936953454 ]
+
+The interrupt line was previously not described. Take care of that.
+
+Fixes: 1e39255ed29d ("arm64: dts: msm8996: Add device node for qcom,dwc3")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230627-topic-more_bindings-v1-11-6b4b6cd081e5@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 260adec7980d8..4ee32583dc7c5 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -903,6 +903,9 @@ usb2: usb@7600000 {
+ #size-cells = <1>;
+ ranges;
+
++ interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "hs_phy_irq";
++
+ clocks = <&gcc GCC_PERIPH_NOC_USB20_AHB_CLK>,
+ <&gcc GCC_USB20_MASTER_CLK>,
+ <&gcc GCC_USB20_MOCK_UTMI_CLK>,
+--
+2.40.1
+
--- /dev/null
+From a00c56ef4119511409d9ffca8cd17fdbff7d09e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Aug 2023 20:14:35 +0800
+Subject: audit: fix possible soft lockup in __audit_inode_child()
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+[ Upstream commit b59bc6e37237e37eadf50cd5de369e913f524463 ]
+
+Tracefs or debugfs maybe cause hundreds to thousands of PATH records,
+too many PATH records maybe cause soft lockup.
+
+For example:
+ 1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n
+ 2. auditctl -a exit,always -S open -k key
+ 3. sysctl -w kernel.watchdog_thresh=5
+ 4. mkdir /sys/kernel/debug/tracing/instances/test
+
+There may be a soft lockup as follows:
+ watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498]
+ Kernel panic - not syncing: softlockup: hung tasks
+ Call trace:
+ dump_backtrace+0x0/0x30c
+ show_stack+0x20/0x30
+ dump_stack+0x11c/0x174
+ panic+0x27c/0x494
+ watchdog_timer_fn+0x2bc/0x390
+ __run_hrtimer+0x148/0x4fc
+ __hrtimer_run_queues+0x154/0x210
+ hrtimer_interrupt+0x2c4/0x760
+ arch_timer_handler_phys+0x48/0x60
+ handle_percpu_devid_irq+0xe0/0x340
+ __handle_domain_irq+0xbc/0x130
+ gic_handle_irq+0x78/0x460
+ el1_irq+0xb8/0x140
+ __audit_inode_child+0x240/0x7bc
+ tracefs_create_file+0x1b8/0x2a0
+ trace_create_file+0x18/0x50
+ event_create_dir+0x204/0x30c
+ __trace_add_new_event+0xac/0x100
+ event_trace_add_tracer+0xa0/0x130
+ trace_array_create_dir+0x60/0x140
+ trace_array_create+0x1e0/0x370
+ instance_mkdir+0x90/0xd0
+ tracefs_syscall_mkdir+0x68/0xa0
+ vfs_mkdir+0x21c/0x34c
+ do_mkdirat+0x1b4/0x1d4
+ __arm64_sys_mkdirat+0x4c/0x60
+ el0_svc_common.constprop.0+0xa8/0x240
+ do_el0_svc+0x8c/0xc0
+ el0_svc+0x20/0x30
+ el0_sync_handler+0xb0/0xb4
+ el0_sync+0x160/0x180
+
+Therefore, we add cond_resched() to __audit_inode_child() to fix it.
+
+Fixes: 5195d8e217a7 ("audit: dynamically allocate audit_names when not enough space is in the names array")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/auditsc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index 1513873e23bd1..e4de5b9d5d3f1 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -1923,6 +1923,8 @@ void __audit_inode_child(struct inode *parent,
+ }
+ }
+
++ cond_resched();
++
+ /* is there a matching child entry? */
+ list_for_each_entry(n, &context->names_list, list) {
+ /* can only match entries that have a name */
+--
+2.40.1
+
--- /dev/null
+From a9a53a9455996545704246a3401f1444d4564056 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jul 2023 21:30:00 +0800
+Subject: Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
+
+From: Yuanjun Gong <ruc_gongyuanjun@163.com>
+
+[ Upstream commit e8b5aed31355072faac8092ead4938ddec3111fd ]
+
+in nokia_bluetooth_serdev_probe(), check the return value of
+clk_prepare_enable() and return the error code if
+clk_prepare_enable() returns an unexpected value.
+
+Fixes: 7bb318680e86 ("Bluetooth: add nokia driver")
+Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_nokia.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/hci_nokia.c b/drivers/bluetooth/hci_nokia.c
+index 2dc33e65d2d0c..5f6c6930b5bdf 100644
+--- a/drivers/bluetooth/hci_nokia.c
++++ b/drivers/bluetooth/hci_nokia.c
+@@ -743,7 +743,11 @@ static int nokia_bluetooth_serdev_probe(struct serdev_device *serdev)
+ return err;
+ }
+
+- clk_prepare_enable(sysclk);
++ err = clk_prepare_enable(sysclk);
++ if (err) {
++ dev_err(dev, "could not enable sysclk: %d", err);
++ return err;
++ }
+ btdev->sysclk_speed = clk_get_rate(sysclk);
+ clk_disable_unprepare(sysclk);
+
+--
+2.40.1
+
--- /dev/null
+From 798a7fd2203539b7f8227b1e01840cf109ed146f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Jul 2023 02:56:25 +0000
+Subject: bpf: Clear the probe_addr for uprobe
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 5125e757e62f6c1d5478db4c2b61a744060ddf3f ]
+
+To avoid returning uninitialized or random values when querying the file
+descriptor (fd) and accessing probe_addr, it is necessary to clear the
+variable prior to its use.
+
+Fixes: 41bdc4b40ed6 ("bpf: introduce bpf subcommand BPF_TASK_FD_QUERY")
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Acked-by: Yonghong Song <yhs@fb.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20230709025630.3735-6-laoar.shao@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/trace_events.h | 3 ++-
+ kernel/trace/bpf_trace.c | 2 +-
+ kernel/trace/trace_uprobe.c | 3 ++-
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
+index 0643c083ed862..93a1b5497bdf1 100644
+--- a/include/linux/trace_events.h
++++ b/include/linux/trace_events.h
+@@ -581,7 +581,8 @@ extern int perf_uprobe_init(struct perf_event *event, bool is_retprobe);
+ extern void perf_uprobe_destroy(struct perf_event *event);
+ extern int bpf_get_uprobe_info(const struct perf_event *event,
+ u32 *fd_type, const char **filename,
+- u64 *probe_offset, bool perf_type_tracepoint);
++ u64 *probe_offset, u64 *probe_addr,
++ bool perf_type_tracepoint);
+ #endif
+ extern int ftrace_profile_set_filter(struct perf_event *event, int event_id,
+ char *filter_str);
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 1cb13d6368f3f..b794470bb42ed 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -1274,7 +1274,7 @@ int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id,
+ #ifdef CONFIG_UPROBE_EVENTS
+ if (flags & TRACE_EVENT_FL_UPROBE)
+ err = bpf_get_uprobe_info(event, fd_type, buf,
+- probe_offset,
++ probe_offset, probe_addr,
+ event->attr.type == PERF_TYPE_TRACEPOINT);
+ #endif
+ }
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index 0da379b902492..0e3bdd69fa2d6 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -1159,7 +1159,7 @@ static void uretprobe_perf_func(struct trace_uprobe *tu, unsigned long func,
+
+ int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type,
+ const char **filename, u64 *probe_offset,
+- bool perf_type_tracepoint)
++ u64 *probe_addr, bool perf_type_tracepoint)
+ {
+ const char *pevent = trace_event_name(event->tp_event);
+ const char *group = event->tp_event->class->system;
+@@ -1176,6 +1176,7 @@ int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type,
+ : BPF_FD_TYPE_UPROBE;
+ *filename = tu->filename;
+ *probe_offset = tu->offset;
++ *probe_addr = 0;
+ return 0;
+ }
+ #endif /* CONFIG_PERF_EVENTS */
+--
+2.40.1
+
--- /dev/null
+From 85b69d6cb70f4fc41fd5ec0ebe931552faaf0e71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 11:23:37 +0200
+Subject: can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors
+ also in case of OOM
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 6c8bc15f02b85bc8f47074110d8fd8caf7a1e42d ]
+
+In case of an RX overflow error from the CAN controller and an OOM
+where no skb can be allocated, the error counters are not incremented.
+
+Fix this by first incrementing the error counters and then allocate
+the skb.
+
+Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
+Link: https://lore.kernel.org/all/20230718-gs_usb-cleanups-v1-7-c3b9154ec605@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/gs_usb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index b2e48c8595f0f..fd80af775ec75 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -389,6 +389,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
+ }
+
+ if (hf->flags & GS_CAN_FLAG_OVERFLOW) {
++ stats->rx_over_errors++;
++ stats->rx_errors++;
++
+ skb = alloc_can_err_skb(netdev, &cf);
+ if (!skb)
+ goto resubmit_urb;
+@@ -396,8 +399,6 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
+ cf->can_id |= CAN_ERR_CRTL;
+ cf->can_dlc = CAN_ERR_DLC;
+ cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
+- stats->rx_over_errors++;
+- stats->rx_errors++;
+ netif_rx(skb);
+ }
+
+--
+2.40.1
+
--- /dev/null
+From 5b6fd8b624575b4157d2d6ede8e9042b9d452d42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Aug 2023 11:25:28 +0000
+Subject: cgroup:namespace: Remove unused cgroup_namespaces_init()
+
+From: Lu Jialin <lujialin4@huawei.com>
+
+[ Upstream commit 82b90b6c5b38e457c7081d50dff11ecbafc1e61a ]
+
+cgroup_namspace_init() just return 0. Therefore, there is no need to
+call it during start_kernel. Just remove it.
+
+Fixes: a79a908fd2b0 ("cgroup: introduce cgroup namespaces")
+Signed-off-by: Lu Jialin <lujialin4@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/namespace.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c
+index b05f1dd58a622..313e66b8c6622 100644
+--- a/kernel/cgroup/namespace.c
++++ b/kernel/cgroup/namespace.c
+@@ -148,9 +148,3 @@ const struct proc_ns_operations cgroupns_operations = {
+ .install = cgroupns_install,
+ .owner = cgroupns_owner,
+ };
+-
+-static __init int cgroup_namespaces_init(void)
+-{
+- return 0;
+-}
+-subsys_initcall(cgroup_namespaces_init);
+--
+2.40.1
+
--- /dev/null
+From cc8c99df236045c32d2f78fe5a27341ad65ef6d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jul 2023 15:31:07 +0000
+Subject: clk: sunxi-ng: Modify mismatched function name
+
+From: Zhang Jianhua <chris.zjh@huawei.com>
+
+[ Upstream commit 075d9ca5b4e17f84fd1c744a405e69ec743be7f0 ]
+
+No functional modification involved.
+
+drivers/clk/sunxi-ng/ccu_mmc_timing.c:54: warning: expecting prototype for sunxi_ccu_set_mmc_timing_mode(). Prototype was for sunxi_ccu_get_mmc_timing_mode() instead
+
+Fixes: f6f64ed868d3 ("clk: sunxi-ng: Add interface to query or configure MMC timing modes.")
+Signed-off-by: Zhang Jianhua <chris.zjh@huawei.com>
+Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20230722153107.2078179-1-chris.zjh@huawei.com
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu_mmc_timing.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu_mmc_timing.c b/drivers/clk/sunxi-ng/ccu_mmc_timing.c
+index f9869f7353c01..9356dc1571561 100644
+--- a/drivers/clk/sunxi-ng/ccu_mmc_timing.c
++++ b/drivers/clk/sunxi-ng/ccu_mmc_timing.c
+@@ -50,7 +50,7 @@ int sunxi_ccu_set_mmc_timing_mode(struct clk *clk, bool new_mode)
+ EXPORT_SYMBOL_GPL(sunxi_ccu_set_mmc_timing_mode);
+
+ /**
+- * sunxi_ccu_set_mmc_timing_mode: Get the current MMC clock timing mode
++ * sunxi_ccu_get_mmc_timing_mode: Get the current MMC clock timing mode
+ * @clk: clock to query
+ *
+ * Returns 0 if the clock is in old timing mode, > 0 if it is in
+--
+2.40.1
+
--- /dev/null
+From 6ce9c8945fb90d330fb476ee7435fdbb906c0fe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Aug 2023 09:51:13 +0000
+Subject: cpufreq: powernow-k8: Use related_cpus instead of cpus in
+ driver.exit()
+
+From: Liao Chang <liaochang1@huawei.com>
+
+[ Upstream commit 03997da042dac73c69e60d91942c727c76828b65 ]
+
+Since the 'cpus' field of policy structure will become empty in the
+cpufreq core API, it is better to use 'related_cpus' in the exit()
+callback of driver.
+
+Fixes: c3274763bfc3 ("cpufreq: powernow-k8: Initialize per-cpu data-structures properly")
+Signed-off-by: Liao Chang <liaochang1@huawei.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/powernow-k8.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
+index 818f92798fb9b..55743d78016b0 100644
+--- a/drivers/cpufreq/powernow-k8.c
++++ b/drivers/cpufreq/powernow-k8.c
+@@ -1104,7 +1104,8 @@ static int powernowk8_cpu_exit(struct cpufreq_policy *pol)
+
+ kfree(data->powernow_table);
+ kfree(data);
+- for_each_cpu(cpu, pol->cpus)
++ /* pol->cpus will be empty here, use related_cpus instead. */
++ for_each_cpu(cpu, pol->related_cpus)
+ per_cpu(powernow_data, cpu) = NULL;
+
+ return 0;
+--
+2.40.1
+
--- /dev/null
+From 63e2c862e3cfa9671d7ce7fc9e862caa19b46064 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Aug 2023 12:55:25 +0200
+Subject: crypto: caam - fix unchecked return value error
+
+From: Gaurav Jain <gaurav.jain@nxp.com>
+
+[ Upstream commit e30685204711a6be40dec2622606950ccd37dafe ]
+
+error:
+Unchecked return value (CHECKED_RETURN)
+check_return: Calling sg_miter_next without checking return value
+
+fix:
+added check if(!sg_miter_next)
+
+Fixes: 8a2a0dd35f2e ("crypto: caam - strip input zeros from RSA input buffer")
+Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com>
+Signed-off-by: Meenakshi Aggarwal <meenakshi.aggarwal@nxp.com>
+Reviewed-by: Gaurav Jain <gaurav.jain@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caampkc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
+index f26d62e5533a7..701e4ad8077b4 100644
+--- a/drivers/crypto/caam/caampkc.c
++++ b/drivers/crypto/caam/caampkc.c
+@@ -194,7 +194,9 @@ static int caam_rsa_count_leading_zeros(struct scatterlist *sgl,
+ if (len && *buff)
+ break;
+
+- sg_miter_next(&miter);
++ if (!sg_miter_next(&miter))
++ break;
++
+ buff = miter.addr;
+ len = miter.length;
+
+--
+2.40.1
+
--- /dev/null
+From 71ddc33e4d2a05e77ac28429e603b891551a4b11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jul 2023 07:49:41 -0700
+Subject: dma-buf/sync_file: Fix docs syntax
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 05d56d8079d510a2994039470f65bea85f0075ee ]
+
+Fixes the warning:
+
+ include/uapi/linux/sync_file.h:77: warning: Function parameter or member 'num_fences' not described in 'sync_file_info'
+
+Fixes: 2d75c88fefb2 ("staging/android: refactor SYNC IOCTLs")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20230724145000.125880-1-robdclark@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/sync_file.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/sync_file.h b/include/uapi/linux/sync_file.h
+index ee2dcfb3d6602..d7f7c04a6e0c1 100644
+--- a/include/uapi/linux/sync_file.h
++++ b/include/uapi/linux/sync_file.h
+@@ -52,7 +52,7 @@ struct sync_fence_info {
+ * @name: name of fence
+ * @status: status of fence. 1: signaled 0:active <0:error
+ * @flags: sync_file_info flags
+- * @num_fences number of fences in the sync_file
++ * @num_fences: number of fences in the sync_file
+ * @pad: padding for 64-bit alignment, should always be zero
+ * @sync_fence_info: pointer to array of structs sync_fence_info with all
+ * fences in the sync_file
+--
+2.40.1
+
--- /dev/null
+From cacd6b8a815ca60c0518847a8699b796aa44cc7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jul 2023 14:41:08 +0000
+Subject: dmaengine: ste_dma40: Add missing IRQ check in d40_probe
+
+From: ruanjinjie <ruanjinjie@huawei.com>
+
+[ Upstream commit c05ce6907b3d6e148b70f0bb5eafd61dcef1ddc1 ]
+
+Check for the return value of platform_get_irq(): if no interrupt
+is specified, it wouldn't make sense to call request_irq().
+
+Fixes: 8d318a50b3d7 ("DMAENGINE: Support for ST-Ericssons DMA40 block v3")
+Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230724144108.2582917-1-ruanjinjie@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ste_dma40.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
+index e588dc5daaa80..e9d76113c9e95 100644
+--- a/drivers/dma/ste_dma40.c
++++ b/drivers/dma/ste_dma40.c
+@@ -3584,6 +3584,10 @@ static int __init d40_probe(struct platform_device *pdev)
+ spin_lock_init(&base->lcla_pool.lock);
+
+ base->irq = platform_get_irq(pdev, 0);
++ if (base->irq < 0) {
++ ret = base->irq;
++ goto destroy_cache;
++ }
+
+ ret = request_irq(base->irq, d40_handle_interrupt, 0, D40_NAME, base);
+ if (ret) {
+--
+2.40.1
+
--- /dev/null
+From 6d2d408a59c0deb5ed523904544ef53baad01975 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jul 2023 18:22:46 +0800
+Subject: drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
+
+From: Minjie Du <duminjie@vivo.com>
+
+[ Upstream commit a995c50db887ef97f3160775aef7d772635a6f6e ]
+
+The function clk_register_pll() may return NULL or an ERR_PTR. Don't
+treat an ERR_PTR as valid.
+
+Signed-off-by: Minjie Du <duminjie@vivo.com>
+Link: https://lore.kernel.org/r/20230712102246.10348-1-duminjie@vivo.com
+Fixes: b9e0d40c0d83 ("clk: keystone: add Keystone PLL clock driver")
+[sboyd@kernel.org: Reword commit text]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/keystone/pll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/keystone/pll.c b/drivers/clk/keystone/pll.c
+index e7e840fb74eaf..526694c2a6c97 100644
+--- a/drivers/clk/keystone/pll.c
++++ b/drivers/clk/keystone/pll.c
+@@ -213,7 +213,7 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl)
+ }
+
+ clk = clk_register_pll(NULL, node->name, parent_name, pll_data);
+- if (clk) {
++ if (!IS_ERR_OR_NULL(clk)) {
+ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ return;
+ }
+--
+2.40.1
+
--- /dev/null
+From 553cdfc7a156c7d73b7ac532e9b1c0a637f119ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 18:24:08 +0800
+Subject: drivers: usb: smsusb: fix error handling code in smsusb_init_device
+
+From: Dongliang Mu <dzm91@hust.edu.cn>
+
+[ Upstream commit b9c7141f384097fa4fa67d2f72e5731d628aef7c ]
+
+The previous commit 4b208f8b561f ("[media] siano: register media controller
+earlier")moves siano_media_device_register before smscore_register_device,
+and adds corresponding error handling code if smscore_register_device
+fails. However, it misses the following error handling code of
+smsusb_init_device.
+
+Fix this by moving error handling code at the end of smsusb_init_device
+and adding a goto statement in the following error handling parts.
+
+Fixes: 4b208f8b561f ("[media] siano: register media controller earlier")
+Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/siano/smsusb.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
+index cd706874899c3..62e4fecc57d9c 100644
+--- a/drivers/media/usb/siano/smsusb.c
++++ b/drivers/media/usb/siano/smsusb.c
+@@ -467,12 +467,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
+ rc = smscore_register_device(¶ms, &dev->coredev, 0, mdev);
+ if (rc < 0) {
+ pr_err("smscore_register_device(...) failed, rc %d\n", rc);
+- smsusb_term_device(intf);
+-#ifdef CONFIG_MEDIA_CONTROLLER_DVB
+- media_device_unregister(mdev);
+-#endif
+- kfree(mdev);
+- return rc;
++ goto err_unregister_device;
+ }
+
+ smscore_set_board_id(dev->coredev, board_id);
+@@ -489,8 +484,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
+ rc = smsusb_start_streaming(dev);
+ if (rc < 0) {
+ pr_err("smsusb_start_streaming(...) failed\n");
+- smsusb_term_device(intf);
+- return rc;
++ goto err_unregister_device;
+ }
+
+ dev->state = SMSUSB_ACTIVE;
+@@ -498,13 +492,20 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
+ rc = smscore_start_device(dev->coredev);
+ if (rc < 0) {
+ pr_err("smscore_start_device(...) failed\n");
+- smsusb_term_device(intf);
+- return rc;
++ goto err_unregister_device;
+ }
+
+ pr_debug("device 0x%p created\n", dev);
+
+ return rc;
++
++err_unregister_device:
++ smsusb_term_device(intf);
++#ifdef CONFIG_MEDIA_CONTROLLER_DVB
++ media_device_unregister(mdev);
++#endif
++ kfree(mdev);
++ return rc;
+ }
+
+ static int smsusb_probe(struct usb_interface *intf,
+--
+2.40.1
+
--- /dev/null
+From 88a32d77cad8fdb303e930c5dba860302f51978c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jul 2023 09:01:43 +0300
+Subject: drm: adv7511: Fix low refresh rate register for ADV7533/5
+
+From: Bogdan Togorean <bogdan.togorean@analog.com>
+
+[ Upstream commit d281eeaa4de2636ff0c8e6ae387bb07b50e5fcbb ]
+
+For ADV7533 and ADV7535 low refresh rate is selected using
+bits [3:2] of 0x4a main register.
+So depending on ADV model write 0xfb or 0x4a register.
+
+Fixes: 2437e7cd88e8 ("drm/bridge: adv7533: Initial support for ADV7533")
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Reviewed-by: Nuno Sa <nuno.sa@analog.com>
+Signed-off-by: Bogdan Togorean <bogdan.togorean@analog.com>
+Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
+Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230719060143.63649-1-alex@shruggie.ro
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 31b75d3ca6e90..85aba4c38dc00 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -756,8 +756,13 @@ static void adv7511_mode_set(struct adv7511 *adv7511,
+ else
+ low_refresh_rate = ADV7511_LOW_REFRESH_RATE_NONE;
+
+- regmap_update_bits(adv7511->regmap, 0xfb,
+- 0x6, low_refresh_rate << 1);
++ if (adv7511->type == ADV7511)
++ regmap_update_bits(adv7511->regmap, 0xfb,
++ 0x6, low_refresh_rate << 1);
++ else
++ regmap_update_bits(adv7511->regmap, 0x4a,
++ 0xc, low_refresh_rate << 2);
++
+ regmap_update_bits(adv7511->regmap, 0x17,
+ 0x60, (vsync_polarity << 6) | (hsync_polarity << 5));
+
+--
+2.40.1
+
--- /dev/null
+From 37a2ed8ca538c9e7472976ff7f283f90eb59a498 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jul 2023 13:11:51 +0200
+Subject: drm/amdgpu: avoid integer overflow warning in
+ amdgpu_device_resize_fb_bar()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 822130b5e8834ab30ad410cf19a582e5014b9a85 ]
+
+On 32-bit architectures comparing a resource against a value larger than
+U32_MAX can cause a warning:
+
+drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:1344:18: error: result of comparison of constant 4294967296 with expression of type 'resource_size_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
+ res->start > 0x100000000ull)
+ ~~~~~~~~~~ ^ ~~~~~~~~~~~~~~
+
+As gcc does not warn about this in dead code, add an IS_ENABLED() check at
+the start of the function. This will always return success but not actually resize
+the BAR on 32-bit architectures without high memory, which is exactly what
+we want here, as the driver can fall back to bank switching the VRAM
+access.
+
+Fixes: 31b8adab3247 ("drm/amdgpu: require a root bus window above 4GB for BAR resize")
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 787cbeea8dc55..c84f475d4f136 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -735,6 +735,9 @@ int amdgpu_device_resize_fb_bar(struct amdgpu_device *adev)
+ u16 cmd;
+ int r;
+
++ if (!IS_ENABLED(CONFIG_PHYS_ADDR_T_64BIT))
++ return 0;
++
+ /* Bypass for VF */
+ if (amdgpu_sriov_vf(adev))
+ return 0;
+--
+2.40.1
+
--- /dev/null
+From ce175f396dab968f74655bec14e523478cdc27d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 17:52:48 -0600
+Subject: drm/amdgpu: Correct Transmit Margin masks
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 19d7a95a8ba66b198f759cf610cc935ce9840d5b ]
+
+Previously we masked PCIe Link Control 2 register values with "7 << 9",
+which was apparently intended to be the Transmit Margin field, but instead
+was the high order bit of Transmit Margin, the Enter Modified Compliance
+bit, and the Compliance SOS bit.
+
+Correct the mask to "7 << 7", which is the Transmit Margin field.
+
+Link: https://lore.kernel.org/r/20191112173503.176611-3-helgaas@kernel.org
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/cik.c | 8 ++++----
+ drivers/gpu/drm/amd/amdgpu/si.c | 8 ++++----
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
+index 78ab939ae5d86..40b62edd891f3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/cik.c
++++ b/drivers/gpu/drm/amd/amdgpu/cik.c
+@@ -1491,13 +1491,13 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+
+ /* linkctl2 */
+ pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9)));
++ tmp16 &= ~((1 << 4) | (7 << 7));
++ tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7)));
+ pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9)));
++ tmp16 &= ~((1 << 4) | (7 << 7));
++ tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7)));
+ pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ tmp = RREG32_PCIE(ixPCIE_LC_CNTL4);
+diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
+index 77c9f4d8668ad..3b9e944bee180 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si.c
++++ b/drivers/gpu/drm/amd/amdgpu/si.c
+@@ -1662,13 +1662,13 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
+
+ pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9)));
++ tmp16 &= ~((1 << 4) | (7 << 7));
++ tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7)));
+ pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9)));
++ tmp16 &= ~((1 << 4) | (7 << 7));
++ tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7)));
+ pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+--
+2.40.1
+
--- /dev/null
+From 7bbad2aab8b5570b6970c783e48ec97dca45033b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Nov 2019 18:35:13 -0600
+Subject: drm/amdgpu: Prefer pcie_capability_read_word()
+
+From: Frederick Lawler <fred@fredlawl.com>
+
+[ Upstream commit 88027c89ea146e32485251f1c2dddcde43c8d04e ]
+
+Commit 8c0d3a02c130 ("PCI: Add accessors for PCI Express Capability")
+added accessors for the PCI Express Capability so that drivers didn't
+need to be aware of differences between v1 and v2 of the PCI
+Express Capability.
+
+Replace pci_read_config_word() and pci_write_config_word() calls with
+pcie_capability_read_word() and pcie_capability_write_word().
+
+[bhelgaas: fix a couple remaining instances in cik.c]
+Link: https://lore.kernel.org/r/20191118003513.10852-1-fred@fredlawl.com
+Signed-off-by: Frederick Lawler <fred@fredlawl.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/cik.c | 71 ++++++++++++++++++++------------
+ drivers/gpu/drm/amd/amdgpu/si.c | 71 ++++++++++++++++++++------------
+ 2 files changed, 90 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
+index 95b3a1f601e8b..35f9bcd17b1b2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/cik.c
++++ b/drivers/gpu/drm/amd/amdgpu/cik.c
+@@ -1377,7 +1377,6 @@ static int cik_set_vce_clocks(struct amdgpu_device *adev, u32 evclk, u32 ecclk)
+ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ {
+ struct pci_dev *root = adev->pdev->bus->self;
+- int bridge_pos, gpu_pos;
+ u32 speed_cntl, current_data_rate;
+ int i;
+ u16 tmp16;
+@@ -1412,12 +1411,7 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ DRM_INFO("enabling PCIE gen 2 link speeds, disable with amdgpu.pcie_gen2=0\n");
+ }
+
+- bridge_pos = pci_pcie_cap(root);
+- if (!bridge_pos)
+- return;
+-
+- gpu_pos = pci_pcie_cap(adev->pdev);
+- if (!gpu_pos)
++ if (!pci_is_pcie(root) || !pci_is_pcie(adev->pdev))
+ return;
+
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
+@@ -1427,14 +1421,17 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+ tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
+
+ tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL,
++ tmp16);
+
+ tmp = RREG32_PCIE(ixPCIE_LC_STATUS1);
+ max_lw = (tmp & PCIE_LC_STATUS1__LC_DETECTED_LINK_WIDTH_MASK) >>
+@@ -1458,15 +1455,23 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+
+ for (i = 0; i < 10; i++) {
+ /* check status */
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_DEVSTA,
++ &tmp16);
+ if (tmp16 & PCI_EXP_DEVSTA_TRPND)
+ break;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &bridge_cfg2);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ &gpu_cfg2);
+
+ tmp = RREG32_PCIE(ixPCIE_LC_CNTL4);
+ tmp |= PCIE_LC_CNTL4__LC_SET_QUIESCE_MASK;
+@@ -1479,32 +1484,45 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ msleep(100);
+
+ /* linkctl */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+ tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(root, PCI_EXP_LNKCTL,
++ tmp16);
+
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL,
++ &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+ tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(adev->pdev,
++ PCI_EXP_LNKCTL,
++ tmp16);
+
+ /* linkctl2 */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &tmp16);
+ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN);
+ tmp16 |= (bridge_cfg2 &
+ (PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN));
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(root,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ &tmp16);
+ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN);
+ tmp16 |= (gpu_cfg2 &
+ (PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN));
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+ tmp = RREG32_PCIE(ixPCIE_LC_CNTL4);
+ tmp &= ~PCIE_LC_CNTL4__LC_SET_QUIESCE_MASK;
+@@ -1519,15 +1537,16 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ speed_cntl &= ~PCIE_LC_SPEED_CNTL__LC_FORCE_DIS_SW_SPEED_CHANGE_MASK;
+ WREG32_PCIE(ixPCIE_LC_SPEED_CNTL, speed_cntl);
+
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL2, &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
++
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE(ixPCIE_LC_SPEED_CNTL);
+ speed_cntl |= PCIE_LC_SPEED_CNTL__LC_INITIATE_LINK_SPEED_CHANGE_MASK;
+diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
+index e5fe304a28156..c6516f82f29c8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si.c
++++ b/drivers/gpu/drm/amd/amdgpu/si.c
+@@ -1558,7 +1558,6 @@ static void si_init_golden_registers(struct amdgpu_device *adev)
+ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ {
+ struct pci_dev *root = adev->pdev->bus->self;
+- int bridge_pos, gpu_pos;
+ u32 speed_cntl, current_data_rate;
+ int i;
+ u16 tmp16;
+@@ -1593,12 +1592,7 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ DRM_INFO("enabling PCIE gen 2 link speeds, disable with amdgpu.pcie_gen2=0\n");
+ }
+
+- bridge_pos = pci_pcie_cap(root);
+- if (!bridge_pos)
+- return;
+-
+- gpu_pos = pci_pcie_cap(adev->pdev);
+- if (!gpu_pos)
++ if (!pci_is_pcie(root) || !pci_is_pcie(adev->pdev))
+ return;
+
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
+@@ -1607,14 +1601,17 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+ tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
+
+ tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL,
++ tmp16);
+
+ tmp = RREG32_PCIE(PCIE_LC_STATUS1);
+ max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
+@@ -1631,15 +1628,23 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ }
+
+ for (i = 0; i < 10; i++) {
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_DEVSTA,
++ &tmp16);
+ if (tmp16 & PCI_EXP_DEVSTA_TRPND)
+ break;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &bridge_cfg2);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ &gpu_cfg2);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp |= LC_SET_QUIESCE;
+@@ -1651,31 +1656,44 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+
+ mdelay(100);
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+ tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(root, PCI_EXP_LNKCTL,
++ tmp16);
+
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL,
++ &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+ tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(adev->pdev,
++ PCI_EXP_LNKCTL,
++ tmp16);
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &tmp16);
+ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN);
+ tmp16 |= (bridge_cfg2 &
+ (PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN));
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(root,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ &tmp16);
+ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN);
+ tmp16 |= (gpu_cfg2 &
+ (PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN));
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp &= ~LC_SET_QUIESCE;
+@@ -1688,15 +1706,16 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE;
+ WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl);
+
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL2, &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
++
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
+ speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE;
+--
+2.40.1
+
--- /dev/null
+From 57ab4ff1e147def6d02f569e699864edf86427f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 07:23:41 -0600
+Subject: drm/amdgpu: Replace numbers with PCI_EXP_LNKCTL2 definitions
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 35e768e296729ac96a8c33b7810b6cb1673ae961 ]
+
+Replace hard-coded magic numbers with the descriptive PCI_EXP_LNKCTL2
+definitions. No functional change intended.
+
+Link: https://lore.kernel.org/r/20191112173503.176611-4-helgaas@kernel.org
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/cik.c | 22 ++++++++++++++--------
+ drivers/gpu/drm/amd/amdgpu/si.c | 22 ++++++++++++++--------
+ 2 files changed, 28 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
+index 40b62edd891f3..95b3a1f601e8b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/cik.c
++++ b/drivers/gpu/drm/amd/amdgpu/cik.c
+@@ -1491,13 +1491,19 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+
+ /* linkctl2 */
+ pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 7));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7)));
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (bridge_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
+ pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 7));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7)));
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (gpu_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
+ pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ tmp = RREG32_PCIE(ixPCIE_LC_CNTL4);
+@@ -1514,13 +1520,13 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ WREG32_PCIE(ixPCIE_LC_SPEED_CNTL, speed_cntl);
+
+ pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~0xf;
++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
+- tmp16 |= 3; /* gen3 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
+- tmp16 |= 2; /* gen2 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+- tmp16 |= 1; /* gen1 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
+ pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE(ixPCIE_LC_SPEED_CNTL);
+diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
+index 3b9e944bee180..e5fe304a28156 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si.c
++++ b/drivers/gpu/drm/amd/amdgpu/si.c
+@@ -1662,13 +1662,19 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
+
+ pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 7));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7)));
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (bridge_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
+ pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 7));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7)));
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (gpu_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
+ pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+@@ -1683,13 +1689,13 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl);
+
+ pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~0xf;
++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
+- tmp16 |= 3;
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
+- tmp16 |= 2;
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+- tmp16 |= 1;
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
+ pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
+--
+2.40.1
+
--- /dev/null
+From 3c2ca041d147ec04689cb28f9feaddda98690807 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jul 2023 15:04:57 +0300
+Subject: drm/amdgpu: Use RMW accessors for changing LNKCTL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit ce7d88110b9ed5f33fe79ea6d4ed049fb0e57bce ]
+
+Don't assume that only the driver would be accessing LNKCTL. ASPM policy
+changes can trigger write to LNKCTL outside of driver's control. And in
+the case of upstream bridge, the driver does not even own the device it's
+changing the registers for.
+
+Use RMW capability accessors which do proper locking to avoid losing
+concurrent updates to the register value.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts")
+Fixes: 62a37553414a ("drm/amdgpu: add si implementation v10")
+Link: https://lore.kernel.org/r/20230717120503.15276-6-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/cik.c | 36 +++++++++-----------------------
+ drivers/gpu/drm/amd/amdgpu/si.c | 36 +++++++++-----------------------
+ 2 files changed, 20 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
+index 35f9bcd17b1b2..7ff16edcda266 100644
+--- a/drivers/gpu/drm/amd/amdgpu/cik.c
++++ b/drivers/gpu/drm/amd/amdgpu/cik.c
+@@ -1421,17 +1421,8 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
+- &bridge_cfg);
+- pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL,
+- &gpu_cfg);
+-
+- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
+-
+- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL,
+- tmp16);
++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+
+ tmp = RREG32_PCIE(ixPCIE_LC_STATUS1);
+ max_lw = (tmp & PCIE_LC_STATUS1__LC_DETECTED_LINK_WIDTH_MASK) >>
+@@ -1484,21 +1475,14 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ msleep(100);
+
+ /* linkctl */
+- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
+- &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pcie_capability_write_word(root, PCI_EXP_LNKCTL,
+- tmp16);
+-
+- pcie_capability_read_word(adev->pdev,
+- PCI_EXP_LNKCTL,
+- &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pcie_capability_write_word(adev->pdev,
+- PCI_EXP_LNKCTL,
+- tmp16);
++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ bridge_cfg &
++ PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ gpu_cfg &
++ PCI_EXP_LNKCTL_HAWD);
+
+ /* linkctl2 */
+ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
+diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
+index c6516f82f29c8..580d74f26b69f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si.c
++++ b/drivers/gpu/drm/amd/amdgpu/si.c
+@@ -1601,17 +1601,8 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
+- &bridge_cfg);
+- pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL,
+- &gpu_cfg);
+-
+- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
+-
+- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL,
+- tmp16);
++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+
+ tmp = RREG32_PCIE(PCIE_LC_STATUS1);
+ max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
+@@ -1656,21 +1647,14 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+
+ mdelay(100);
+
+- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
+- &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pcie_capability_write_word(root, PCI_EXP_LNKCTL,
+- tmp16);
+-
+- pcie_capability_read_word(adev->pdev,
+- PCI_EXP_LNKCTL,
+- &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pcie_capability_write_word(adev->pdev,
+- PCI_EXP_LNKCTL,
+- tmp16);
++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ bridge_cfg &
++ PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ gpu_cfg &
++ PCI_EXP_LNKCTL_HAWD);
+
+ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
+ &tmp16);
+--
+2.40.1
+
--- /dev/null
+From bbdb88221f0c7106e0137ce4421ec170bde3ba08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Aug 2023 22:45:21 +0200
+Subject: drm/msm/mdp5: Don't leak some plane state
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+[ Upstream commit fd0ad3b2365c1c58aa5a761c18efc4817193beb6 ]
+
+Apparently no one noticed that mdp5 plane states leak like a sieve
+ever since we introduced plane_state->commit refcount a few years ago
+in 21a01abbe32a ("drm/atomic: Fix freeing connector/plane state too
+early by tracking commits, v3.")
+
+Fix it by using the right helpers.
+
+Fixes: 21a01abbe32a ("drm/atomic: Fix freeing connector/plane state too early by tracking commits, v3.")
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Rob Clark <robdclark@gmail.com>
+Cc: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Cc: linux-arm-msm@vger.kernel.org
+Cc: freedreno@lists.freedesktop.org
+Reported-and-tested-by: dorum@noisolation.com
+Cc: dorum@noisolation.com
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Reviewed-by: Rob Clark <robdclark@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/551236/
+Link: https://lore.kernel.org/r/20230803204521.928582-1-daniel.vetter@ffwll.ch
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+index 0cbc43f61d9c7..cd5b9ee22a5bb 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+@@ -230,8 +230,7 @@ static void mdp5_plane_destroy_state(struct drm_plane *plane,
+ {
+ struct mdp5_plane_state *pstate = to_mdp5_plane_state(state);
+
+- if (state->fb)
+- drm_framebuffer_put(state->fb);
++ __drm_atomic_helper_plane_destroy_state(state);
+
+ kfree(pstate);
+ }
+--
+2.40.1
+
--- /dev/null
+From 424bfd83e7c76e211d9e22440d1ac2f064affd9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 13:48:57 +0200
+Subject: drm/msm: Replace drm_framebuffer_{un/reference} with put, get
+ functions
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit f2152d492ca4ff6d53b37edf1a137480c909f6ce ]
+
+This patch unifies the naming of DRM functions for reference counting
+of struct drm_framebuffer. The resulting code is more aligned with the
+rest of the Linux kernel interfaces.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Stable-dep-of: fd0ad3b2365c ("drm/msm/mdp5: Don't leak some plane state")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+index 501d7989b9a5f..0cbc43f61d9c7 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+@@ -185,7 +185,7 @@ static void mdp5_plane_reset(struct drm_plane *plane)
+ struct mdp5_plane_state *mdp5_state;
+
+ if (plane->state && plane->state->fb)
+- drm_framebuffer_unreference(plane->state->fb);
++ drm_framebuffer_put(plane->state->fb);
+
+ kfree(to_mdp5_plane_state(plane->state));
+ plane->state = NULL;
+@@ -231,7 +231,7 @@ static void mdp5_plane_destroy_state(struct drm_plane *plane,
+ struct mdp5_plane_state *pstate = to_mdp5_plane_state(state);
+
+ if (state->fb)
+- drm_framebuffer_unreference(state->fb);
++ drm_framebuffer_put(state->fb);
+
+ kfree(pstate);
+ }
+--
+2.40.1
+
--- /dev/null
+From 1ac466c9e7dc32240d87d114cb1aff223859b13a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 17:54:13 -0600
+Subject: drm/radeon: Correct Transmit Margin masks
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 40bd4be5a652ce56068a8273b68caa38cb0d8f4b ]
+
+Previously we masked PCIe Link Control 2 register values with "7 << 9",
+which was apparently intended to be the Transmit Margin field, but instead
+was the high order bit of Transmit Margin, the Enter Modified Compliance
+bit, and the Compliance SOS bit.
+
+Correct the mask to "7 << 7", which is the Transmit Margin field.
+
+Link: https://lore.kernel.org/r/20191112173503.176611-3-helgaas@kernel.org
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 7189576e8a82 ("drm/radeon: Use RMW accessors for changing LNKCTL")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/cik.c | 8 ++++----
+ drivers/gpu/drm/radeon/si.c | 8 ++++----
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 827d551962d98..bd009d12b1571 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -9615,13 +9615,13 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+
+ /* linkctl2 */
+ pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9)));
++ tmp16 &= ~((1 << 4) | (7 << 7));
++ tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7)));
+ pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9)));
++ tmp16 &= ~((1 << 4) | (7 << 7));
++ tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7)));
+ pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 639f0698f961c..7ed5d7970108c 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -7198,13 +7198,13 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+
+ /* linkctl2 */
+ pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9)));
++ tmp16 &= ~((1 << 4) | (7 << 7));
++ tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7)));
+ pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9)));
++ tmp16 &= ~((1 << 4) | (7 << 7));
++ tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7)));
+ pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+--
+2.40.1
+
--- /dev/null
+From b5c24331b5e79edea81a82204a17f55fc4945491 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Nov 2019 18:35:13 -0600
+Subject: drm/radeon: Prefer pcie_capability_read_word()
+
+From: Frederick Lawler <fred@fredlawl.com>
+
+[ Upstream commit 3d581b11e34a92350983e5d3ecf469b5c677e295 ]
+
+Commit 8c0d3a02c130 ("PCI: Add accessors for PCI Express Capability")
+added accessors for the PCI Express Capability so that drivers didn't
+need to be aware of differences between v1 and v2 of the PCI
+Express Capability.
+
+Replace pci_read_config_word() and pci_write_config_word() calls with
+pcie_capability_read_word() and pcie_capability_write_word().
+
+Link: https://lore.kernel.org/r/20191118003513.10852-1-fred@fredlawl.com
+Signed-off-by: Frederick Lawler <fred@fredlawl.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 7189576e8a82 ("drm/radeon: Use RMW accessors for changing LNKCTL")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/cik.c | 70 +++++++++++++++++++++-------------
+ drivers/gpu/drm/radeon/si.c | 73 +++++++++++++++++++++++-------------
+ 2 files changed, 90 insertions(+), 53 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 47e5c29a9c2f7..728d4306a8725 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -9500,7 +9500,6 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ {
+ struct pci_dev *root = rdev->pdev->bus->self;
+ enum pci_bus_speed speed_cap;
+- int bridge_pos, gpu_pos;
+ u32 speed_cntl, current_data_rate;
+ int i;
+ u16 tmp16;
+@@ -9542,12 +9541,7 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n");
+ }
+
+- bridge_pos = pci_pcie_cap(root);
+- if (!bridge_pos)
+- return;
+-
+- gpu_pos = pci_pcie_cap(rdev->pdev);
+- if (!gpu_pos)
++ if (!pci_is_pcie(root) || !pci_is_pcie(rdev->pdev))
+ return;
+
+ if (speed_cap == PCIE_SPEED_8_0GT) {
+@@ -9557,14 +9551,17 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+ tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
+
+ tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL,
++ tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_STATUS1);
+ max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
+@@ -9582,15 +9579,23 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+
+ for (i = 0; i < 10; i++) {
+ /* check status */
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_DEVSTA,
++ &tmp16);
+ if (tmp16 & PCI_EXP_DEVSTA_TRPND)
+ break;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &bridge_cfg2);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ &gpu_cfg2);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp |= LC_SET_QUIESCE;
+@@ -9603,32 +9608,45 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ mdelay(100);
+
+ /* linkctl */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+ tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(root, PCI_EXP_LNKCTL,
++ tmp16);
+
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL,
++ &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+ tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(rdev->pdev,
++ PCI_EXP_LNKCTL,
++ tmp16);
+
+ /* linkctl2 */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &tmp16);
+ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN);
+ tmp16 |= (bridge_cfg2 &
+ (PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN));
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(root,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ &tmp16);
+ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN);
+ tmp16 |= (gpu_cfg2 &
+ (PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN));
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp &= ~LC_SET_QUIESCE;
+@@ -9642,7 +9660,7 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE;
+ WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl);
+
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL2, &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
+ if (speed_cap == PCIE_SPEED_8_0GT)
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+@@ -9650,7 +9668,7 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
+ speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE;
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 53ef1bff057e9..1bf1fffbaa946 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -3253,7 +3253,7 @@ static void si_gpu_init(struct radeon_device *rdev)
+ /* XXX what about 12? */
+ rdev->config.si.tile_config |= (3 << 0);
+ break;
+- }
++ }
+ switch ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) {
+ case 0: /* four banks */
+ rdev->config.si.tile_config |= 0 << 4;
+@@ -7083,7 +7083,6 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ {
+ struct pci_dev *root = rdev->pdev->bus->self;
+ enum pci_bus_speed speed_cap;
+- int bridge_pos, gpu_pos;
+ u32 speed_cntl, current_data_rate;
+ int i;
+ u16 tmp16;
+@@ -7125,12 +7124,7 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n");
+ }
+
+- bridge_pos = pci_pcie_cap(root);
+- if (!bridge_pos)
+- return;
+-
+- gpu_pos = pci_pcie_cap(rdev->pdev);
+- if (!gpu_pos)
++ if (!pci_is_pcie(root) || !pci_is_pcie(rdev->pdev))
+ return;
+
+ if (speed_cap == PCIE_SPEED_8_0GT) {
+@@ -7140,14 +7134,17 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+ tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
+
+ tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL,
++ tmp16);
+
+ tmp = RREG32_PCIE(PCIE_LC_STATUS1);
+ max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
+@@ -7165,15 +7162,23 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+
+ for (i = 0; i < 10; i++) {
+ /* check status */
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_DEVSTA,
++ &tmp16);
+ if (tmp16 & PCI_EXP_DEVSTA_TRPND)
+ break;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &bridge_cfg2);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ &gpu_cfg2);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp |= LC_SET_QUIESCE;
+@@ -7186,32 +7191,46 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ mdelay(100);
+
+ /* linkctl */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+ tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(root,
++ PCI_EXP_LNKCTL,
++ tmp16);
+
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL,
++ &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+ tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_write_word(rdev->pdev,
++ PCI_EXP_LNKCTL,
++ tmp16);
+
+ /* linkctl2 */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &tmp16);
+ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN);
+ tmp16 |= (bridge_cfg2 &
+ (PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN));
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(root,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ &tmp16);
+ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN);
+ tmp16 |= (gpu_cfg2 &
+ (PCI_EXP_LNKCTL2_ENTER_COMP |
+ PCI_EXP_LNKCTL2_TX_MARGIN));
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp &= ~LC_SET_QUIESCE;
+@@ -7225,7 +7244,7 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE;
+ WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl);
+
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL2, &tmp16);
+ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
+ if (speed_cap == PCIE_SPEED_8_0GT)
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+@@ -7233,7 +7252,7 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
+ speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE;
+--
+2.40.1
+
--- /dev/null
+From 96ebcf4edb0a87326ae5496825da01caa69df39b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 07:24:24 -0600
+Subject: drm/radeon: Replace numbers with PCI_EXP_LNKCTL2 definitions
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit ca56f99c18cafdeae6961ce9d87fc978506152ca ]
+
+Replace hard-coded magic numbers with the descriptive PCI_EXP_LNKCTL2
+definitions. No functional change intended.
+
+Link: https://lore.kernel.org/r/20191112173503.176611-4-helgaas@kernel.org
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 7189576e8a82 ("drm/radeon: Use RMW accessors for changing LNKCTL")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/cik.c | 22 ++++++++++++++--------
+ drivers/gpu/drm/radeon/si.c | 22 ++++++++++++++--------
+ 2 files changed, 28 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index bd009d12b1571..47e5c29a9c2f7 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -9615,13 +9615,19 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+
+ /* linkctl2 */
+ pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 7));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7)));
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (bridge_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
+ pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 7));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7)));
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (gpu_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
+ pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+@@ -9637,13 +9643,13 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl);
+
+ pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~0xf;
++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
+ if (speed_cap == PCIE_SPEED_8_0GT)
+- tmp16 |= 3; /* gen3 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+ else if (speed_cap == PCIE_SPEED_5_0GT)
+- tmp16 |= 2; /* gen2 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+- tmp16 |= 1; /* gen1 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
+ pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 7ed5d7970108c..53ef1bff057e9 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -7198,13 +7198,19 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+
+ /* linkctl2 */
+ pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 7));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7)));
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (bridge_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
+ pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 7));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7)));
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (gpu_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
+ pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+@@ -7220,13 +7226,13 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl);
+
+ pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~0xf;
++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
+ if (speed_cap == PCIE_SPEED_8_0GT)
+- tmp16 |= 3; /* gen3 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+ else if (speed_cap == PCIE_SPEED_5_0GT)
+- tmp16 |= 2; /* gen2 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+- tmp16 |= 1; /* gen1 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
+ pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
+--
+2.40.1
+
--- /dev/null
+From 76e10fe9c00b6653390b4ce171c54198ff030108 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jul 2023 15:04:58 +0300
+Subject: drm/radeon: Use RMW accessors for changing LNKCTL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 7189576e8a829130192b33c5b64e8a475369c776 ]
+
+Don't assume that only the driver would be accessing LNKCTL. ASPM policy
+changes can trigger write to LNKCTL outside of driver's control. And in
+the case of upstream bridge, the driver does not even own the device it's
+changing the registers for.
+
+Use RMW capability accessors which do proper locking to avoid losing
+concurrent updates to the register value.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Fixes: 8a7cd27679d0 ("drm/radeon/cik: add support for pcie gen1/2/3 switching")
+Fixes: b9d305dfb66c ("drm/radeon: implement pcie gen2/3 support for SI")
+Link: https://lore.kernel.org/r/20230717120503.15276-7-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/cik.c | 36 ++++++++++-------------------------
+ drivers/gpu/drm/radeon/si.c | 37 ++++++++++--------------------------
+ 2 files changed, 20 insertions(+), 53 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 728d4306a8725..643f74c231c5d 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -9551,17 +9551,8 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
+- &bridge_cfg);
+- pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL,
+- &gpu_cfg);
+-
+- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
+-
+- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL,
+- tmp16);
++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_STATUS1);
+ max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
+@@ -9608,21 +9599,14 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ mdelay(100);
+
+ /* linkctl */
+- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
+- &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pcie_capability_write_word(root, PCI_EXP_LNKCTL,
+- tmp16);
+-
+- pcie_capability_read_word(rdev->pdev,
+- PCI_EXP_LNKCTL,
+- &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pcie_capability_write_word(rdev->pdev,
+- PCI_EXP_LNKCTL,
+- tmp16);
++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ bridge_cfg &
++ PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ gpu_cfg &
++ PCI_EXP_LNKCTL_HAWD);
+
+ /* linkctl2 */
+ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 1bf1fffbaa946..644ddd8d65ad5 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -7134,17 +7134,8 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
+- &bridge_cfg);
+- pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL,
+- &gpu_cfg);
+-
+- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
+-
+- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL,
+- tmp16);
++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+
+ tmp = RREG32_PCIE(PCIE_LC_STATUS1);
+ max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
+@@ -7191,22 +7182,14 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ mdelay(100);
+
+ /* linkctl */
+- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
+- &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pcie_capability_write_word(root,
+- PCI_EXP_LNKCTL,
+- tmp16);
+-
+- pcie_capability_read_word(rdev->pdev,
+- PCI_EXP_LNKCTL,
+- &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pcie_capability_write_word(rdev->pdev,
+- PCI_EXP_LNKCTL,
+- tmp16);
++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ bridge_cfg &
++ PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ gpu_cfg &
++ PCI_EXP_LNKCTL_HAWD);
+
+ /* linkctl2 */
+ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
+--
+2.40.1
+
--- /dev/null
+From de837e25ffe1564409e42a0c39e29a48efba7fc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jul 2023 11:23:49 +0800
+Subject: drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
+
+From: Yangtao Li <frank.li@vivo.com>
+
+[ Upstream commit 2a1ca44b654346cadfc538c4fb32eecd8daf3140 ]
+
+When platform_get_irq fails, we should return dpaux->irq
+instead of -ENXIO.
+
+Fixes: 6b6b604215c6 ("drm/tegra: Add eDP support")
+Signed-off-by: Yangtao Li <frank.li@vivo.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230710032355.72914-13-frank.li@vivo.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dpaux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
+index bed9efe36a1eb..7d9be2f56ab1e 100644
+--- a/drivers/gpu/drm/tegra/dpaux.c
++++ b/drivers/gpu/drm/tegra/dpaux.c
+@@ -450,7 +450,7 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+
+ dpaux->irq = platform_get_irq(pdev, 0);
+ if (dpaux->irq < 0)
+- return -ENXIO;
++ return dpaux->irq;
+
+ if (!pdev->dev.pm_domain) {
+ dpaux->rst = devm_reset_control_get(&pdev->dev, "dpaux");
+--
+2.40.1
+
--- /dev/null
+From ee3f35e14070321e1088b3f11418a753e63bf055 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jun 2021 14:39:55 +0800
+Subject: drm/tegra: Remove superfluous error messages around
+ platform_get_irq()
+
+From: Tan Zhongjun <tanzhongjun@yulong.com>
+
+[ Upstream commit d12919bb5da571ec50588ef97683d37e36dc2de5 ]
+
+The platform_get_irq() prints error message telling that interrupt is
+missing,hence there is no need to duplicated that message in the
+drivers.
+
+Signed-off-by: Tan Zhongjun <tanzhongjun@yulong.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Stable-dep-of: 2a1ca44b6543 ("drm/tegra: dpaux: Fix incorrect return value of platform_get_irq")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dpaux.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
+index d84e81ff36ad0..bed9efe36a1eb 100644
+--- a/drivers/gpu/drm/tegra/dpaux.c
++++ b/drivers/gpu/drm/tegra/dpaux.c
+@@ -449,10 +449,8 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+ return PTR_ERR(dpaux->regs);
+
+ dpaux->irq = platform_get_irq(pdev, 0);
+- if (dpaux->irq < 0) {
+- dev_err(&pdev->dev, "failed to get IRQ\n");
++ if (dpaux->irq < 0)
+ return -ENXIO;
+- }
+
+ if (!pdev->dev.pm_domain) {
+ dpaux->rst = devm_reset_control_get(&pdev->dev, "dpaux");
+--
+2.40.1
+
--- /dev/null
+From 14a7f9e1310a17aef4e673e32931f137e317d5bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 13:55:21 +0000
+Subject: eventfd: Export eventfd_ctx_do_read()
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+[ Upstream commit 28f1326710555bbe666f64452d08f2d7dd657cae ]
+
+Where events are consumed in the kernel, for example by KVM's
+irqfd_wakeup() and VFIO's virqfd_wakeup(), they currently lack a
+mechanism to drain the eventfd's counter.
+
+Since the wait queue is already locked while the wakeup functions are
+invoked, all they really need to do is call eventfd_ctx_do_read().
+
+Add a check for the lock, and export it for them.
+
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Message-Id: <20201027135523.646811-2-dwmw2@infradead.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Stable-dep-of: 758b49204781 ("eventfd: prevent underflow for eventfd semaphores")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/eventfd.c | 5 ++++-
+ include/linux/eventfd.h | 6 ++++++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/fs/eventfd.c b/fs/eventfd.c
+index ce1d1711fbbaf..a96de1f0377bc 100644
+--- a/fs/eventfd.c
++++ b/fs/eventfd.c
+@@ -174,11 +174,14 @@ static __poll_t eventfd_poll(struct file *file, poll_table *wait)
+ return events;
+ }
+
+-static void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
++void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
+ {
++ lockdep_assert_held(&ctx->wqh.lock);
++
+ *cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count;
+ ctx->count -= *cnt;
+ }
++EXPORT_SYMBOL_GPL(eventfd_ctx_do_read);
+
+ /**
+ * eventfd_ctx_remove_wait_queue - Read the current counter and removes wait queue.
+diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
+index 3482f9365a4db..de0ad39d4281f 100644
+--- a/include/linux/eventfd.h
++++ b/include/linux/eventfd.h
+@@ -41,6 +41,7 @@ struct eventfd_ctx *eventfd_ctx_fileget(struct file *file);
+ __u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n);
+ int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_entry_t *wait,
+ __u64 *cnt);
++void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt);
+
+ DECLARE_PER_CPU(int, eventfd_wake_count);
+
+@@ -82,6 +83,11 @@ static inline bool eventfd_signal_count(void)
+ return false;
+ }
+
++static inline void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
++{
++
++}
++
+ #endif
+
+ #endif /* _LINUX_EVENTFD_H */
+--
+2.40.1
+
--- /dev/null
+From 375e2c06869dc8ce3c1171e10ab28310cb631ea8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Jul 2023 14:54:51 +0800
+Subject: eventfd: prevent underflow for eventfd semaphores
+
+From: Wen Yang <wenyang.linux@foxmail.com>
+
+[ Upstream commit 758b492047816a3158d027e9fca660bc5bcf20bf ]
+
+For eventfd with flag EFD_SEMAPHORE, when its ctx->count is 0, calling
+eventfd_ctx_do_read will cause ctx->count to overflow to ULLONG_MAX.
+
+An underflow can happen with EFD_SEMAPHORE eventfds in at least the
+following three subsystems:
+
+(1) virt/kvm/eventfd.c
+(2) drivers/vfio/virqfd.c
+(3) drivers/virt/acrn/irqfd.c
+
+where (2) and (3) are just modeled after (1). An eventfd must be
+specified for use with the KVM_IRQFD ioctl(). This can also be an
+EFD_SEMAPHORE eventfd. When the eventfd count is zero or has been
+decremented to zero an underflow can be triggered when the irqfd is shut
+down by raising the KVM_IRQFD_FLAG_DEASSIGN flag in the KVM_IRQFD
+ioctl():
+
+ // ctx->count == 0
+ kvm_vm_ioctl()
+ -> kvm_irqfd()
+ -> kvm_irqfd_deassign()
+ -> irqfd_deactivate()
+ -> irqfd_shutdown()
+ -> eventfd_ctx_remove_wait_queue(&cnt)
+ -> eventfd_ctx_do_read(&cnt)
+
+Userspace polling on the eventfd wouldn't notice the underflow because 1
+is always returned as the value from eventfd_read() while ctx->count
+would've underflowed. It's not a huge deal because this should only be
+happening when the irqfd is shutdown but we should still fix it and
+avoid the spurious wakeup.
+
+Fixes: cb289d6244a3 ("eventfd - allow atomic read and waitqueue remove")
+Signed-off-by: Wen Yang <wenyang.linux@foxmail.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Dylan Yudaken <dylany@fb.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: linux-fsdevel@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Message-Id: <tencent_7588DFD1F365950A757310D764517A14B306@qq.com>
+[brauner: rewrite commit message and add explanation how this underflow can happen]
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/eventfd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/eventfd.c b/fs/eventfd.c
+index a96de1f0377bc..66864100b823c 100644
+--- a/fs/eventfd.c
++++ b/fs/eventfd.c
+@@ -178,7 +178,7 @@ void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
+ {
+ lockdep_assert_held(&ctx->wqh.lock);
+
+- *cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count;
++ *cnt = ((ctx->flags & EFD_SEMAPHORE) && ctx->count) ? 1 : ctx->count;
+ ctx->count -= *cnt;
+ }
+ EXPORT_SYMBOL_GPL(eventfd_ctx_do_read);
+--
+2.40.1
+
--- /dev/null
+From 316f17143099ebc32b41563a5968438fb7f561d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jul 2023 20:05:42 +0800
+Subject: fs: Fix error checking for d_hash_and_lookup()
+
+From: Wang Ming <machel@vivo.com>
+
+[ Upstream commit 0d5a4f8f775ff990142cdc810a84eae078589d27 ]
+
+The d_hash_and_lookup() function returns error pointers or NULL.
+Most incorrect error checks were fixed, but the one in int path_pts()
+was forgotten.
+
+Fixes: eedf265aa003 ("devpts: Make each mount of devpts an independent filesystem.")
+Signed-off-by: Wang Ming <machel@vivo.com>
+Message-Id: <20230713120555.7025-1-machel@vivo.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namei.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/namei.c b/fs/namei.c
+index 0dbe38afef29b..60b57e0bc1742 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -2613,7 +2613,7 @@ int path_pts(struct path *path)
+ this.name = "pts";
+ this.len = 3;
+ child = d_hash_and_lookup(parent, &this);
+- if (!child)
++ if (IS_ERR_OR_NULL(child))
+ return -ENOENT;
+
+ path->dentry = child;
+--
+2.40.1
+
--- /dev/null
+From 87cedd000ff5bf316dd900cbac63a6ca36e6483d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Aug 2023 09:26:57 +0800
+Subject: fs: lockd: avoid possible wrong NULL parameter
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit de8d38cf44bac43e83bad28357ba84784c412752 ]
+
+clang's static analysis warning: fs/lockd/mon.c: line 293, column 2:
+Null pointer passed as 2nd argument to memory copy function.
+
+Assuming 'hostname' is NULL and calling 'nsm_create_handle()', this will
+pass NULL as 2nd argument to memory copy function 'memcpy()'. So return
+NULL if 'hostname' is invalid.
+
+Fixes: 77a3ef33e2de ("NSM: More clean up of nsm_get_handle()")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/lockd/mon.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
+index 654594ef4f945..68a2eac548c3c 100644
+--- a/fs/lockd/mon.c
++++ b/fs/lockd/mon.c
+@@ -275,6 +275,9 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap,
+ {
+ struct nsm_handle *new;
+
++ if (!hostname)
++ return NULL;
++
+ new = kzalloc(sizeof(*new) + hostname_len + 1, GFP_KERNEL);
+ if (unlikely(new == NULL))
+ return NULL;
+--
+2.40.1
+
--- /dev/null
+From fa07136c73c876618590dab02cee83a1b0d44a43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Aug 2023 17:54:17 +0300
+Subject: fs: ocfs2: namei: check return value of ocfs2_add_entry()
+
+From: Artem Chernyshev <artem.chernyshev@red-soft.ru>
+
+[ Upstream commit 6b72e5f9e79360fce4f2be7fe81159fbdf4256a5 ]
+
+Process result of ocfs2_add_entry() in case we have an error
+value.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Link: https://lkml.kernel.org/r/20230803145417.177649-1-artem.chernyshev@red-soft.ru
+Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
+Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Artem Chernyshev <artem.chernyshev@red-soft.ru>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Kurt Hackel <kurt.hackel@oracle.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/namei.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
+index bd8d742adf65a..bb8483510327f 100644
+--- a/fs/ocfs2/namei.c
++++ b/fs/ocfs2/namei.c
+@@ -1538,6 +1538,10 @@ static int ocfs2_rename(struct inode *old_dir,
+ status = ocfs2_add_entry(handle, new_dentry, old_inode,
+ OCFS2_I(old_inode)->ip_blkno,
+ new_dir_bh, &target_insert);
++ if (status < 0) {
++ mlog_errno(status);
++ goto bail;
++ }
+ }
+
+ old_inode->i_ctime = current_time(old_inode);
+--
+2.40.1
+
--- /dev/null
+From c58d70b4df10fabf5b8c63afd31626867e8106e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Aug 2023 06:14:33 +0000
+Subject: HID: multitouch: Correct devm device reference for hidinput input_dev
+ name
+
+From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+
+[ Upstream commit 4794394635293a3e74591351fff469cea7ad15a2 ]
+
+Reference the HID device rather than the input device for the devm
+allocation of the input_dev name. Referencing the input_dev would lead to a
+use-after-free when the input_dev was unregistered and subsequently fires a
+uevent that depends on the name. At the point of firing the uevent, the
+name would be freed by devres management.
+
+Use devm_kasprintf to simplify the logic for allocating memory and
+formatting the input_dev name string.
+
+Reported-by: Maxime Ripard <mripard@kernel.org>
+Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae
+Fixes: c08d46aa805b ("HID: multitouch: devm conversion")
+Suggested-by: Maxime Ripard <mripard@kernel.org>
+Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://lore.kernel.org/r/20230824061308.222021-3-sergeantsagara@protonmail.com
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-multitouch.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 4b1c223be9933..6411ee12c7a30 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1540,7 +1540,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app)
+ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ {
+ struct mt_device *td = hid_get_drvdata(hdev);
+- char *name;
+ const char *suffix = NULL;
+ struct mt_report_data *rdata;
+ struct mt_application *mt_application = NULL;
+@@ -1594,15 +1593,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ break;
+ }
+
+- if (suffix) {
+- name = devm_kzalloc(&hi->input->dev,
+- strlen(hdev->name) + strlen(suffix) + 2,
+- GFP_KERNEL);
+- if (name) {
+- sprintf(name, "%s %s", hdev->name, suffix);
+- hi->input->name = name;
+- }
+- }
++ if (suffix)
++ hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
++ "%s %s", hdev->name, suffix);
+
+ return 0;
+ }
+--
+2.40.1
+
--- /dev/null
+From e81f5b82161d580cb788510fd9374a80d86d30ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Aug 2023 10:25:25 +0800
+Subject: IB/uverbs: Fix an potential error pointer dereference
+
+From: Xiang Yang <xiangyang3@huawei.com>
+
+[ Upstream commit 26b7d1a27167e7adf75b150755e05d2bc123ce55 ]
+
+smatch reports the warning below:
+drivers/infiniband/core/uverbs_std_types_counters.c:110
+ib_uverbs_handler_UVERBS_METHOD_COUNTERS_READ() error: 'uattr'
+dereferencing possible ERR_PTR()
+
+The return value of uattr maybe ERR_PTR(-ENOENT), fix this by checking
+the value of uattr before using it.
+
+Fixes: ebb6796bd397 ("IB/uverbs: Add read counters support")
+Signed-off-by: Xiang Yang <xiangyang3@huawei.com>
+Link: https://lore.kernel.org/r/20230804022525.1916766-1-xiangyang3@huawei.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/uverbs_std_types_counters.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/core/uverbs_std_types_counters.c b/drivers/infiniband/core/uverbs_std_types_counters.c
+index a0ffdcf9a51cd..bb3a03cdc9742 100644
+--- a/drivers/infiniband/core/uverbs_std_types_counters.c
++++ b/drivers/infiniband/core/uverbs_std_types_counters.c
+@@ -103,6 +103,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_COUNTERS_READ)(
+ return ret;
+
+ uattr = uverbs_attr_get(attrs, UVERBS_ATTR_READ_COUNTERS_BUFF);
++ if (IS_ERR(uattr))
++ return PTR_ERR(uattr);
+ read_attr.ncounters = uattr->ptr_attr.len / sizeof(u64);
+ read_attr.counters_buff = uverbs_zalloc(
+ attrs, array_size(read_attr.ncounters, sizeof(u64)));
+--
+2.40.1
+
--- /dev/null
+From 0ebe811d8c34ca05a29b0cfa2d667a1d7c0e71d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Aug 2023 20:32:16 +0300
+Subject: jfs: validate max amount of blocks before allocation.
+
+From: Alexei Filippov <halip0503@gmail.com>
+
+[ Upstream commit 0225e10972fa809728b8d4c1bd2772b3ec3fdb57 ]
+
+The lack of checking bmp->db_max_freebud in extBalloc() can lead to
+shift out of bounds, so this patch prevents undefined behavior, because
+bmp->db_max_freebud == -1 only if there is no free space.
+
+Signed-off-by: Aleksei Filippov <halip0503@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-and-tested-by: syzbot+5f088f29593e6b4c8db8@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?id=01abadbd6ae6a08b1f1987aa61554c6b3ac19ff2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_extent.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/jfs/jfs_extent.c b/fs/jfs/jfs_extent.c
+index 2ae7d59ab10a5..c971e8a6525de 100644
+--- a/fs/jfs/jfs_extent.c
++++ b/fs/jfs/jfs_extent.c
+@@ -521,6 +521,11 @@ extBalloc(struct inode *ip, s64 hint, s64 * nblocks, s64 * blkno)
+ * blocks in the map. in that case, we'll start off with the
+ * maximum free.
+ */
++
++ /* give up if no space left */
++ if (bmp->db_maxfreebud == -1)
++ return -ENOSPC;
++
+ max = (s64) 1 << bmp->db_maxfreebud;
+ if (*nblocks >= max && *nblocks > nbperpage)
+ nb = nblks = (max > nbperpage) ? max : nbperpage;
+--
+2.40.1
+
--- /dev/null
+From acdac18412043f6bbd000c1a1d1eb50e535095ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 19:58:14 -0700
+Subject: lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
+
+From: Yan Zhai <yan@cloudflare.com>
+
+[ Upstream commit a171fbec88a2c730b108c7147ac5e7b2f5a02b47 ]
+
+LWTUNNEL_XMIT_CONTINUE is implicitly assumed in ip(6)_finish_output2,
+such that any positive return value from a xmit hook could cause
+unexpected continue behavior, despite that related skb may have been
+freed. This could be error-prone for future xmit hook ops. One of the
+possible errors is to return statuses of dst_output directly.
+
+To make the code safer, redefine LWTUNNEL_XMIT_CONTINUE value to
+distinguish from dst_output statuses and check the continue
+condition explicitly.
+
+Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure")
+Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Yan Zhai <yan@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/96b939b85eda00e8df4f7c080f770970a4c5f698.1692326837.git.yan@cloudflare.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/lwtunnel.h | 5 ++++-
+ net/ipv4/ip_output.c | 2 +-
+ net/ipv6/ip6_output.c | 2 +-
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
+index 33fd9ba7e0e5a..ec75c0a1c529f 100644
+--- a/include/net/lwtunnel.h
++++ b/include/net/lwtunnel.h
+@@ -16,9 +16,12 @@
+ #define LWTUNNEL_STATE_INPUT_REDIRECT BIT(1)
+ #define LWTUNNEL_STATE_XMIT_REDIRECT BIT(2)
+
++/* LWTUNNEL_XMIT_CONTINUE should be distinguishable from dst_output return
++ * values (NET_XMIT_xxx and NETDEV_TX_xxx in linux/netdevice.h) for safety.
++ */
+ enum {
+ LWTUNNEL_XMIT_DONE,
+- LWTUNNEL_XMIT_CONTINUE,
++ LWTUNNEL_XMIT_CONTINUE = 0x100,
+ };
+
+
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 92fa11e75a4d0..6936f703758bb 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -221,7 +221,7 @@ static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *s
+ if (lwtunnel_xmit_redirect(dst->lwtstate)) {
+ int res = lwtunnel_xmit(skb);
+
+- if (res < 0 || res == LWTUNNEL_XMIT_DONE)
++ if (res != LWTUNNEL_XMIT_CONTINUE)
+ return res;
+ }
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 4f31a781ab370..ff4d349e13f78 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -106,7 +106,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
+ if (lwtunnel_xmit_redirect(dst->lwtstate)) {
+ int res = lwtunnel_xmit(skb);
+
+- if (res < 0 || res == LWTUNNEL_XMIT_DONE)
++ if (res != LWTUNNEL_XMIT_CONTINUE)
+ return res;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From a3ad07d093466d55c5c7bb1a91a8500838bd0cc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Aug 2023 21:53:55 +0800
+Subject: md/raid1: free the r1bio before waiting for blocked rdev
+
+From: Xueshi Hu <xueshi.hu@smartx.com>
+
+[ Upstream commit 992db13a4aee766c8bfbf046ad15c2db5fa7cab8 ]
+
+Raid1 reshape will change mempool and r1conf::raid_disks which are
+needed to free r1bio. allow_barrier() make a concurrent raid1_reshape()
+possible. So, free the in-flight r1bio before waiting blocked rdev.
+
+Fixes: 6bfe0b499082 ("md: support blocking writes to an array on device failure")
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Xueshi Hu <xueshi.hu@smartx.com>
+Link: https://lore.kernel.org/r/20230814135356.1113639-3-xueshi.hu@smartx.com
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid1.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 0f8b1fb3d0517..530a53aafc122 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1341,6 +1341,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
+ */
+ wait_barrier(conf, bio->bi_iter.bi_sector);
+
++ retry_write:
+ r1_bio = alloc_r1bio(mddev, bio);
+ r1_bio->sectors = max_write_sectors;
+
+@@ -1362,7 +1363,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
+ */
+
+ disks = conf->raid_disks * 2;
+- retry_write:
+ blocked_rdev = NULL;
+ rcu_read_lock();
+ max_sectors = r1_bio->sectors;
+@@ -1433,7 +1433,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
+ for (j = 0; j < i; j++)
+ if (r1_bio->bios[j])
+ rdev_dec_pending(conf->mirrors[j].rdev, mddev);
+- r1_bio->state = 0;
++ free_r1bio(r1_bio);
+ allow_barrier(conf, bio->bi_iter.bi_sector);
+ raid1_log(mddev, "wait rdev %d blocked", blocked_rdev->raid_disk);
+ md_wait_for_blocked_rdev(blocked_rdev, mddev);
+--
+2.40.1
+
--- /dev/null
+From b0bc88c25eec302a0b2dcf91ec53f3b37b4af637 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Aug 2023 21:53:56 +0800
+Subject: md/raid1: hold the barrier until handle_read_error() finishes
+
+From: Xueshi Hu <xueshi.hu@smartx.com>
+
+[ Upstream commit c069da449a13669ffa754fd971747e7e17e7d691 ]
+
+handle_read_error() will call allow_barrier() to match the former barrier
+raising. However, it should put the allow_barrier() at the end to avoid a
+concurrent raid reshape.
+
+Fixes: 689389a06ce7 ("md/raid1: simplify handle_read_error().")
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Xueshi Hu <xueshi.hu@smartx.com>
+Link: https://lore.kernel.org/r/20230814135356.1113639-4-xueshi.hu@smartx.com
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid1.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 530a53aafc122..2bb0f8be7e870 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -2458,6 +2458,7 @@ static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio)
+ struct mddev *mddev = conf->mddev;
+ struct bio *bio;
+ struct md_rdev *rdev;
++ sector_t sector;
+
+ clear_bit(R1BIO_ReadError, &r1_bio->state);
+ /* we got a read error. Maybe the drive is bad. Maybe just
+@@ -2487,12 +2488,13 @@ static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio)
+ }
+
+ rdev_dec_pending(rdev, conf->mddev);
+- allow_barrier(conf, r1_bio->sector);
++ sector = r1_bio->sector;
+ bio = r1_bio->master_bio;
+
+ /* Reuse the old r1_bio so that the IO_BLOCKED settings are preserved */
+ r1_bio->state = 0;
+ raid1_read_request(mddev, bio, r1_bio->sectors, r1_bio);
++ allow_barrier(conf, sector);
+ }
+
+ static void raid1d(struct md_thread *thread)
+--
+2.40.1
+
--- /dev/null
+From 438bf0ce3411ed739139d1d54981f497341cae7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 01:55:01 -0700
+Subject: media: cx24120: Add retval check for cx24120_message_send()
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit 96002c0ac824e1773d3f706b1f92e2a9f2988047 ]
+
+If cx24120_message_send() returns error, we should keep local struct
+unchanged.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 5afc9a25be8d ("[media] Add support for TechniSat Skystar S2")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/cx24120.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/dvb-frontends/cx24120.c b/drivers/media/dvb-frontends/cx24120.c
+index dd3ec316e7c2a..d6107f3270a6d 100644
+--- a/drivers/media/dvb-frontends/cx24120.c
++++ b/drivers/media/dvb-frontends/cx24120.c
+@@ -980,7 +980,9 @@ static void cx24120_set_clock_ratios(struct dvb_frontend *fe)
+ cmd.arg[8] = (clock_ratios_table[idx].rate >> 8) & 0xff;
+ cmd.arg[9] = (clock_ratios_table[idx].rate >> 0) & 0xff;
+
+- cx24120_message_send(state, &cmd);
++ ret = cx24120_message_send(state, &cmd);
++ if (ret != 0)
++ return;
+
+ /* Calculate ber window rates for stat work */
+ cx24120_calculate_ber_window(state, clock_ratios_table[idx].rate);
+--
+2.40.1
+
--- /dev/null
+From 8d8aedc8f687b33573ad6b748f37b74d2ca58ef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 06:38:32 -0700
+Subject: media: dib7000p: Fix potential division by zero
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit a1db7b2c5533fc67e2681eb5efc921a67bc7d5b8 ]
+
+Variable loopdiv can be assigned 0, then it is used as a denominator,
+without checking it for 0.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 713d54a8bd81 ("[media] DiB7090: add support for the dib7090 based")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+[hverkuil: (bw != NULL) -> bw]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/dib7000p.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
+index 58387860b62dc..f478b4859f44e 100644
+--- a/drivers/media/dvb-frontends/dib7000p.c
++++ b/drivers/media/dvb-frontends/dib7000p.c
+@@ -500,7 +500,7 @@ static int dib7000p_update_pll(struct dvb_frontend *fe, struct dibx000_bandwidth
+ prediv = reg_1856 & 0x3f;
+ loopdiv = (reg_1856 >> 6) & 0x3f;
+
+- if ((bw != NULL) && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) {
++ if (loopdiv && bw && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) {
+ dprintk("Updating pll (prediv: old = %d new = %d ; loopdiv : old = %d new = %d)\n", prediv, bw->pll_prediv, loopdiv, bw->pll_ratio);
+ reg_1856 &= 0xf000;
+ reg_1857 = dib7000p_read_word(state, 1857);
+--
+2.40.1
+
--- /dev/null
+From 2eb3e6f329542542b85876d5084bf241735dbd68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 May 2023 07:58:36 +0200
+Subject: media: dvb-usb: m920x: Fix a potential memory leak in
+ m920x_i2c_xfer()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ea9ef6c2e001c5dc94bee35ebd1c8a98621cf7b8 ]
+
+'read' is freed when it is known to be NULL, but not when a read error
+occurs.
+
+Revert the logic to avoid a small leak, should a m920x_read() call fail.
+
+Fixes: a2ab06d7c4d6 ("media: m920x: don't use stack on USB reads")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb/m920x.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/m920x.c
+index 3b2a0f36fc38e..e5491b9b8825c 100644
+--- a/drivers/media/usb/dvb-usb/m920x.c
++++ b/drivers/media/usb/dvb-usb/m920x.c
+@@ -280,7 +280,6 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu
+ char *read = kmalloc(1, GFP_KERNEL);
+ if (!read) {
+ ret = -ENOMEM;
+- kfree(read);
+ goto unlock;
+ }
+
+@@ -291,8 +290,10 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu
+
+ if ((ret = m920x_read(d->udev, M9206_I2C, 0x0,
+ 0x20 | stop,
+- read, 1)) != 0)
++ read, 1)) != 0) {
++ kfree(read);
+ goto unlock;
++ }
+ msg[i].buf[j] = read[0];
+ }
+
+--
+2.40.1
+
--- /dev/null
+From f15565b4df803dcd311ba196c53b34d00cc85c10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jul 2023 19:40:07 +0200
+Subject: media: go7007: Remove redundant if statement
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit f33cb49081da0ec5af0888f8ecbd566bd326eed1 ]
+
+The if statement that compares msgs[i].len != 3 is always false because
+it is in a code block where msg[i].len is equal to 3. The check is
+redundant and can be removed.
+
+As detected by cppcheck static analysis:
+drivers/media/usb/go7007/go7007-i2c.c:168:20: warning: Opposite inner
+'if' condition leads to a dead code block. [oppositeInnerCondition]
+
+Link: https://lore.kernel.org/linux-media/20230727174007.635572-1-colin.i.king@gmail.com
+
+Fixes: 866b8695d67e ("Staging: add the go7007 video driver")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/go7007/go7007-i2c.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/media/usb/go7007/go7007-i2c.c b/drivers/media/usb/go7007/go7007-i2c.c
+index c084bf794b567..64f25d4e52b20 100644
+--- a/drivers/media/usb/go7007/go7007-i2c.c
++++ b/drivers/media/usb/go7007/go7007-i2c.c
+@@ -173,8 +173,6 @@ static int go7007_i2c_master_xfer(struct i2c_adapter *adapter,
+ } else if (msgs[i].len == 3) {
+ if (msgs[i].flags & I2C_M_RD)
+ return -EIO;
+- if (msgs[i].len != 3)
+- return -EIO;
+ if (go7007_i2c_xfer(go, msgs[i].addr, 0,
+ (msgs[i].buf[0] << 8) | msgs[i].buf[1],
+ 0x01, &msgs[i].buf[2]) < 0)
+--
+2.40.1
+
--- /dev/null
+From 0b28d0be06d46d4b2248814883a3743b93c364f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Dec 2022 15:21:45 +0000
+Subject: media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 66274280b2c745d380508dc27b9a4dfd736e5eda ]
+
+The driver changes the Bayer order based on the flips, but
+does not define the control correctly with the
+V4L2_CTRL_FLAG_MODIFY_LAYOUT flag.
+
+Add the V4L2_CTRL_FLAG_MODIFY_LAYOUT flag.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Stable-dep-of: 7b5a42e6ae71 ("media: ov2680: Remove auto-gain and auto-exposure controls")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2680.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index d8798fb714ba8..426386b94fff4 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -969,6 +969,8 @@ static int ov2680_v4l2_init(struct ov2680_dev *sensor)
+
+ ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
+ ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
++ ctrls->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++ ctrls->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
+
+ v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
+ v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true);
+--
+2.40.1
+
--- /dev/null
+From 0136fb65b618739f3523c5ed75b5e274cbe96a7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jul 2023 17:14:41 +0800
+Subject: media: mediatek: vcodec: Return NULL if no vdec_fb is found
+
+From: Irui Wang <irui.wang@mediatek.com>
+
+[ Upstream commit dfa2d6e07432270330ae191f50a0e70636a4cd2b ]
+
+"fb_use_list" is used to store used or referenced frame buffers for
+vp9 stateful decoder. "NULL" should be returned when getting target
+frame buffer failed from "fb_use_list", not a random unexpected one.
+
+Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver")
+Signed-off-by: Irui Wang <irui.wang@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+index bc8349bc2e80c..2c0d89a46410a 100644
+--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
++++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+@@ -230,10 +230,11 @@ static struct vdec_fb *vp9_rm_from_fb_use_list(struct vdec_vp9_inst
+ if (fb->base_y.va == addr) {
+ list_move_tail(&node->list,
+ &inst->available_fb_node_list);
+- break;
++ return fb;
+ }
+ }
+- return fb;
++
++ return NULL;
+ }
+
+ static void vp9_add_to_fb_free_list(struct vdec_vp9_inst *inst,
+--
+2.40.1
+
--- /dev/null
+From e91b22e7b6474a32cd21d1f0af57e4ffe9946d6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Aug 2023 11:33:17 +0200
+Subject: media: ov2680: Fix ov2680_bayer_order()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 50a7bad4e0a37d7018ab6fe843dd84bc6b2ecf72 ]
+
+The index into ov2680_hv_flip_bayer_order[] should be 0-3, but
+ov2680_bayer_order() was using 0 + BIT(2) + (BIT(2) << 1) as
+max index, while the intention was to use: 0 + 1 + 2 as max index.
+
+Fix the index calculation in ov2680_bayer_order(), while at it
+also just use the ctrl values rather then reading them back using
+a slow i2c-read transaction.
+
+This also allows making the function void, since there now are
+no more i2c-reads to error check.
+
+Note the check for the ctrls being NULL is there to allow
+adding an ov2680_fill_format() helper later, which will call
+ov2680_set_bayer_order() during probe() before the ctrls are created.
+
+[Sakari Ailus: Change all users of ov2680_set_bayer_order() here]
+
+Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver")
+Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
+Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2680.c | 33 ++++++++++++++-------------------
+ 1 file changed, 14 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index 1cb319c85b582..96513c86c8f66 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -315,26 +315,17 @@ static void ov2680_power_down(struct ov2680_dev *sensor)
+ usleep_range(5000, 10000);
+ }
+
+-static int ov2680_bayer_order(struct ov2680_dev *sensor)
++static void ov2680_set_bayer_order(struct ov2680_dev *sensor)
+ {
+- u32 format1;
+- u32 format2;
+- u32 hv_flip;
+- int ret;
+-
+- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT1, &format1);
+- if (ret < 0)
+- return ret;
++ int hv_flip = 0;
+
+- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT2, &format2);
+- if (ret < 0)
+- return ret;
++ if (sensor->ctrls.vflip && sensor->ctrls.vflip->val)
++ hv_flip += 1;
+
+- hv_flip = (format2 & BIT(2) << 1) | (format1 & BIT(2));
++ if (sensor->ctrls.hflip && sensor->ctrls.hflip->val)
++ hv_flip += 2;
+
+ sensor->fmt.code = ov2680_hv_flip_bayer_order[hv_flip];
+-
+- return 0;
+ }
+
+ static int ov2680_vflip_enable(struct ov2680_dev *sensor)
+@@ -345,7 +336,8 @@ static int ov2680_vflip_enable(struct ov2680_dev *sensor)
+ if (ret < 0)
+ return ret;
+
+- return ov2680_bayer_order(sensor);
++ ov2680_set_bayer_order(sensor);
++ return 0;
+ }
+
+ static int ov2680_vflip_disable(struct ov2680_dev *sensor)
+@@ -356,7 +348,8 @@ static int ov2680_vflip_disable(struct ov2680_dev *sensor)
+ if (ret < 0)
+ return ret;
+
+- return ov2680_bayer_order(sensor);
++ ov2680_set_bayer_order(sensor);
++ return 0;
+ }
+
+ static int ov2680_hflip_enable(struct ov2680_dev *sensor)
+@@ -367,7 +360,8 @@ static int ov2680_hflip_enable(struct ov2680_dev *sensor)
+ if (ret < 0)
+ return ret;
+
+- return ov2680_bayer_order(sensor);
++ ov2680_set_bayer_order(sensor);
++ return 0;
+ }
+
+ static int ov2680_hflip_disable(struct ov2680_dev *sensor)
+@@ -378,7 +372,8 @@ static int ov2680_hflip_disable(struct ov2680_dev *sensor)
+ if (ret < 0)
+ return ret;
+
+- return ov2680_bayer_order(sensor);
++ ov2680_set_bayer_order(sensor);
++ return 0;
+ }
+
+ static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value)
+--
+2.40.1
+
--- /dev/null
+From 18e36ea745701c1a93c8c5d774f510c5cb53d2e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Aug 2023 11:33:23 +0200
+Subject: media: ov2680: Fix regulators being left enabled on ov2680_power_on()
+ errors
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 84b4bd7e0d98166aa32fd470e672721190492eae ]
+
+When the ov2680_power_on() "sensor soft reset failed" path is hit during
+probe() the WARN() about putting an enabled regulator at
+drivers/regulator/core.c:2398 triggers 3 times (once for each regulator),
+filling dmesg with backtraces.
+
+Fix this by properly disabling the regulators on ov2680_power_on() errors.
+
+Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver")
+Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
+Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2680.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index 142c6c1721649..40d583a972a41 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -459,7 +459,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
+ ret = ov2680_write_reg(sensor, OV2680_REG_SOFT_RESET, 0x01);
+ if (ret != 0) {
+ dev_err(dev, "sensor soft reset failed\n");
+- return ret;
++ goto err_disable_regulators;
+ }
+ usleep_range(1000, 2000);
+ } else {
+@@ -469,7 +469,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
+
+ ret = clk_prepare_enable(sensor->xvclk);
+ if (ret < 0)
+- return ret;
++ goto err_disable_regulators;
+
+ sensor->is_enabled = true;
+
+@@ -479,6 +479,10 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
+ ov2680_stream_disable(sensor);
+
+ return 0;
++
++err_disable_regulators:
++ regulator_bulk_disable(OV2680_NUM_SUPPLIES, sensor->supplies);
++ return ret;
+ }
+
+ static int ov2680_s_power(struct v4l2_subdev *sd, int on)
+--
+2.40.1
+
--- /dev/null
+From 986c1b66ae146949fff026f2433846018ca18252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Aug 2023 11:33:18 +0200
+Subject: media: ov2680: Fix vflip / hflip set functions
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit d5d08ad330c9ccebc5e066fda815423a290f48b0 ]
+
+ov2680_vflip_disable() / ov2680_hflip_disable() pass BIT(0) instead of
+0 as value to ov2680_mod_reg().
+
+While fixing this also:
+
+1. Stop having separate enable/disable functions for hflip / vflip
+2. Move the is_streaming check, which is unique to hflip / vflip
+ into the ov2680_set_?flip() functions.
+
+for a nice code cleanup.
+
+Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver")
+Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
+Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2680.c | 50 +++++++++-----------------------------
+ 1 file changed, 12 insertions(+), 38 deletions(-)
+
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index 96513c86c8f66..142c6c1721649 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -328,23 +328,15 @@ static void ov2680_set_bayer_order(struct ov2680_dev *sensor)
+ sensor->fmt.code = ov2680_hv_flip_bayer_order[hv_flip];
+ }
+
+-static int ov2680_vflip_enable(struct ov2680_dev *sensor)
++static int ov2680_set_vflip(struct ov2680_dev *sensor, s32 val)
+ {
+ int ret;
+
+- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(2));
+- if (ret < 0)
+- return ret;
+-
+- ov2680_set_bayer_order(sensor);
+- return 0;
+-}
+-
+-static int ov2680_vflip_disable(struct ov2680_dev *sensor)
+-{
+- int ret;
++ if (sensor->is_streaming)
++ return -EBUSY;
+
+- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(0));
++ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1,
++ BIT(2), val ? BIT(2) : 0);
+ if (ret < 0)
+ return ret;
+
+@@ -352,23 +344,15 @@ static int ov2680_vflip_disable(struct ov2680_dev *sensor)
+ return 0;
+ }
+
+-static int ov2680_hflip_enable(struct ov2680_dev *sensor)
++static int ov2680_set_hflip(struct ov2680_dev *sensor, s32 val)
+ {
+ int ret;
+
+- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(2));
+- if (ret < 0)
+- return ret;
+-
+- ov2680_set_bayer_order(sensor);
+- return 0;
+-}
+-
+-static int ov2680_hflip_disable(struct ov2680_dev *sensor)
+-{
+- int ret;
++ if (sensor->is_streaming)
++ return -EBUSY;
+
+- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(0));
++ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2,
++ BIT(2), val ? BIT(2) : 0);
+ if (ret < 0)
+ return ret;
+
+@@ -724,19 +708,9 @@ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl)
+ case V4L2_CID_EXPOSURE:
+ return ov2680_exposure_set(sensor, ctrl->val);
+ case V4L2_CID_VFLIP:
+- if (sensor->is_streaming)
+- return -EBUSY;
+- if (ctrl->val)
+- return ov2680_vflip_enable(sensor);
+- else
+- return ov2680_vflip_disable(sensor);
++ return ov2680_set_vflip(sensor, ctrl->val);
+ case V4L2_CID_HFLIP:
+- if (sensor->is_streaming)
+- return -EBUSY;
+- if (ctrl->val)
+- return ov2680_hflip_enable(sensor);
+- else
+- return ov2680_hflip_disable(sensor);
++ return ov2680_set_hflip(sensor, ctrl->val);
+ case V4L2_CID_TEST_PATTERN:
+ return ov2680_test_pattern_set(sensor, ctrl->val);
+ default:
+--
+2.40.1
+
--- /dev/null
+From 2db9eaf406d920cf37651c84f252b1b5d222d5c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Aug 2023 11:33:16 +0200
+Subject: media: ov2680: Remove auto-gain and auto-exposure controls
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 7b5a42e6ae71927359ea67a2c22570ba97fa4059 ]
+
+Quoting the OV2680 datasheet:
+
+"3.2 exposure and gain control
+
+In the OV2680, the exposure time and gain are set manually from an external
+controller. The OV2680 supports manual gain and exposure control only for
+normal applications, no auto mode."
+
+And indeed testing with the atomisp_ov2680 fork of ov2680.c has shown that
+auto-exposure and auto-gain do not work.
+
+Note that the code setting the auto-exposure flag was broken, callers
+of ov2680_exposure_set() were directly passing !!ctrls->auto_exp->val as
+"bool auto_exp" value, but ctrls->auto_exp is a menu control with:
+
+enum v4l2_exposure_auto_type {
+ V4L2_EXPOSURE_AUTO = 0,
+ V4L2_EXPOSURE_MANUAL = 1,
+ ...
+
+So instead of passing !!ctrls->auto_exp->val they should have been passing
+ctrls->auto_exp->val == V4L2_EXPOSURE_AUTO, iow the passed value was
+inverted of what it should have been.
+
+Also remove ov2680_g_volatile_ctrl() since without auto support the gain
+and exposure controls are not volatile.
+
+This also fixes the control values not being properly applied in
+ov2680_mode_set(). The 800x600 mode register-list also sets gain,
+exposure and vflip overriding the last set ctrl values.
+
+ov2680_mode_set() does call ov2680_gain_set() and ov2680_exposure_set()
+but did this before writing the mode register-list, so these values
+would still be overridden by the mode register-list.
+
+Add a v4l2_ctrl_handler_setup() call after writing the mode register-list
+to restore all ctrl values. Also remove the ctrls->gain->is_new check from
+ov2680_gain_set() so that the gain always gets restored properly.
+
+Last since ov2680_mode_set() now calls v4l2_ctrl_handler_setup(), remove
+the v4l2_ctrl_handler_setup() call after ov2680_mode_restore() since
+ov2680_mode_restore() calls ov2680_mode_set().
+
+Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver")
+Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
+Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2680.c | 161 ++++---------------------------------
+ 1 file changed, 17 insertions(+), 144 deletions(-)
+
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index 426386b94fff4..1cb319c85b582 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -85,15 +85,8 @@ struct ov2680_mode_info {
+
+ struct ov2680_ctrls {
+ struct v4l2_ctrl_handler handler;
+- struct {
+- struct v4l2_ctrl *auto_exp;
+- struct v4l2_ctrl *exposure;
+- };
+- struct {
+- struct v4l2_ctrl *auto_gain;
+- struct v4l2_ctrl *gain;
+- };
+-
++ struct v4l2_ctrl *exposure;
++ struct v4l2_ctrl *gain;
+ struct v4l2_ctrl *hflip;
+ struct v4l2_ctrl *vflip;
+ struct v4l2_ctrl *test_pattern;
+@@ -143,6 +136,7 @@ static const struct reg_value ov2680_setting_30fps_QUXGA_800_600[] = {
+ {0x380e, 0x02}, {0x380f, 0x84}, {0x3811, 0x04}, {0x3813, 0x04},
+ {0x3814, 0x31}, {0x3815, 0x31}, {0x3820, 0xc0}, {0x4008, 0x00},
+ {0x4009, 0x03}, {0x4837, 0x1e}, {0x3501, 0x4e}, {0x3502, 0xe0},
++ {0x3503, 0x03},
+ };
+
+ static const struct reg_value ov2680_setting_30fps_720P_1280_720[] = {
+@@ -405,69 +399,15 @@ static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value)
+ return 0;
+ }
+
+-static int ov2680_gain_set(struct ov2680_dev *sensor, bool auto_gain)
+-{
+- struct ov2680_ctrls *ctrls = &sensor->ctrls;
+- u32 gain;
+- int ret;
+-
+- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(1),
+- auto_gain ? 0 : BIT(1));
+- if (ret < 0)
+- return ret;
+-
+- if (auto_gain || !ctrls->gain->is_new)
+- return 0;
+-
+- gain = ctrls->gain->val;
+-
+- ret = ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain);
+-
+- return 0;
+-}
+-
+-static int ov2680_gain_get(struct ov2680_dev *sensor)
+-{
+- u32 gain;
+- int ret;
+-
+- ret = ov2680_read_reg16(sensor, OV2680_REG_GAIN_PK, &gain);
+- if (ret)
+- return ret;
+-
+- return gain;
+-}
+-
+-static int ov2680_exposure_set(struct ov2680_dev *sensor, bool auto_exp)
++static int ov2680_gain_set(struct ov2680_dev *sensor, u32 gain)
+ {
+- struct ov2680_ctrls *ctrls = &sensor->ctrls;
+- u32 exp;
+- int ret;
+-
+- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(0),
+- auto_exp ? 0 : BIT(0));
+- if (ret < 0)
+- return ret;
+-
+- if (auto_exp || !ctrls->exposure->is_new)
+- return 0;
+-
+- exp = (u32)ctrls->exposure->val;
+- exp <<= 4;
+-
+- return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, exp);
++ return ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain);
+ }
+
+-static int ov2680_exposure_get(struct ov2680_dev *sensor)
++static int ov2680_exposure_set(struct ov2680_dev *sensor, u32 exp)
+ {
+- int ret;
+- u32 exp;
+-
+- ret = ov2680_read_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, &exp);
+- if (ret)
+- return ret;
+-
+- return exp >> 4;
++ return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH,
++ exp << 4);
+ }
+
+ static int ov2680_stream_enable(struct ov2680_dev *sensor)
+@@ -482,33 +422,17 @@ static int ov2680_stream_disable(struct ov2680_dev *sensor)
+
+ static int ov2680_mode_set(struct ov2680_dev *sensor)
+ {
+- struct ov2680_ctrls *ctrls = &sensor->ctrls;
+ int ret;
+
+- ret = ov2680_gain_set(sensor, false);
+- if (ret < 0)
+- return ret;
+-
+- ret = ov2680_exposure_set(sensor, false);
++ ret = ov2680_load_regs(sensor, sensor->current_mode);
+ if (ret < 0)
+ return ret;
+
+- ret = ov2680_load_regs(sensor, sensor->current_mode);
++ /* Restore value of all ctrls */
++ ret = __v4l2_ctrl_handler_setup(&sensor->ctrls.handler);
+ if (ret < 0)
+ return ret;
+
+- if (ctrls->auto_gain->val) {
+- ret = ov2680_gain_set(sensor, true);
+- if (ret < 0)
+- return ret;
+- }
+-
+- if (ctrls->auto_exp->val == V4L2_EXPOSURE_AUTO) {
+- ret = ov2680_exposure_set(sensor, true);
+- if (ret < 0)
+- return ret;
+- }
+-
+ sensor->mode_pending_changes = false;
+
+ return 0;
+@@ -590,15 +514,10 @@ static int ov2680_s_power(struct v4l2_subdev *sd, int on)
+ else
+ ret = ov2680_power_off(sensor);
+
+- mutex_unlock(&sensor->lock);
+-
+- if (on && ret == 0) {
+- ret = v4l2_ctrl_handler_setup(&sensor->ctrls.handler);
+- if (ret < 0)
+- return ret;
+-
++ if (on && ret == 0)
+ ret = ov2680_mode_restore(sensor);
+- }
++
++ mutex_unlock(&sensor->lock);
+
+ return ret;
+ }
+@@ -796,52 +715,19 @@ static int ov2680_enum_frame_interval(struct v4l2_subdev *sd,
+ return 0;
+ }
+
+-static int ov2680_g_volatile_ctrl(struct v4l2_ctrl *ctrl)
+-{
+- struct v4l2_subdev *sd = ctrl_to_sd(ctrl);
+- struct ov2680_dev *sensor = to_ov2680_dev(sd);
+- struct ov2680_ctrls *ctrls = &sensor->ctrls;
+- int val;
+-
+- if (!sensor->is_enabled)
+- return 0;
+-
+- switch (ctrl->id) {
+- case V4L2_CID_GAIN:
+- val = ov2680_gain_get(sensor);
+- if (val < 0)
+- return val;
+- ctrls->gain->val = val;
+- break;
+- case V4L2_CID_EXPOSURE:
+- val = ov2680_exposure_get(sensor);
+- if (val < 0)
+- return val;
+- ctrls->exposure->val = val;
+- break;
+- }
+-
+- return 0;
+-}
+-
+ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ struct v4l2_subdev *sd = ctrl_to_sd(ctrl);
+ struct ov2680_dev *sensor = to_ov2680_dev(sd);
+- struct ov2680_ctrls *ctrls = &sensor->ctrls;
+
+ if (!sensor->is_enabled)
+ return 0;
+
+ switch (ctrl->id) {
+- case V4L2_CID_AUTOGAIN:
+- return ov2680_gain_set(sensor, !!ctrl->val);
+ case V4L2_CID_GAIN:
+- return ov2680_gain_set(sensor, !!ctrls->auto_gain->val);
+- case V4L2_CID_EXPOSURE_AUTO:
+- return ov2680_exposure_set(sensor, !!ctrl->val);
++ return ov2680_gain_set(sensor, ctrl->val);
+ case V4L2_CID_EXPOSURE:
+- return ov2680_exposure_set(sensor, !!ctrls->auto_exp->val);
++ return ov2680_exposure_set(sensor, ctrl->val);
+ case V4L2_CID_VFLIP:
+ if (sensor->is_streaming)
+ return -EBUSY;
+@@ -866,7 +752,6 @@ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl)
+ }
+
+ static const struct v4l2_ctrl_ops ov2680_ctrl_ops = {
+- .g_volatile_ctrl = ov2680_g_volatile_ctrl,
+ .s_ctrl = ov2680_s_ctrl,
+ };
+
+@@ -938,7 +823,7 @@ static int ov2680_v4l2_init(struct ov2680_dev *sensor)
+ if (ret < 0)
+ return ret;
+
+- v4l2_ctrl_handler_init(hdl, 7);
++ v4l2_ctrl_handler_init(hdl, 5);
+
+ hdl->lock = &sensor->lock;
+
+@@ -950,16 +835,9 @@ static int ov2680_v4l2_init(struct ov2680_dev *sensor)
+ ARRAY_SIZE(test_pattern_menu) - 1,
+ 0, 0, test_pattern_menu);
+
+- ctrls->auto_exp = v4l2_ctrl_new_std_menu(hdl, ops,
+- V4L2_CID_EXPOSURE_AUTO,
+- V4L2_EXPOSURE_MANUAL, 0,
+- V4L2_EXPOSURE_AUTO);
+-
+ ctrls->exposure = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_EXPOSURE,
+ 0, 32767, 1, 0);
+
+- ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_AUTOGAIN,
+- 0, 1, 1, 1);
+ ctrls->gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_GAIN, 0, 2047, 1, 0);
+
+ if (hdl->error) {
+@@ -967,14 +845,9 @@ static int ov2680_v4l2_init(struct ov2680_dev *sensor)
+ goto cleanup_entity;
+ }
+
+- ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
+- ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
+ ctrls->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
+ ctrls->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
+
+- v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
+- v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true);
+-
+ sensor->sd.ctrl_handler = hdl;
+
+ ret = v4l2_async_register_subdev(&sensor->sd);
+--
+2.40.1
+
--- /dev/null
+From d52a64ff2e95e14ba52b6f000d80eb2d69b8a7ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 14:35:19 -0500
+Subject: media: Use of_node_name_eq for node name comparisons
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 2fc6e404117e5b921097c929ba572a00e4421b50 ]
+
+Convert string compares of DT node names to use of_node_name_eq helper
+instead. This removes direct access to the node name pointer.
+
+Cc: Kyungmin Park <kyungmin.park@samsung.com>
+Cc: Kukjin Kim <kgene@kernel.org>
+Cc: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: Hyun Kwon <hyun.kwon@xilinx.com>
+Cc: Michal Simek <michal.simek@xilinx.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-samsung-soc@vger.kernel.org
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Benoit Parrot <bparrot@ti.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Stable-dep-of: d7b13edd4cb4 ("media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/exynos4-is/media-dev.c | 12 ++++++------
+ drivers/media/platform/ti-vpe/cal.c | 4 ++--
+ drivers/media/platform/xilinx/xilinx-tpg.c | 2 +-
+ drivers/media/v4l2-core/v4l2-fwnode.c | 6 ++----
+ 4 files changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index 03171f2cf2968..5f50ea283a04f 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -445,7 +445,7 @@ static int fimc_md_parse_port_node(struct fimc_md *fmd,
+ */
+ np = of_get_parent(rem);
+
+- if (np && !of_node_cmp(np->name, "i2c-isp"))
++ if (of_node_name_eq(np, "i2c-isp"))
+ pd->fimc_bus_type = FIMC_BUS_TYPE_ISP_WRITEBACK;
+ else
+ pd->fimc_bus_type = pd->sensor_bus_type;
+@@ -492,7 +492,7 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd)
+ for_each_available_child_of_node(parent, node) {
+ struct device_node *port;
+
+- if (of_node_cmp(node->name, "csis"))
++ if (!of_node_name_eq(node, "csis"))
+ continue;
+ /* The csis node can have only port subnode. */
+ port = of_get_next_child(node, NULL);
+@@ -713,13 +713,13 @@ static int fimc_md_register_platform_entities(struct fimc_md *fmd,
+ continue;
+
+ /* If driver of any entity isn't ready try all again later. */
+- if (!strcmp(node->name, CSIS_OF_NODE_NAME))
++ if (of_node_name_eq(node, CSIS_OF_NODE_NAME))
+ plat_entity = IDX_CSIS;
+- else if (!strcmp(node->name, FIMC_IS_OF_NODE_NAME))
++ else if (of_node_name_eq(node, FIMC_IS_OF_NODE_NAME))
+ plat_entity = IDX_IS_ISP;
+- else if (!strcmp(node->name, FIMC_LITE_OF_NODE_NAME))
++ else if (of_node_name_eq(node, FIMC_LITE_OF_NODE_NAME))
+ plat_entity = IDX_FLITE;
+- else if (!strcmp(node->name, FIMC_OF_NODE_NAME) &&
++ else if (of_node_name_eq(node, FIMC_OF_NODE_NAME) &&
+ !of_property_read_bool(node, "samsung,lcd-wb"))
+ plat_entity = IDX_FIMC;
+
+diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
+index d945323fc437d..f9488e01a36f0 100644
+--- a/drivers/media/platform/ti-vpe/cal.c
++++ b/drivers/media/platform/ti-vpe/cal.c
+@@ -1618,7 +1618,7 @@ of_get_next_port(const struct device_node *parent,
+ return NULL;
+ }
+ prev = port;
+- } while (of_node_cmp(port->name, "port") != 0);
++ } while (!of_node_name_eq(port, "port"));
+ }
+
+ return port;
+@@ -1638,7 +1638,7 @@ of_get_next_endpoint(const struct device_node *parent,
+ if (!ep)
+ return NULL;
+ prev = ep;
+- } while (of_node_cmp(ep->name, "endpoint") != 0);
++ } while (!of_node_name_eq(ep, "endpoint"));
+
+ return ep;
+ }
+diff --git a/drivers/media/platform/xilinx/xilinx-tpg.c b/drivers/media/platform/xilinx/xilinx-tpg.c
+index 9c49d1d10bee5..06d25e5fafbf2 100644
+--- a/drivers/media/platform/xilinx/xilinx-tpg.c
++++ b/drivers/media/platform/xilinx/xilinx-tpg.c
+@@ -725,7 +725,7 @@ static int xtpg_parse_of(struct xtpg_device *xtpg)
+ const struct xvip_video_format *format;
+ struct device_node *endpoint;
+
+- if (!port->name || of_node_cmp(port->name, "port"))
++ if (!of_node_name_eq(port, "port"))
+ continue;
+
+ format = xvip_of_get_format(port);
+diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
+index 169bdbb1f61a5..8046871e89f87 100644
+--- a/drivers/media/v4l2-core/v4l2-fwnode.c
++++ b/drivers/media/v4l2-core/v4l2-fwnode.c
+@@ -290,8 +290,7 @@ int v4l2_fwnode_parse_link(struct fwnode_handle *__fwnode,
+ fwnode = fwnode_get_parent(__fwnode);
+ fwnode_property_read_u32(fwnode, port_prop, &link->local_port);
+ fwnode = fwnode_get_next_parent(fwnode);
+- if (is_of_node(fwnode) &&
+- of_node_cmp(to_of_node(fwnode)->name, "ports") == 0)
++ if (is_of_node(fwnode) && of_node_name_eq(to_of_node(fwnode), "ports"))
+ fwnode = fwnode_get_next_parent(fwnode);
+ link->local_node = fwnode;
+
+@@ -304,8 +303,7 @@ int v4l2_fwnode_parse_link(struct fwnode_handle *__fwnode,
+ fwnode = fwnode_get_parent(fwnode);
+ fwnode_property_read_u32(fwnode, port_prop, &link->remote_port);
+ fwnode = fwnode_get_next_parent(fwnode);
+- if (is_of_node(fwnode) &&
+- of_node_cmp(to_of_node(fwnode)->name, "ports") == 0)
++ if (is_of_node(fwnode) && of_node_name_eq(to_of_node(fwnode), "ports"))
+ fwnode = fwnode_get_next_parent(fwnode);
+ link->remote_node = fwnode;
+
+--
+2.40.1
+
--- /dev/null
+From 0f2e5345dff65a6549319694ade74d2dae9a0836 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 20:31:05 +0200
+Subject: media: v4l2-core: Fix a potential resource leak in
+ v4l2_fwnode_parse_link()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit d7b13edd4cb4bfa335b6008ab867ac28582d3e5c ]
+
+If fwnode_graph_get_remote_endpoint() fails, 'fwnode' is known to be NULL,
+so fwnode_handle_put() is a no-op.
+
+Release the reference taken from a previous fwnode_graph_get_port_parent()
+call instead.
+
+Also handle fwnode_graph_get_port_parent() failures.
+
+In order to fix these issues, add an error handling path to the function
+and the needed gotos.
+
+Fixes: ca50c197bd96 ("[media] v4l: fwnode: Support generic fwnode for parsing standardised properties")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-fwnode.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
+index 14530fddbef47..95079229a772b 100644
+--- a/drivers/media/v4l2-core/v4l2-fwnode.c
++++ b/drivers/media/v4l2-core/v4l2-fwnode.c
+@@ -289,18 +289,28 @@ int v4l2_fwnode_parse_link(struct fwnode_handle *fwnode,
+ fwnode_graph_parse_endpoint(fwnode, &fwep);
+ link->local_port = fwep.port;
+ link->local_node = fwnode_graph_get_port_parent(fwnode);
++ if (!link->local_node)
++ return -ENOLINK;
+
+ fwnode = fwnode_graph_get_remote_endpoint(fwnode);
+- if (!fwnode) {
+- fwnode_handle_put(fwnode);
+- return -ENOLINK;
+- }
++ if (!fwnode)
++ goto err_put_local_node;
+
+ fwnode_graph_parse_endpoint(fwnode, &fwep);
+ link->remote_port = fwep.port;
+ link->remote_node = fwnode_graph_get_port_parent(fwnode);
++ if (!link->remote_node)
++ goto err_put_remote_endpoint;
+
+ return 0;
++
++err_put_remote_endpoint:
++ fwnode_handle_put(fwnode);
++
++err_put_local_node:
++ fwnode_handle_put(link->local_node);
++
++ return -ENOLINK;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_fwnode_parse_link);
+
+--
+2.40.1
+
--- /dev/null
+From 59e7d42309adb317279f089d5e5227b3bc1806dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2020 11:31:39 +0100
+Subject: media: v4l2-fwnode: fix v4l2_fwnode_parse_link handling
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+[ Upstream commit 453b0c8304dcbc6eed2836de8fee90bf5bcc7006 ]
+
+Currently the driver differentiate the port number property handling for
+ACPI and DT. This is wrong as because ACPI should use the "reg" val too
+[1].
+
+[1] https://patchwork.kernel.org/patch/11421985/
+
+Fixes: ca50c197bd96 ("[media] v4l: fwnode: Support generic fwnode for parsing standardised properties")
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: d7b13edd4cb4 ("media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-fwnode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
+index 8046871e89f87..158548443fa7c 100644
+--- a/drivers/media/v4l2-core/v4l2-fwnode.c
++++ b/drivers/media/v4l2-core/v4l2-fwnode.c
+@@ -282,7 +282,7 @@ EXPORT_SYMBOL_GPL(v4l2_fwnode_endpoint_alloc_parse);
+ int v4l2_fwnode_parse_link(struct fwnode_handle *__fwnode,
+ struct v4l2_fwnode_link *link)
+ {
+- const char *port_prop = is_of_node(__fwnode) ? "reg" : "port";
++ const char *port_prop = "reg";
+ struct fwnode_handle *fwnode;
+
+ memset(link, 0, sizeof(*link));
+--
+2.40.1
+
--- /dev/null
+From fba252546411307f875bb9610e7e44d665332368 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2020 11:31:40 +0100
+Subject: media: v4l2-fwnode: simplify v4l2_fwnode_parse_link
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+[ Upstream commit 507a0ba93aa1cf2837d2abc4ab0cbad3c29409d3 ]
+
+This helper was introduced before those helpers where awailable. Convert
+it to cleanup the code and improbe readability.
+
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: d7b13edd4cb4 ("media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-fwnode.c | 25 +++++++++----------------
+ 1 file changed, 9 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
+index 158548443fa7c..14530fddbef47 100644
+--- a/drivers/media/v4l2-core/v4l2-fwnode.c
++++ b/drivers/media/v4l2-core/v4l2-fwnode.c
+@@ -279,33 +279,26 @@ struct v4l2_fwnode_endpoint *v4l2_fwnode_endpoint_alloc_parse(
+ }
+ EXPORT_SYMBOL_GPL(v4l2_fwnode_endpoint_alloc_parse);
+
+-int v4l2_fwnode_parse_link(struct fwnode_handle *__fwnode,
++int v4l2_fwnode_parse_link(struct fwnode_handle *fwnode,
+ struct v4l2_fwnode_link *link)
+ {
+- const char *port_prop = "reg";
+- struct fwnode_handle *fwnode;
++ struct fwnode_endpoint fwep;
+
+ memset(link, 0, sizeof(*link));
+
+- fwnode = fwnode_get_parent(__fwnode);
+- fwnode_property_read_u32(fwnode, port_prop, &link->local_port);
+- fwnode = fwnode_get_next_parent(fwnode);
+- if (is_of_node(fwnode) && of_node_name_eq(to_of_node(fwnode), "ports"))
+- fwnode = fwnode_get_next_parent(fwnode);
+- link->local_node = fwnode;
++ fwnode_graph_parse_endpoint(fwnode, &fwep);
++ link->local_port = fwep.port;
++ link->local_node = fwnode_graph_get_port_parent(fwnode);
+
+- fwnode = fwnode_graph_get_remote_endpoint(__fwnode);
++ fwnode = fwnode_graph_get_remote_endpoint(fwnode);
+ if (!fwnode) {
+ fwnode_handle_put(fwnode);
+ return -ENOLINK;
+ }
+
+- fwnode = fwnode_get_parent(fwnode);
+- fwnode_property_read_u32(fwnode, port_prop, &link->remote_port);
+- fwnode = fwnode_get_next_parent(fwnode);
+- if (is_of_node(fwnode) && of_node_name_eq(to_of_node(fwnode), "ports"))
+- fwnode = fwnode_get_next_parent(fwnode);
+- link->remote_node = fwnode;
++ fwnode_graph_parse_endpoint(fwnode, &fwep);
++ link->remote_port = fwep.port;
++ link->remote_node = fwnode_graph_get_port_parent(fwnode);
+
+ return 0;
+ }
+--
+2.40.1
+
--- /dev/null
+From 1bab321b1b0d49c78f7671b32c6af2a4f7c00de7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 10:28:58 -0700
+Subject: mwifiex: drop 'set_consistent_dma_mask' log message
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit f7369179ad32000973fc7a0a76603e0b41792b52 ]
+
+This message is pointless.
+
+While we're at it, include the error code in the error message, which is
+not pointless.
+
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Stable-dep-of: 288c63d5cb46 ("wifi: mwifiex: fix error recovery in PCIE buffer descriptor management")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/pcie.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
+index aea79fd54c311..6712b5097bcca 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -2939,10 +2939,9 @@ static int mwifiex_init_pcie(struct mwifiex_adapter *adapter)
+
+ pci_set_master(pdev);
+
+- pr_notice("try set_consistent_dma_mask(32)\n");
+ ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+ if (ret) {
+- pr_err("set_dma_mask(32) failed\n");
++ pr_err("set_dma_mask(32) failed: %d\n", ret);
+ goto err_set_dma_mask;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From 0a17d01f1a3d235e23af62643e5659cf6897f08c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Aug 2020 09:01:52 +0200
+Subject: mwifiex: switch from 'pci_' to 'dma_' API
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 4cf975f640fefdfdf6168a79e882558478ce057a ]
+
+The wrappers in include/linux/pci-dma-compat.h should go away.
+
+The patch has been generated with the coccinelle script below and has been
+hand modified to replace GFP_ with a correct flag.
+It has been compile tested.
+
+When memory is allocated in 'mwifiex_pcie_alloc_buffers()' (see details in
+the call chain below) GFP_KERNEL can be used because both
+'mwifiex_register()' and 'mwifiex_reinit_sw()' already use GFP_KERNEL.
+(for 'mwifiex_reinit_sw()', it is hidden in a call to 'alloc_workqueue()')
+
+The call chain is:
+ mwifiex_register
+ --> mwifiex_init_pcie (.init_if function, see mwifiex_if_ops)
+ [ or ]
+ mwifiex_reinit_sw
+ -->mwifiex_pcie_up_dev (.up_dev function, see mwifiex_if_ops)
+
+ [ then in both case ]
+ -->mwifiex_pcie_alloc_buffers
+ --> mwifiex_pcie_create_txbd_ring
+ --> mwifiex_pcie_create_rxbd_ring
+ --> mwifiex_pcie_create_evtbd_ring
+ --> mwifiex_pcie_alloc_sleep_cookie_buf
+
+@@
+@@
+- PCI_DMA_BIDIRECTIONAL
++ DMA_BIDIRECTIONAL
+
+@@
+@@
+- PCI_DMA_TODEVICE
++ DMA_TO_DEVICE
+
+@@
+@@
+- PCI_DMA_FROMDEVICE
++ DMA_FROM_DEVICE
+
+@@
+@@
+- PCI_DMA_NONE
++ DMA_NONE
+
+@@
+expression e1, e2, e3;
+@@
+- pci_alloc_consistent(e1, e2, e3)
++ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
+
+@@
+expression e1, e2, e3;
+@@
+- pci_zalloc_consistent(e1, e2, e3)
++ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_free_consistent(e1, e2, e3, e4)
++ dma_free_coherent(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_map_single(e1, e2, e3, e4)
++ dma_map_single(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_unmap_single(e1, e2, e3, e4)
++ dma_unmap_single(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4, e5;
+@@
+- pci_map_page(e1, e2, e3, e4, e5)
++ dma_map_page(&e1->dev, e2, e3, e4, e5)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_unmap_page(e1, e2, e3, e4)
++ dma_unmap_page(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_map_sg(e1, e2, e3, e4)
++ dma_map_sg(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_unmap_sg(e1, e2, e3, e4)
++ dma_unmap_sg(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_dma_sync_single_for_cpu(e1, e2, e3, e4)
++ dma_sync_single_for_cpu(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_dma_sync_single_for_device(e1, e2, e3, e4)
++ dma_sync_single_for_device(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_dma_sync_sg_for_cpu(e1, e2, e3, e4)
++ dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_dma_sync_sg_for_device(e1, e2, e3, e4)
++ dma_sync_sg_for_device(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2;
+@@
+- pci_dma_mapping_error(e1, e2)
++ dma_mapping_error(&e1->dev, e2)
+
+@@
+expression e1, e2;
+@@
+- pci_set_dma_mask(e1, e2)
++ dma_set_mask(&e1->dev, e2)
+
+@@
+expression e1, e2;
+@@
+- pci_set_consistent_dma_mask(e1, e2)
++ dma_set_coherent_mask(&e1->dev, e2)
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200819070152.111522-1-christophe.jaillet@wanadoo.fr
+Stable-dep-of: 288c63d5cb46 ("wifi: mwifiex: fix error recovery in PCIE buffer descriptor management")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/pcie.c | 153 ++++++++++----------
+ 1 file changed, 78 insertions(+), 75 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
+index 6712b5097bcca..4fce133c3dcac 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -58,8 +58,8 @@ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
+ struct pcie_service_card *card = adapter->card;
+ struct mwifiex_dma_mapping mapping;
+
+- mapping.addr = pci_map_single(card->dev, skb->data, size, flags);
+- if (pci_dma_mapping_error(card->dev, mapping.addr)) {
++ mapping.addr = dma_map_single(&card->dev->dev, skb->data, size, flags);
++ if (dma_mapping_error(&card->dev->dev, mapping.addr)) {
+ mwifiex_dbg(adapter, ERROR, "failed to map pci memory!\n");
+ return -1;
+ }
+@@ -75,7 +75,7 @@ static void mwifiex_unmap_pci_memory(struct mwifiex_adapter *adapter,
+ struct mwifiex_dma_mapping mapping;
+
+ mwifiex_get_mapping(skb, &mapping);
+- pci_unmap_single(card->dev, mapping.addr, mapping.len, flags);
++ dma_unmap_single(&card->dev->dev, mapping.addr, mapping.len, flags);
+ }
+
+ /*
+@@ -469,10 +469,9 @@ static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter,
+ struct sk_buff *cmdrsp = card->cmdrsp_buf;
+
+ for (count = 0; count < max_delay_loop_cnt; count++) {
+- pci_dma_sync_single_for_cpu(card->dev,
+- MWIFIEX_SKB_DMA_ADDR(cmdrsp),
+- sizeof(sleep_cookie),
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_cpu(&card->dev->dev,
++ MWIFIEX_SKB_DMA_ADDR(cmdrsp),
++ sizeof(sleep_cookie), DMA_FROM_DEVICE);
+ buffer = cmdrsp->data;
+ sleep_cookie = get_unaligned_le32(buffer);
+
+@@ -481,10 +480,10 @@ static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter,
+ "sleep cookie found at count %d\n", count);
+ break;
+ }
+- pci_dma_sync_single_for_device(card->dev,
+- MWIFIEX_SKB_DMA_ADDR(cmdrsp),
+- sizeof(sleep_cookie),
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_device(&card->dev->dev,
++ MWIFIEX_SKB_DMA_ADDR(cmdrsp),
++ sizeof(sleep_cookie),
++ DMA_FROM_DEVICE);
+ usleep_range(20, 30);
+ }
+
+@@ -638,7 +637,7 @@ static int mwifiex_init_rxq_ring(struct mwifiex_adapter *adapter)
+
+ if (mwifiex_map_pci_memory(adapter, skb,
+ MWIFIEX_RX_DATA_BUF_SIZE,
+- PCI_DMA_FROMDEVICE))
++ DMA_FROM_DEVICE))
+ return -1;
+
+ buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
+@@ -695,7 +694,7 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)
+ skb_put(skb, MAX_EVENT_SIZE);
+
+ if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE,
+- PCI_DMA_FROMDEVICE)) {
++ DMA_FROM_DEVICE)) {
+ kfree_skb(skb);
+ kfree(card->evtbd_ring_vbase);
+ return -1;
+@@ -738,7 +737,7 @@ static void mwifiex_cleanup_txq_ring(struct mwifiex_adapter *adapter)
+ if (card->tx_buf_list[i]) {
+ skb = card->tx_buf_list[i];
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ dev_kfree_skb_any(skb);
+ }
+ memset(desc2, 0, sizeof(*desc2));
+@@ -747,7 +746,7 @@ static void mwifiex_cleanup_txq_ring(struct mwifiex_adapter *adapter)
+ if (card->tx_buf_list[i]) {
+ skb = card->tx_buf_list[i];
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ dev_kfree_skb_any(skb);
+ }
+ memset(desc, 0, sizeof(*desc));
+@@ -777,7 +776,7 @@ static void mwifiex_cleanup_rxq_ring(struct mwifiex_adapter *adapter)
+ if (card->rx_buf_list[i]) {
+ skb = card->rx_buf_list[i];
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ dev_kfree_skb_any(skb);
+ }
+ memset(desc2, 0, sizeof(*desc2));
+@@ -786,7 +785,7 @@ static void mwifiex_cleanup_rxq_ring(struct mwifiex_adapter *adapter)
+ if (card->rx_buf_list[i]) {
+ skb = card->rx_buf_list[i];
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ dev_kfree_skb_any(skb);
+ }
+ memset(desc, 0, sizeof(*desc));
+@@ -812,7 +811,7 @@ static void mwifiex_cleanup_evt_ring(struct mwifiex_adapter *adapter)
+ if (card->evt_buf_list[i]) {
+ skb = card->evt_buf_list[i];
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ dev_kfree_skb_any(skb);
+ }
+ card->evt_buf_list[i] = NULL;
+@@ -853,9 +852,10 @@ static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_dbg(adapter, INFO,
+ "info: txbd_ring: Allocating %d bytes\n",
+ card->txbd_ring_size);
+- card->txbd_ring_vbase = pci_alloc_consistent(card->dev,
+- card->txbd_ring_size,
+- &card->txbd_ring_pbase);
++ card->txbd_ring_vbase = dma_alloc_coherent(&card->dev->dev,
++ card->txbd_ring_size,
++ &card->txbd_ring_pbase,
++ GFP_KERNEL);
+ if (!card->txbd_ring_vbase) {
+ mwifiex_dbg(adapter, ERROR,
+ "allocate consistent memory (%d bytes) failed!\n",
+@@ -879,9 +879,9 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_cleanup_txq_ring(adapter);
+
+ if (card->txbd_ring_vbase)
+- pci_free_consistent(card->dev, card->txbd_ring_size,
+- card->txbd_ring_vbase,
+- card->txbd_ring_pbase);
++ dma_free_coherent(&card->dev->dev, card->txbd_ring_size,
++ card->txbd_ring_vbase,
++ card->txbd_ring_pbase);
+ card->txbd_ring_size = 0;
+ card->txbd_wrptr = 0;
+ card->txbd_rdptr = 0 | reg->tx_rollover_ind;
+@@ -917,9 +917,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_dbg(adapter, INFO,
+ "info: rxbd_ring: Allocating %d bytes\n",
+ card->rxbd_ring_size);
+- card->rxbd_ring_vbase = pci_alloc_consistent(card->dev,
+- card->rxbd_ring_size,
+- &card->rxbd_ring_pbase);
++ card->rxbd_ring_vbase = dma_alloc_coherent(&card->dev->dev,
++ card->rxbd_ring_size,
++ &card->rxbd_ring_pbase,
++ GFP_KERNEL);
+ if (!card->rxbd_ring_vbase) {
+ mwifiex_dbg(adapter, ERROR,
+ "allocate consistent memory (%d bytes) failed!\n",
+@@ -947,9 +948,9 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_cleanup_rxq_ring(adapter);
+
+ if (card->rxbd_ring_vbase)
+- pci_free_consistent(card->dev, card->rxbd_ring_size,
+- card->rxbd_ring_vbase,
+- card->rxbd_ring_pbase);
++ dma_free_coherent(&card->dev->dev, card->rxbd_ring_size,
++ card->rxbd_ring_vbase,
++ card->rxbd_ring_pbase);
+ card->rxbd_ring_size = 0;
+ card->rxbd_wrptr = 0;
+ card->rxbd_rdptr = 0 | reg->rx_rollover_ind;
+@@ -981,9 +982,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_dbg(adapter, INFO,
+ "info: evtbd_ring: Allocating %d bytes\n",
+ card->evtbd_ring_size);
+- card->evtbd_ring_vbase = pci_alloc_consistent(card->dev,
+- card->evtbd_ring_size,
+- &card->evtbd_ring_pbase);
++ card->evtbd_ring_vbase = dma_alloc_coherent(&card->dev->dev,
++ card->evtbd_ring_size,
++ &card->evtbd_ring_pbase,
++ GFP_KERNEL);
+ if (!card->evtbd_ring_vbase) {
+ mwifiex_dbg(adapter, ERROR,
+ "allocate consistent memory (%d bytes) failed!\n",
+@@ -1011,9 +1013,9 @@ static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_cleanup_evt_ring(adapter);
+
+ if (card->evtbd_ring_vbase)
+- pci_free_consistent(card->dev, card->evtbd_ring_size,
+- card->evtbd_ring_vbase,
+- card->evtbd_ring_pbase);
++ dma_free_coherent(&card->dev->dev, card->evtbd_ring_size,
++ card->evtbd_ring_vbase,
++ card->evtbd_ring_pbase);
+ card->evtbd_wrptr = 0;
+ card->evtbd_rdptr = 0 | reg->evt_rollover_ind;
+ card->evtbd_ring_size = 0;
+@@ -1040,7 +1042,7 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter)
+ }
+ skb_put(skb, MWIFIEX_UPLD_SIZE);
+ if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
+- PCI_DMA_FROMDEVICE)) {
++ DMA_FROM_DEVICE)) {
+ kfree_skb(skb);
+ return -1;
+ }
+@@ -1064,14 +1066,14 @@ static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifiex_adapter *adapter)
+
+ if (card && card->cmdrsp_buf) {
+ mwifiex_unmap_pci_memory(adapter, card->cmdrsp_buf,
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ dev_kfree_skb_any(card->cmdrsp_buf);
+ card->cmdrsp_buf = NULL;
+ }
+
+ if (card && card->cmd_buf) {
+ mwifiex_unmap_pci_memory(adapter, card->cmd_buf,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ dev_kfree_skb_any(card->cmd_buf);
+ card->cmd_buf = NULL;
+ }
+@@ -1086,8 +1088,10 @@ static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter)
+ struct pcie_service_card *card = adapter->card;
+ u32 *cookie;
+
+- card->sleep_cookie_vbase = pci_alloc_consistent(card->dev, sizeof(u32),
+- &card->sleep_cookie_pbase);
++ card->sleep_cookie_vbase = dma_alloc_coherent(&card->dev->dev,
++ sizeof(u32),
++ &card->sleep_cookie_pbase,
++ GFP_KERNEL);
+ if (!card->sleep_cookie_vbase) {
+ mwifiex_dbg(adapter, ERROR,
+ "pci_alloc_consistent failed!\n");
+@@ -1115,9 +1119,9 @@ static int mwifiex_pcie_delete_sleep_cookie_buf(struct mwifiex_adapter *adapter)
+ card = adapter->card;
+
+ if (card && card->sleep_cookie_vbase) {
+- pci_free_consistent(card->dev, sizeof(u32),
+- card->sleep_cookie_vbase,
+- card->sleep_cookie_pbase);
++ dma_free_coherent(&card->dev->dev, sizeof(u32),
++ card->sleep_cookie_vbase,
++ card->sleep_cookie_pbase);
+ card->sleep_cookie_vbase = NULL;
+ }
+
+@@ -1189,7 +1193,7 @@ static int mwifiex_pcie_send_data_complete(struct mwifiex_adapter *adapter)
+ "SEND COMP: Detach skb %p at txbd_rdidx=%d\n",
+ skb, wrdoneidx);
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+
+ unmap_count++;
+
+@@ -1282,7 +1286,7 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
+ put_unaligned_le16(MWIFIEX_TYPE_DATA, payload + 2);
+
+ if (mwifiex_map_pci_memory(adapter, skb, skb->len,
+- PCI_DMA_TODEVICE))
++ DMA_TO_DEVICE))
+ return -1;
+
+ wrindx = (card->txbd_wrptr & reg->tx_mask) >> reg->tx_start_ptr;
+@@ -1372,7 +1376,7 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
+
+ return -EINPROGRESS;
+ done_unmap:
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+ card->tx_buf_list[wrindx] = NULL;
+ atomic_dec(&adapter->tx_hw_pending);
+ if (reg->pfu_enabled)
+@@ -1426,7 +1430,7 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
+ if (!skb_data)
+ return -ENOMEM;
+
+- mwifiex_unmap_pci_memory(adapter, skb_data, PCI_DMA_FROMDEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb_data, DMA_FROM_DEVICE);
+ card->rx_buf_list[rd_index] = NULL;
+
+ /* Get data length from interface header -
+@@ -1464,7 +1468,7 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
+
+ if (mwifiex_map_pci_memory(adapter, skb_tmp,
+ MWIFIEX_RX_DATA_BUF_SIZE,
+- PCI_DMA_FROMDEVICE))
++ DMA_FROM_DEVICE))
+ return -1;
+
+ buf_pa = MWIFIEX_SKB_DMA_ADDR(skb_tmp);
+@@ -1541,7 +1545,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ return -1;
+ }
+
+- if (mwifiex_map_pci_memory(adapter, skb, skb->len, PCI_DMA_TODEVICE))
++ if (mwifiex_map_pci_memory(adapter, skb, skb->len, DMA_TO_DEVICE))
+ return -1;
+
+ buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
+@@ -1553,7 +1557,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ mwifiex_dbg(adapter, ERROR,
+ "%s: failed to write download command to boot code.\n",
+ __func__);
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+ return -1;
+ }
+
+@@ -1565,7 +1569,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ mwifiex_dbg(adapter, ERROR,
+ "%s: failed to write download command to boot code.\n",
+ __func__);
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+ return -1;
+ }
+
+@@ -1574,7 +1578,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ mwifiex_dbg(adapter, ERROR,
+ "%s: failed to write command len to cmd_size scratch reg\n",
+ __func__);
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+ return -1;
+ }
+
+@@ -1583,7 +1587,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ CPU_INTR_DOOR_BELL)) {
+ mwifiex_dbg(adapter, ERROR,
+ "%s: failed to assert door-bell intr\n", __func__);
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+ return -1;
+ }
+
+@@ -1642,7 +1646,7 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ put_unaligned_le16((u16)skb->len, &payload[0]);
+ put_unaligned_le16(MWIFIEX_TYPE_CMD, &payload[2]);
+
+- if (mwifiex_map_pci_memory(adapter, skb, skb->len, PCI_DMA_TODEVICE))
++ if (mwifiex_map_pci_memory(adapter, skb, skb->len, DMA_TO_DEVICE))
+ return -1;
+
+ card->cmd_buf = skb;
+@@ -1742,17 +1746,16 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
+ "info: Rx CMD Response\n");
+
+ if (adapter->curr_cmd)
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_FROMDEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_FROM_DEVICE);
+ else
+- pci_dma_sync_single_for_cpu(card->dev,
+- MWIFIEX_SKB_DMA_ADDR(skb),
+- MWIFIEX_UPLD_SIZE,
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_cpu(&card->dev->dev,
++ MWIFIEX_SKB_DMA_ADDR(skb),
++ MWIFIEX_UPLD_SIZE, DMA_FROM_DEVICE);
+
+ /* Unmap the command as a response has been received. */
+ if (card->cmd_buf) {
+ mwifiex_unmap_pci_memory(adapter, card->cmd_buf,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ dev_kfree_skb_any(card->cmd_buf);
+ card->cmd_buf = NULL;
+ }
+@@ -1763,10 +1766,10 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
+
+ if (!adapter->curr_cmd) {
+ if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
+- pci_dma_sync_single_for_device(card->dev,
+- MWIFIEX_SKB_DMA_ADDR(skb),
+- MWIFIEX_SLEEP_COOKIE_SIZE,
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_device(&card->dev->dev,
++ MWIFIEX_SKB_DMA_ADDR(skb),
++ MWIFIEX_SLEEP_COOKIE_SIZE,
++ DMA_FROM_DEVICE);
+ if (mwifiex_write_reg(adapter,
+ PCIE_CPU_INT_EVENT,
+ CPU_INTR_SLEEP_CFM_DONE)) {
+@@ -1777,7 +1780,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
+ mwifiex_delay_for_sleep_cookie(adapter,
+ MWIFIEX_MAX_DELAY_COUNT);
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ skb_pull(skb, adapter->intf_hdr_len);
+ while (reg->sleep_cookie && (count++ < 10) &&
+ mwifiex_pcie_ok_to_access_hw(adapter))
+@@ -1793,7 +1796,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
+ min_t(u32, MWIFIEX_SIZE_OF_CMD_BUFFER, skb->len));
+ skb_push(skb, adapter->intf_hdr_len);
+ if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
+- PCI_DMA_FROMDEVICE))
++ DMA_FROM_DEVICE))
+ return -1;
+ } else if (mwifiex_pcie_ok_to_access_hw(adapter)) {
+ skb_pull(skb, adapter->intf_hdr_len);
+@@ -1835,7 +1838,7 @@ static int mwifiex_pcie_cmdrsp_complete(struct mwifiex_adapter *adapter,
+ card->cmdrsp_buf = skb;
+ skb_push(card->cmdrsp_buf, adapter->intf_hdr_len);
+ if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
+- PCI_DMA_FROMDEVICE))
++ DMA_FROM_DEVICE))
+ return -1;
+ }
+
+@@ -1890,7 +1893,7 @@ static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter)
+ mwifiex_dbg(adapter, INFO,
+ "info: Read Index: %d\n", rdptr);
+ skb_cmd = card->evt_buf_list[rdptr];
+- mwifiex_unmap_pci_memory(adapter, skb_cmd, PCI_DMA_FROMDEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb_cmd, DMA_FROM_DEVICE);
+
+ /* Take the pointer and set it to event pointer in adapter
+ and will return back after event handling callback */
+@@ -1970,7 +1973,7 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter,
+ skb_put(skb, MAX_EVENT_SIZE - skb->len);
+ if (mwifiex_map_pci_memory(adapter, skb,
+ MAX_EVENT_SIZE,
+- PCI_DMA_FROMDEVICE))
++ DMA_FROM_DEVICE))
+ return -1;
+ card->evt_buf_list[rdptr] = skb;
+ desc = card->evtbd_ring[rdptr];
+@@ -2252,7 +2255,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
+ "interrupt status during fw dnld.\n",
+ __func__);
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ ret = -1;
+ goto done;
+ }
+@@ -2264,12 +2267,12 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
+ mwifiex_dbg(adapter, ERROR, "%s: Card failed to ACK download\n",
+ __func__);
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ ret = -1;
+ goto done;
+ }
+
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+
+ offset += txlen;
+ } while (true);
+@@ -2939,13 +2942,13 @@ static int mwifiex_init_pcie(struct mwifiex_adapter *adapter)
+
+ pci_set_master(pdev);
+
+- ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
++ ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+ if (ret) {
+ pr_err("set_dma_mask(32) failed: %d\n", ret);
+ goto err_set_dma_mask;
+ }
+
+- ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
++ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+ if (ret) {
+ pr_err("set_consistent_dma_mask(64) failed\n");
+ goto err_set_dma_mask;
+--
+2.40.1
+
--- /dev/null
+From ba5602451b2f0157ffb4170456bb2cde73b68240 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Aug 2023 14:43:36 +0800
+Subject: net: arcnet: Do not call kfree_skb() under local_irq_disable()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 786c96e92fb9e854cb8b0cb7399bb2fb28e15c4b ]
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with hardware interrupts being disabled.
+So replace kfree_skb() with dev_kfree_skb_irq() under
+local_irq_disable(). Compile tested only.
+
+Fixes: 05fcd31cc472 ("arcnet: add err_skb package for package status feedback")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/arcnet/arcnet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
+index 553776cc1d29d..2b112d3d85409 100644
+--- a/drivers/net/arcnet/arcnet.c
++++ b/drivers/net/arcnet/arcnet.c
+@@ -434,7 +434,7 @@ static void arcnet_reply_tasklet(unsigned long data)
+
+ ret = sock_queue_err_skb(sk, ackskb);
+ if (ret)
+- kfree_skb(ackskb);
++ dev_kfree_skb_irq(ackskb);
+
+ local_irq_enable();
+ };
+--
+2.40.1
+
--- /dev/null
+From fcb9298752943c3056268cfa0a536aa280b29dee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Aug 2023 01:49:05 -0700
+Subject: net/sched: sch_hfsc: Ensure inner classes have fsc curve
+
+From: Budimir Markovic <markovicbudimir@gmail.com>
+
+[ Upstream commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f ]
+
+HFSC assumes that inner classes have an fsc curve, but it is currently
+possible for classes without an fsc curve to become parents. This leads
+to bugs including a use-after-free.
+
+Don't allow non-root classes without HFSC_FSC to become parents.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
+Signed-off-by: Budimir Markovic <markovicbudimir@gmail.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Link: https://lore.kernel.org/r/20230824084905.422-1-markovicbudimir@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_hfsc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
+index b18ec1f6de60c..fa3d2fd4990ce 100644
+--- a/net/sched/sch_hfsc.c
++++ b/net/sched/sch_hfsc.c
+@@ -1021,6 +1021,10 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
+ if (parent == NULL)
+ return -ENOENT;
+ }
++ if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) {
++ NL_SET_ERR_MSG(extack, "Invalid parent - parent class must have FSC");
++ return -EINVAL;
++ }
+
+ if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0)
+ return -EINVAL;
+--
+2.40.1
+
--- /dev/null
+From 11ecbdde6683b860e40530e45bf7ec639dff3671 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Aug 2023 09:50:59 -0700
+Subject: netrom: Deny concurrent connect().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit c2f8fd7949603efb03908e05abbf7726748c8de3 ]
+
+syzkaller reported null-ptr-deref [0] related to AF_NETROM.
+This is another self-accept issue from the strace log. [1]
+
+syz-executor creates an AF_NETROM socket and calls connect(), which
+is blocked at that time. Then, sk->sk_state is TCP_SYN_SENT and
+sock->state is SS_CONNECTING.
+
+ [pid 5059] socket(AF_NETROM, SOCK_SEQPACKET, 0) = 4
+ [pid 5059] connect(4, {sa_family=AF_NETROM, sa_data="..." <unfinished ...>
+
+Another thread calls connect() concurrently, which finally fails
+with -EINVAL. However, the problem here is the socket state is
+reset even while the first connect() is blocked.
+
+ [pid 5060] connect(4, NULL, 0 <unfinished ...>
+ [pid 5060] <... connect resumed>) = -1 EINVAL (Invalid argument)
+
+As sk->state is TCP_CLOSE and sock->state is SS_UNCONNECTED, the
+following listen() succeeds. Then, the first connect() looks up
+itself as a listener and puts skb into the queue with skb->sk itself.
+As a result, the next accept() gets another FD of itself as 3, and
+the first connect() finishes.
+
+ [pid 5060] listen(4, 0 <unfinished ...>
+ [pid 5060] <... listen resumed>) = 0
+ [pid 5060] accept(4, NULL, NULL <unfinished ...>
+ [pid 5060] <... accept resumed>) = 3
+ [pid 5059] <... connect resumed>) = 0
+
+Then, accept4() is called but blocked, which causes the general protection
+fault later.
+
+ [pid 5059] accept4(4, NULL, 0x20000400, SOCK_NONBLOCK <unfinished ...>
+
+After that, another self-accept occurs by accept() and writev().
+
+ [pid 5060] accept(4, NULL, NULL <unfinished ...>
+ [pid 5061] writev(3, [{iov_base=...}] <unfinished ...>
+ [pid 5061] <... writev resumed>) = 99
+ [pid 5060] <... accept resumed>) = 6
+
+Finally, the leader thread close()s all FDs. Since the three FDs
+reference the same socket, nr_release() does the cleanup for it
+three times, and the remaining accept4() causes the following fault.
+
+ [pid 5058] close(3) = 0
+ [pid 5058] close(4) = 0
+ [pid 5058] close(5) = -1 EBADF (Bad file descriptor)
+ [pid 5058] close(6) = 0
+ [pid 5058] <... exit_group resumed>) = ?
+ [ 83.456055][ T5059] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
+
+To avoid the issue, we need to return an error for connect() if
+another connect() is in progress, as done in __inet_stream_connect().
+
+[0]:
+general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
+KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
+CPU: 0 PID: 5059 Comm: syz-executor.0 Not tainted 6.5.0-rc5-syzkaller-00194-gace0ab3a4b54 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
+RIP: 0010:__lock_acquire+0x109/0x5de0 kernel/locking/lockdep.c:5012
+Code: 45 85 c9 0f 84 cc 0e 00 00 44 8b 05 11 6e 23 0b 45 85 c0 0f 84 be 0d 00 00 48 ba 00 00 00 00 00 fc ff df 4c 89 d1 48 c1 e9 03 <80> 3c 11 00 0f 85 e8 40 00 00 49 81 3a a0 69 48 90 0f 84 96 0d 00
+RSP: 0018:ffffc90003d6f9e0 EFLAGS: 00010006
+RAX: ffff8880244c8000 RBX: 1ffff920007adf6c RCX: 0000000000000003
+RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000018
+RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000001
+R10: 0000000000000018 R11: 0000000000000000 R12: 0000000000000000
+R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+FS: 00007f51d519a6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f51d5158d58 CR3: 000000002943f000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ lock_acquire kernel/locking/lockdep.c:5761 [inline]
+ lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726
+ __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
+ _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162
+ prepare_to_wait+0x47/0x380 kernel/sched/wait.c:269
+ nr_accept+0x20d/0x650 net/netrom/af_netrom.c:798
+ do_accept+0x3a6/0x570 net/socket.c:1872
+ __sys_accept4_file net/socket.c:1913 [inline]
+ __sys_accept4+0x99/0x120 net/socket.c:1943
+ __do_sys_accept4 net/socket.c:1954 [inline]
+ __se_sys_accept4 net/socket.c:1951 [inline]
+ __x64_sys_accept4+0x96/0x100 net/socket.c:1951
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7f51d447cae9
+Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007f51d519a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000120
+RAX: ffffffffffffffda RBX: 00007f51d459bf80 RCX: 00007f51d447cae9
+RDX: 0000000020000400 RSI: 0000000000000000 RDI: 0000000000000004
+RBP: 00007f51d44c847a R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000
+R13: 000000000000000b R14: 00007f51d459bf80 R15: 00007ffc25c34e48
+ </TASK>
+
+Link: https://syzkaller.appspot.com/text?tag=CrashLog&x=152cdb63a80000 [1]
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: syzbot+666c97e4686410e79649@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=666c97e4686410e79649
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netrom/af_netrom.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
+index a5d819fa7c899..146550ce0ac6f 100644
+--- a/net/netrom/af_netrom.c
++++ b/net/netrom/af_netrom.c
+@@ -663,6 +663,11 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
+ goto out_release;
+ }
+
++ if (sock->state == SS_CONNECTING) {
++ err = -EALREADY;
++ goto out_release;
++ }
++
+ sk->sk_state = TCP_CLOSE;
+ sock->state = SS_UNCONNECTED;
+
+--
+2.40.1
+
--- /dev/null
+From 89bac0624177b98d2140ffc0921df3bce1c11fe4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 01:21:58 -0400
+Subject: new helper: lookup_positive_unlocked()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 6c2d4798a8d16cf4f3a28c3cd4af4f1dcbbb4d04 ]
+
+Most of the callers of lookup_one_len_unlocked() treat negatives are
+ERR_PTR(-ENOENT). Provide a helper that would do just that. Note
+that a pinned positive dentry remains positive - it's ->d_inode is
+stable, etc.; a pinned _negative_ dentry can become positive at any
+point as long as you are not holding its parent at least shared.
+So using lookup_one_len_unlocked() needs to be careful;
+lookup_positive_unlocked() is safer and that's what the callers
+end up open-coding anyway.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Stable-dep-of: 0d5a4f8f775f ("fs: Fix error checking for d_hash_and_lookup()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifsfs.c | 7 +------
+ fs/debugfs/inode.c | 6 +-----
+ fs/kernfs/mount.c | 2 +-
+ fs/namei.c | 20 ++++++++++++++++++++
+ fs/nfsd/nfs3xdr.c | 4 +---
+ fs/nfsd/nfs4xdr.c | 11 +----------
+ fs/overlayfs/namei.c | 24 ++++++++----------------
+ fs/quota/dquot.c | 7 +------
+ include/linux/namei.h | 1 +
+ 9 files changed, 35 insertions(+), 47 deletions(-)
+
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 52b1524b40cdc..ef1a43f4bd663 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -663,11 +663,6 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
+ struct inode *dir = d_inode(dentry);
+ struct dentry *child;
+
+- if (!dir) {
+- dput(dentry);
+- dentry = ERR_PTR(-ENOENT);
+- break;
+- }
+ if (!S_ISDIR(dir->i_mode)) {
+ dput(dentry);
+ dentry = ERR_PTR(-ENOTDIR);
+@@ -684,7 +679,7 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
+ while (*s && *s != sep)
+ s++;
+
+- child = lookup_one_len_unlocked(p, dentry, s - p);
++ child = lookup_positive_unlocked(p, dentry, s - p);
+ dput(dentry);
+ dentry = child;
+ } while (!IS_ERR(dentry));
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 4661ecaf6741c..1e4ae78f64a8f 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -275,13 +275,9 @@ struct dentry *debugfs_lookup(const char *name, struct dentry *parent)
+ if (!parent)
+ parent = debugfs_mount->mnt_root;
+
+- dentry = lookup_one_len_unlocked(name, parent, strlen(name));
++ dentry = lookup_positive_unlocked(name, parent, strlen(name));
+ if (IS_ERR(dentry))
+ return NULL;
+- if (!d_really_is_positive(dentry)) {
+- dput(dentry);
+- return NULL;
+- }
+ return dentry;
+ }
+ EXPORT_SYMBOL_GPL(debugfs_lookup);
+diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c
+index 0b22c39dad477..b2a126a947e31 100644
+--- a/fs/kernfs/mount.c
++++ b/fs/kernfs/mount.c
+@@ -212,7 +212,7 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn,
+ dput(dentry);
+ return ERR_PTR(-EINVAL);
+ }
+- dtmp = lookup_one_len_unlocked(kntmp->name, dentry,
++ dtmp = lookup_positive_unlocked(kntmp->name, dentry,
+ strlen(kntmp->name));
+ dput(dentry);
+ if (IS_ERR(dtmp))
+diff --git a/fs/namei.c b/fs/namei.c
+index 9e8fca598acc5..0dbe38afef29b 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -2575,6 +2575,26 @@ struct dentry *lookup_one_len_unlocked(const char *name,
+ }
+ EXPORT_SYMBOL(lookup_one_len_unlocked);
+
++/*
++ * Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT)
++ * on negatives. Returns known positive or ERR_PTR(); that's what
++ * most of the users want. Note that pinned negative with unlocked parent
++ * _can_ become positive at any time, so callers of lookup_one_len_unlocked()
++ * need to be very careful; pinned positives have ->d_inode stable, so
++ * this one avoids such problems.
++ */
++struct dentry *lookup_positive_unlocked(const char *name,
++ struct dentry *base, int len)
++{
++ struct dentry *ret = lookup_one_len_unlocked(name, base, len);
++ if (!IS_ERR(ret) && d_is_negative(ret)) {
++ dput(ret);
++ ret = ERR_PTR(-ENOENT);
++ }
++ return ret;
++}
++EXPORT_SYMBOL(lookup_positive_unlocked);
++
+ #ifdef CONFIG_UNIX98_PTYS
+ int path_pts(struct path *path)
+ {
+diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
+index b90bea1c434eb..9f537decdd9c7 100644
+--- a/fs/nfsd/nfs3xdr.c
++++ b/fs/nfsd/nfs3xdr.c
+@@ -855,13 +855,11 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
+ } else
+ dchild = dget(dparent);
+ } else
+- dchild = lookup_one_len_unlocked(name, dparent, namlen);
++ dchild = lookup_positive_unlocked(name, dparent, namlen);
+ if (IS_ERR(dchild))
+ return rv;
+ if (d_mountpoint(dchild))
+ goto out;
+- if (d_really_is_negative(dchild))
+- goto out;
+ if (dchild->d_inode->i_ino != ino)
+ goto out;
+ rv = fh_compose(fhp, exp, dchild, &cd->fh);
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 74ab20c89e752..bceb99a8a814a 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -2984,18 +2984,9 @@ nfsd4_encode_dirent_fattr(struct xdr_stream *xdr, struct nfsd4_readdir *cd,
+ __be32 nfserr;
+ int ignore_crossmnt = 0;
+
+- dentry = lookup_one_len_unlocked(name, cd->rd_fhp->fh_dentry, namlen);
++ dentry = lookup_positive_unlocked(name, cd->rd_fhp->fh_dentry, namlen);
+ if (IS_ERR(dentry))
+ return nfserrno(PTR_ERR(dentry));
+- if (d_really_is_negative(dentry)) {
+- /*
+- * we're not holding the i_mutex here, so there's
+- * a window where this directory entry could have gone
+- * away.
+- */
+- dput(dentry);
+- return nfserr_noent;
+- }
+
+ exp_get(exp);
+ /*
+diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
+index badf039267a2f..e51dc7f16596c 100644
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -203,7 +203,7 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
+ int err;
+ bool last_element = !post[0];
+
+- this = lookup_one_len_unlocked(name, base, namelen);
++ this = lookup_positive_unlocked(name, base, namelen);
+ if (IS_ERR(this)) {
+ err = PTR_ERR(this);
+ this = NULL;
+@@ -211,8 +211,6 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
+ goto out;
+ goto out_err;
+ }
+- if (!this->d_inode)
+- goto put_and_out;
+
+ if (ovl_dentry_weird(this)) {
+ /* Don't support traversing automounts and other weirdness */
+@@ -654,7 +652,7 @@ struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh)
+ if (err)
+ return ERR_PTR(err);
+
+- index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len);
++ index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len);
+ kfree(name.name);
+ if (IS_ERR(index)) {
+ if (PTR_ERR(index) == -ENOENT)
+@@ -662,9 +660,7 @@ struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh)
+ return index;
+ }
+
+- if (d_is_negative(index))
+- err = 0;
+- else if (ovl_is_whiteout(index))
++ if (ovl_is_whiteout(index))
+ err = -ESTALE;
+ else if (ovl_dentry_weird(index))
+ err = -EIO;
+@@ -688,7 +684,7 @@ struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper,
+ if (err)
+ return ERR_PTR(err);
+
+- index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len);
++ index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len);
+ if (IS_ERR(index)) {
+ err = PTR_ERR(index);
+ if (err == -ENOENT) {
+@@ -703,9 +699,7 @@ struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper,
+ }
+
+ inode = d_inode(index);
+- if (d_is_negative(index)) {
+- goto out_dput;
+- } else if (ovl_is_whiteout(index) && !verify) {
++ if (ovl_is_whiteout(index) && !verify) {
+ /*
+ * When index lookup is called with !verify for decoding an
+ * overlay file handle, a whiteout index implies that decode
+@@ -1134,7 +1128,7 @@ bool ovl_lower_positive(struct dentry *dentry)
+ struct dentry *this;
+ struct dentry *lowerdir = poe->lowerstack[i].dentry;
+
+- this = lookup_one_len_unlocked(name->name, lowerdir,
++ this = lookup_positive_unlocked(name->name, lowerdir,
+ name->len);
+ if (IS_ERR(this)) {
+ switch (PTR_ERR(this)) {
+@@ -1151,10 +1145,8 @@ bool ovl_lower_positive(struct dentry *dentry)
+ break;
+ }
+ } else {
+- if (this->d_inode) {
+- positive = !ovl_is_whiteout(this);
+- done = true;
+- }
++ positive = !ovl_is_whiteout(this);
++ done = true;
+ dput(this);
+ }
+ }
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 303987d29b9c9..d901119e25b51 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -2535,15 +2535,10 @@ int dquot_quota_on_mount(struct super_block *sb, char *qf_name,
+ struct dentry *dentry;
+ int error;
+
+- dentry = lookup_one_len_unlocked(qf_name, sb->s_root, strlen(qf_name));
++ dentry = lookup_positive_unlocked(qf_name, sb->s_root, strlen(qf_name));
+ if (IS_ERR(dentry))
+ return PTR_ERR(dentry);
+
+- if (d_really_is_negative(dentry)) {
+- error = -ENOENT;
+- goto out;
+- }
+-
+ error = security_quota_on(dentry);
+ if (!error)
+ error = vfs_load_quota_inode(d_inode(dentry), type, format_id,
+diff --git a/include/linux/namei.h b/include/linux/namei.h
+index a78606e8e3df7..4632f4ca33426 100644
+--- a/include/linux/namei.h
++++ b/include/linux/namei.h
+@@ -84,6 +84,7 @@ extern int kern_path_mountpoint(int, const char *, struct path *, unsigned int);
+ extern struct dentry *try_lookup_one_len(const char *, struct dentry *, int);
+ extern struct dentry *lookup_one_len(const char *, struct dentry *, int);
+ extern struct dentry *lookup_one_len_unlocked(const char *, struct dentry *, int);
++extern struct dentry *lookup_positive_unlocked(const char *, struct dentry *, int);
+
+ extern int follow_down_one(struct path *);
+ extern int follow_down(struct path *);
+--
+2.40.1
+
--- /dev/null
+From f101c460c695305be35554b1cc36e398532787ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jul 2023 11:08:46 +0300
+Subject: nfs/blocklayout: Use the passed in gfp flags
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 08b45fcb2d4675f6182fe0edc0d8b1fe604051fa ]
+
+This allocation should use the passed in GFP_ flags instead of
+GFP_KERNEL. One places where this matters is in filelayout_pg_init_write()
+which uses GFP_NOFS as the allocation flags.
+
+Fixes: 5c83746a0cf2 ("pnfs/blocklayout: in-kernel GETDEVICEINFO XDR parsing")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/blocklayout/dev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c
+index dec5880ac6de2..6e3a14fdff9c8 100644
+--- a/fs/nfs/blocklayout/dev.c
++++ b/fs/nfs/blocklayout/dev.c
+@@ -422,7 +422,7 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_block_dev *d,
+ int ret, i;
+
+ d->children = kcalloc(v->concat.volumes_count,
+- sizeof(struct pnfs_block_dev), GFP_KERNEL);
++ sizeof(struct pnfs_block_dev), gfp_mask);
+ if (!d->children)
+ return -ENOMEM;
+
+@@ -451,7 +451,7 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_block_dev *d,
+ int ret, i;
+
+ d->children = kcalloc(v->stripe.volumes_count,
+- sizeof(struct pnfs_block_dev), GFP_KERNEL);
++ sizeof(struct pnfs_block_dev), gfp_mask);
+ if (!d->children)
+ return -ENOMEM;
+
+--
+2.40.1
+
--- /dev/null
+From 966ed41e348984fca5df2b30ceda628b414a32da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Aug 2023 10:20:52 -0400
+Subject: NFSD: da_addr_body field missing in some GETDEVICEINFO replies
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 6372e2ee629894433fe6107d7048536a3280a284 ]
+
+The XDR specification in RFC 8881 looks like this:
+
+struct device_addr4 {
+ layouttype4 da_layout_type;
+ opaque da_addr_body<>;
+};
+
+struct GETDEVICEINFO4resok {
+ device_addr4 gdir_device_addr;
+ bitmap4 gdir_notification;
+};
+
+union GETDEVICEINFO4res switch (nfsstat4 gdir_status) {
+case NFS4_OK:
+ GETDEVICEINFO4resok gdir_resok4;
+case NFS4ERR_TOOSMALL:
+ count4 gdir_mincount;
+default:
+ void;
+};
+
+Looking at nfsd4_encode_getdeviceinfo() ....
+
+When the client provides a zero gd_maxcount, then the Linux NFS
+server implementation encodes the da_layout_type field and then
+skips the da_addr_body field completely, proceeding directly to
+encode gdir_notification field.
+
+There does not appear to be an option in the specification to skip
+encoding da_addr_body. Moreover, Section 18.40.3 says:
+
+> If the client wants to just update or turn off notifications, it
+> MAY send a GETDEVICEINFO operation with gdia_maxcount set to zero.
+> In that event, if the device ID is valid, the reply's da_addr_body
+> field of the gdir_device_addr field will be of zero length.
+
+Since the layout drivers are responsible for encoding the
+da_addr_body field, put this fix inside the ->encode_getdeviceinfo
+methods.
+
+Fixes: 9cf514ccfacb ("nfsd: implement pNFS operations")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Cc: Tom Haynes <loghyr@gmail.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/blocklayoutxdr.c | 9 +++++++++
+ fs/nfsd/flexfilelayoutxdr.c | 9 +++++++++
+ fs/nfsd/nfs4xdr.c | 25 +++++++++++--------------
+ 3 files changed, 29 insertions(+), 14 deletions(-)
+
+diff --git a/fs/nfsd/blocklayoutxdr.c b/fs/nfsd/blocklayoutxdr.c
+index 442543304930b..2455dc8be18a8 100644
+--- a/fs/nfsd/blocklayoutxdr.c
++++ b/fs/nfsd/blocklayoutxdr.c
+@@ -82,6 +82,15 @@ nfsd4_block_encode_getdeviceinfo(struct xdr_stream *xdr,
+ int len = sizeof(__be32), ret, i;
+ __be32 *p;
+
++ /*
++ * See paragraph 5 of RFC 8881 S18.40.3.
++ */
++ if (!gdp->gd_maxcount) {
++ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT)
++ return nfserr_resource;
++ return nfs_ok;
++ }
++
+ p = xdr_reserve_space(xdr, len + sizeof(__be32));
+ if (!p)
+ return nfserr_resource;
+diff --git a/fs/nfsd/flexfilelayoutxdr.c b/fs/nfsd/flexfilelayoutxdr.c
+index e81d2a5cf381e..bb205328e043d 100644
+--- a/fs/nfsd/flexfilelayoutxdr.c
++++ b/fs/nfsd/flexfilelayoutxdr.c
+@@ -85,6 +85,15 @@ nfsd4_ff_encode_getdeviceinfo(struct xdr_stream *xdr,
+ int addr_len;
+ __be32 *p;
+
++ /*
++ * See paragraph 5 of RFC 8881 S18.40.3.
++ */
++ if (!gdp->gd_maxcount) {
++ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT)
++ return nfserr_resource;
++ return nfs_ok;
++ }
++
+ /* len + padding for two strings */
+ addr_len = 16 + da->netaddr.netid_len + da->netaddr.addr_len;
+ ver_len = 20;
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index bceb99a8a814a..33827cdd8066f 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -4126,20 +4126,17 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
+
+ *p++ = cpu_to_be32(gdev->gd_layout_type);
+
+- /* If maxcount is 0 then just update notifications */
+- if (gdev->gd_maxcount != 0) {
+- ops = nfsd4_layout_ops[gdev->gd_layout_type];
+- nfserr = ops->encode_getdeviceinfo(xdr, gdev);
+- if (nfserr) {
+- /*
+- * We don't bother to burden the layout drivers with
+- * enforcing gd_maxcount, just tell the client to
+- * come back with a bigger buffer if it's not enough.
+- */
+- if (xdr->buf->len + 4 > gdev->gd_maxcount)
+- goto toosmall;
+- return nfserr;
+- }
++ ops = nfsd4_layout_ops[gdev->gd_layout_type];
++ nfserr = ops->encode_getdeviceinfo(xdr, gdev);
++ if (nfserr) {
++ /*
++ * We don't bother to burden the layout drivers with
++ * enforcing gd_maxcount, just tell the client to
++ * come back with a bigger buffer if it's not enough.
++ */
++ if (xdr->buf->len + 4 > gdev->gd_maxcount)
++ goto toosmall;
++ return nfserr;
+ }
+
+ if (gdev->gd_notify_types) {
+--
+2.40.1
+
--- /dev/null
+From 9b172d0e9ceb65e14a0d22795f0ceb420ae643a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jul 2023 16:02:46 +0800
+Subject: of: unittest: fix null pointer dereferencing in
+ of_unittest_find_node_by_name()
+
+From: Ruan Jinjie <ruanjinjie@huawei.com>
+
+[ Upstream commit d6ce4f0ea19c32f10867ed93d8386924326ab474 ]
+
+when kmalloc() fail to allocate memory in kasprintf(), name
+or full_name will be NULL, strcmp() will cause
+null pointer dereference.
+
+Fixes: 0d638a07d3a1 ("of: Convert to using %pOF instead of full_name")
+Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com>
+Link: https://lore.kernel.org/r/20230727080246.519539-1-ruanjinjie@huawei.com
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/unittest.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 29f17c3449aa4..59dc68a1d8ff3 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -52,7 +52,7 @@ static void __init of_unittest_find_node_by_name(void)
+
+ np = of_find_node_by_path("/testcase-data");
+ name = kasprintf(GFP_KERNEL, "%pOF", np);
+- unittest(np && !strcmp("/testcase-data", name),
++ unittest(np && name && !strcmp("/testcase-data", name),
+ "find /testcase-data failed\n");
+ of_node_put(np);
+ kfree(name);
+@@ -63,14 +63,14 @@ static void __init of_unittest_find_node_by_name(void)
+
+ np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a");
+ name = kasprintf(GFP_KERNEL, "%pOF", np);
+- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
++ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
+ "find /testcase-data/phandle-tests/consumer-a failed\n");
+ of_node_put(np);
+ kfree(name);
+
+ np = of_find_node_by_path("testcase-alias");
+ name = kasprintf(GFP_KERNEL, "%pOF", np);
+- unittest(np && !strcmp("/testcase-data", name),
++ unittest(np && name && !strcmp("/testcase-data", name),
+ "find testcase-alias failed\n");
+ of_node_put(np);
+ kfree(name);
+@@ -81,7 +81,7 @@ static void __init of_unittest_find_node_by_name(void)
+
+ np = of_find_node_by_path("testcase-alias/phandle-tests/consumer-a");
+ name = kasprintf(GFP_KERNEL, "%pOF", np);
+- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
++ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
+ "find testcase-alias/phandle-tests/consumer-a failed\n");
+ of_node_put(np);
+ kfree(name);
+@@ -1138,6 +1138,8 @@ static void attach_node_and_children(struct device_node *np)
+ const char *full_name;
+
+ full_name = kasprintf(GFP_KERNEL, "%pOF", np);
++ if (!full_name)
++ return;
+
+ if (!strcmp(full_name, "/__local_fixups__") ||
+ !strcmp(full_name, "/__fixups__")) {
+--
+2.40.1
+
--- /dev/null
+From 09969232f0b98f4f7a02eb50196d44fa4848afba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jul 2023 10:50:29 +0200
+Subject: of: unittest: Fix overlay type in apply/revert check
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 6becf8f845ae1f0b1cfed395bbeccbd23654162d ]
+
+The removal check in of_unittest_apply_revert_overlay_check()
+always uses the platform device overlay type, while it should use the
+actual overlay type, as passed as a parameter to the function.
+
+This has no impact on any current test, as all tests calling
+of_unittest_apply_revert_overlay_check() use the platform device overlay
+type.
+
+Fixes: d5e75500ca401d31 ("of: unitest: Add I2C overlay unit tests.")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/ba0234c41ba808f10112094f88792beeb6dbaedf.1690533838.git.geert+renesas@glider.be
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/unittest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 59dc68a1d8ff3..2515ce3930059 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -1573,7 +1573,7 @@ static int __init of_unittest_apply_revert_overlay_check(int overlay_nr,
+ }
+
+ /* unittest device must be again in before state */
+- if (of_unittest_device_exists(unittest_nr, PDEV_OVERLAY) != before) {
++ if (of_unittest_device_exists(unittest_nr, ovtype) != before) {
+ unittest(0, "%s with device @\"%s\" %s\n",
+ overlay_name_from_nr(overlay_nr),
+ unittest_path(unittest_nr, ovtype),
+--
+2.40.1
+
--- /dev/null
+From 58953f44d2df88cb9e5634ee07a74fdae011eef6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2019 11:07:36 -0600
+Subject: PCI: Add #defines for Enter Compliance, Transmit Margin
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit bbdb2f5ecdf1e66b2f09710134db3c2e5c43a958 ]
+
+Add definitions for the Enter Compliance and Transmit Margin fields of the
+PCIe Link Control 2 register.
+
+Link: https://lore.kernel.org/r/20191112173503.176611-2-helgaas@kernel.org
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/pci_regs.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
+index c47dbeeb02318..39c69235a3843 100644
+--- a/include/uapi/linux/pci_regs.h
++++ b/include/uapi/linux/pci_regs.h
+@@ -671,6 +671,8 @@
+ #define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003 /* Supported Speed 8GT/s */
+ #define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004 /* Supported Speed 16GT/s */
+ #define PCI_EXP_LNKCTL2_TLS_32_0GT 0x0005 /* Supported Speed 32GT/s */
++#define PCI_EXP_LNKCTL2_ENTER_COMP 0x0010 /* Enter Compliance */
++#define PCI_EXP_LNKCTL2_TX_MARGIN 0x0380 /* Transmit Margin */
+ #define PCI_EXP_LNKSTA2 50 /* Link Status 2 */
+ #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52 /* v2 endpoints with link end here */
+ #define PCI_EXP_SLTCAP2 52 /* Slot Capabilities 2 */
+--
+2.40.1
+
--- /dev/null
+From e57763ddd31cfef5648beebe8a9f5e237e15b677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jul 2023 15:04:56 +0300
+Subject: PCI/ASPM: Use RMW accessors for changing LNKCTL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit e09060b3b6b4661278ff8e1b7b81a37d5ea86eae ]
+
+Don't assume that the device is fully under the control of ASPM and use RMW
+capability accessors which do proper locking to avoid losing concurrent
+updates to the register values.
+
+If configuration fails in pcie_aspm_configure_common_clock(), the
+function attempts to restore the old PCI_EXP_LNKCTL_CCC settings. Store
+only the old PCI_EXP_LNKCTL_CCC bit for the relevant devices rather
+than the content of the whole LNKCTL registers. It aligns better with
+how pcie_lnkctl_clear_and_set() expects its parameter and makes the
+code more obvious to understand.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Fixes: 2a42d9dba784 ("PCIe: ASPM: Break out of endless loop waiting for PCI config bits to switch")
+Fixes: 7d715a6c1ae5 ("PCI: add PCI Express ASPM support")
+Link: https://lore.kernel.org/r/20230717120503.15276-5-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: "Rafael J. Wysocki" <rafael@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aspm.c | 30 +++++++++++++-----------------
+ 1 file changed, 13 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index eec62f7377f48..118c91586798d 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -260,7 +260,7 @@ static int pcie_retrain_link(struct pcie_link_state *link)
+ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
+ {
+ int same_clock = 1;
+- u16 reg16, parent_reg, child_reg[8];
++ u16 reg16, ccc, parent_old_ccc, child_old_ccc[8];
+ struct pci_dev *child, *parent = link->pdev;
+ struct pci_bus *linkbus = parent->subordinate;
+ /*
+@@ -282,6 +282,7 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
+
+ /* Port might be already in common clock mode */
+ pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16);
++ parent_old_ccc = reg16 & PCI_EXP_LNKCTL_CCC;
+ if (same_clock && (reg16 & PCI_EXP_LNKCTL_CCC)) {
+ bool consistent = true;
+
+@@ -298,34 +299,29 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
+ pci_warn(parent, "ASPM: current common clock configuration is broken, reconfiguring\n");
+ }
+
++ ccc = same_clock ? PCI_EXP_LNKCTL_CCC : 0;
+ /* Configure downstream component, all functions */
+ list_for_each_entry(child, &linkbus->devices, bus_list) {
+ pcie_capability_read_word(child, PCI_EXP_LNKCTL, ®16);
+- child_reg[PCI_FUNC(child->devfn)] = reg16;
+- if (same_clock)
+- reg16 |= PCI_EXP_LNKCTL_CCC;
+- else
+- reg16 &= ~PCI_EXP_LNKCTL_CCC;
+- pcie_capability_write_word(child, PCI_EXP_LNKCTL, reg16);
++ child_old_ccc[PCI_FUNC(child->devfn)] = reg16 & PCI_EXP_LNKCTL_CCC;
++ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_CCC, ccc);
+ }
+
+ /* Configure upstream component */
+- pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16);
+- parent_reg = reg16;
+- if (same_clock)
+- reg16 |= PCI_EXP_LNKCTL_CCC;
+- else
+- reg16 &= ~PCI_EXP_LNKCTL_CCC;
+- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
++ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_CCC, ccc);
+
+ if (pcie_retrain_link(link)) {
+
+ /* Training failed. Restore common clock configurations */
+ pci_err(parent, "ASPM: Could not configure common clock\n");
+ list_for_each_entry(child, &linkbus->devices, bus_list)
+- pcie_capability_write_word(child, PCI_EXP_LNKCTL,
+- child_reg[PCI_FUNC(child->devfn)]);
+- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, parent_reg);
++ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_CCC,
++ child_old_ccc[PCI_FUNC(child->devfn)]);
++ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_CCC, parent_old_ccc);
+ }
+ }
+
+--
+2.40.1
+
--- /dev/null
+From aa13d91b35f7ee0b43e7b9d60807b1c8df27a589 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 11:04:51 -0800
+Subject: PCI/ATS: Add pci_prg_resp_pasid_required() interface.
+
+From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+
+[ Upstream commit e5567f5f67621877726f99be040af9fbedda37dc ]
+
+Return the PRG Response PASID Required bit in the Page Request
+Status Register.
+
+As per PCIe spec r4.0, sec 10.5.2.3, if this bit is Set, the device
+expects a PASID TLP Prefix on PRG Response Messages when the
+corresponding Page Requests had a PASID TLP Prefix. If Clear, the device
+does not expect PASID TLP Prefixes on any PRG Response Message, and the
+device behavior is undefined if the device receives a PRG Response Message
+with a PASID TLP Prefix. Also the device behavior is undefined if this
+bit is Set and the device receives a PRG Response Message with no PASID TLP
+Prefix when the corresponding Page Requests had a PASID TLP Prefix.
+
+This function will be used by drivers like IOMMU, if it is required to
+check the status of the PRG Response PASID Required bit before enabling
+the PASID support of the device.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Cc: Keith Busch <keith.busch@intel.com>
+Suggested-by: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/ats.c | 30 ++++++++++++++++++++++++++++++
+ include/linux/pci-ats.h | 5 +++++
+ include/uapi/linux/pci_regs.h | 1 +
+ 3 files changed, 36 insertions(+)
+
+diff --git a/drivers/pci/ats.c b/drivers/pci/ats.c
+index 5b78f3b1b918a..420cd0a578d07 100644
+--- a/drivers/pci/ats.c
++++ b/drivers/pci/ats.c
+@@ -368,6 +368,36 @@ int pci_pasid_features(struct pci_dev *pdev)
+ }
+ EXPORT_SYMBOL_GPL(pci_pasid_features);
+
++/**
++ * pci_prg_resp_pasid_required - Return PRG Response PASID Required bit
++ * status.
++ * @pdev: PCI device structure
++ *
++ * Returns 1 if PASID is required in PRG Response Message, 0 otherwise.
++ *
++ * Even though the PRG response PASID status is read from PRI Status
++ * Register, since this API will mainly be used by PASID users, this
++ * function is defined within #ifdef CONFIG_PCI_PASID instead of
++ * CONFIG_PCI_PRI.
++ */
++int pci_prg_resp_pasid_required(struct pci_dev *pdev)
++{
++ u16 status;
++ int pos;
++
++ pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_PRI);
++ if (!pos)
++ return 0;
++
++ pci_read_config_word(pdev, pos + PCI_PRI_STATUS, &status);
++
++ if (status & PCI_PRI_STATUS_PASID)
++ return 1;
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(pci_prg_resp_pasid_required);
++
+ #define PASID_NUMBER_SHIFT 8
+ #define PASID_NUMBER_MASK (0x1f << PASID_NUMBER_SHIFT)
+ /**
+diff --git a/include/linux/pci-ats.h b/include/linux/pci-ats.h
+index 7c4b8e27268c7..facfd6a18fe18 100644
+--- a/include/linux/pci-ats.h
++++ b/include/linux/pci-ats.h
+@@ -40,6 +40,7 @@ void pci_disable_pasid(struct pci_dev *pdev);
+ void pci_restore_pasid_state(struct pci_dev *pdev);
+ int pci_pasid_features(struct pci_dev *pdev);
+ int pci_max_pasids(struct pci_dev *pdev);
++int pci_prg_resp_pasid_required(struct pci_dev *pdev);
+
+ #else /* CONFIG_PCI_PASID */
+
+@@ -66,6 +67,10 @@ static inline int pci_max_pasids(struct pci_dev *pdev)
+ return -EINVAL;
+ }
+
++static int pci_prg_resp_pasid_required(struct pci_dev *pdev)
++{
++ return 0;
++}
+ #endif /* CONFIG_PCI_PASID */
+
+
+diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
+index 8d2767140798b..4c7aa15b0e2ee 100644
+--- a/include/uapi/linux/pci_regs.h
++++ b/include/uapi/linux/pci_regs.h
+@@ -885,6 +885,7 @@
+ #define PCI_PRI_STATUS_RF 0x001 /* Response Failure */
+ #define PCI_PRI_STATUS_UPRGI 0x002 /* Unexpected PRG index */
+ #define PCI_PRI_STATUS_STOPPED 0x100 /* PRI Stopped */
++#define PCI_PRI_STATUS_PASID 0x8000 /* PRG Response PASID Required */
+ #define PCI_PRI_MAX_REQ 0x08 /* PRI max reqs supported */
+ #define PCI_PRI_ALLOC_REQ 0x0c /* PRI max reqs allowed */
+ #define PCI_EXT_CAP_PRI_SIZEOF 16
+--
+2.40.1
+
--- /dev/null
+From 3991525e8dc6b62220a340537c658c702596e0a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Feb 2019 14:50:14 -0600
+Subject: PCI: Cleanup register definition width and whitespace
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 35d0a06dad2220d62042fd1a91a216d17744e724 ]
+
+Follow the file conventions of:
+
+ - register offsets not indented
+ - fields within a register indented one space
+ - field masks use same width as register
+ - register field values indented an additional space
+
+No functional change intended.
+
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/pci_regs.h | 132 +++++++++++++++++-----------------
+ 1 file changed, 65 insertions(+), 67 deletions(-)
+
+diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
+index 4c7aa15b0e2ee..9fd0cb2f9d12d 100644
+--- a/include/uapi/linux/pci_regs.h
++++ b/include/uapi/linux/pci_regs.h
+@@ -1,7 +1,5 @@
+ /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+ /*
+- * pci_regs.h
+- *
+ * PCI standard defines
+ * Copyright 1994, Drew Eckhardt
+ * Copyright 1997--1999 Martin Mares <mj@ucw.cz>
+@@ -15,7 +13,7 @@
+ * PCI System Design Guide
+ *
+ * For HyperTransport information, please consult the following manuals
+- * from http://www.hypertransport.org
++ * from http://www.hypertransport.org :
+ *
+ * The HyperTransport I/O Link Specification
+ */
+@@ -300,7 +298,7 @@
+ #define PCI_SID_ESR_FIC 0x20 /* First In Chassis Flag */
+ #define PCI_SID_CHASSIS_NR 3 /* Chassis Number */
+
+-/* Message Signalled Interrupts registers */
++/* Message Signalled Interrupt registers */
+
+ #define PCI_MSI_FLAGS 2 /* Message Control */
+ #define PCI_MSI_FLAGS_ENABLE 0x0001 /* MSI feature enabled */
+@@ -318,7 +316,7 @@
+ #define PCI_MSI_MASK_64 16 /* Mask bits register for 64-bit devices */
+ #define PCI_MSI_PENDING_64 20 /* Pending intrs for 64-bit devices */
+
+-/* MSI-X registers */
++/* MSI-X registers (in MSI-X capability) */
+ #define PCI_MSIX_FLAGS 2 /* Message Control */
+ #define PCI_MSIX_FLAGS_QSIZE 0x07FF /* Table size */
+ #define PCI_MSIX_FLAGS_MASKALL 0x4000 /* Mask all vectors for this function */
+@@ -332,13 +330,13 @@
+ #define PCI_MSIX_FLAGS_BIRMASK PCI_MSIX_PBA_BIR /* deprecated */
+ #define PCI_CAP_MSIX_SIZEOF 12 /* size of MSIX registers */
+
+-/* MSI-X Table entry format */
++/* MSI-X Table entry format (in memory mapped by a BAR) */
+ #define PCI_MSIX_ENTRY_SIZE 16
+-#define PCI_MSIX_ENTRY_LOWER_ADDR 0
+-#define PCI_MSIX_ENTRY_UPPER_ADDR 4
+-#define PCI_MSIX_ENTRY_DATA 8
+-#define PCI_MSIX_ENTRY_VECTOR_CTRL 12
+-#define PCI_MSIX_ENTRY_CTRL_MASKBIT 1
++#define PCI_MSIX_ENTRY_LOWER_ADDR 0 /* Message Address */
++#define PCI_MSIX_ENTRY_UPPER_ADDR 4 /* Message Upper Address */
++#define PCI_MSIX_ENTRY_DATA 8 /* Message Data */
++#define PCI_MSIX_ENTRY_VECTOR_CTRL 12 /* Vector Control */
++#define PCI_MSIX_ENTRY_CTRL_MASKBIT 0x00000001
+
+ /* CompactPCI Hotswap Register */
+
+@@ -464,19 +462,19 @@
+ /* PCI Express capability registers */
+
+ #define PCI_EXP_FLAGS 2 /* Capabilities register */
+-#define PCI_EXP_FLAGS_VERS 0x000f /* Capability version */
+-#define PCI_EXP_FLAGS_TYPE 0x00f0 /* Device/Port type */
+-#define PCI_EXP_TYPE_ENDPOINT 0x0 /* Express Endpoint */
+-#define PCI_EXP_TYPE_LEG_END 0x1 /* Legacy Endpoint */
+-#define PCI_EXP_TYPE_ROOT_PORT 0x4 /* Root Port */
+-#define PCI_EXP_TYPE_UPSTREAM 0x5 /* Upstream Port */
+-#define PCI_EXP_TYPE_DOWNSTREAM 0x6 /* Downstream Port */
+-#define PCI_EXP_TYPE_PCI_BRIDGE 0x7 /* PCIe to PCI/PCI-X Bridge */
+-#define PCI_EXP_TYPE_PCIE_BRIDGE 0x8 /* PCI/PCI-X to PCIe Bridge */
+-#define PCI_EXP_TYPE_RC_END 0x9 /* Root Complex Integrated Endpoint */
+-#define PCI_EXP_TYPE_RC_EC 0xa /* Root Complex Event Collector */
+-#define PCI_EXP_FLAGS_SLOT 0x0100 /* Slot implemented */
+-#define PCI_EXP_FLAGS_IRQ 0x3e00 /* Interrupt message number */
++#define PCI_EXP_FLAGS_VERS 0x000f /* Capability version */
++#define PCI_EXP_FLAGS_TYPE 0x00f0 /* Device/Port type */
++#define PCI_EXP_TYPE_ENDPOINT 0x0 /* Express Endpoint */
++#define PCI_EXP_TYPE_LEG_END 0x1 /* Legacy Endpoint */
++#define PCI_EXP_TYPE_ROOT_PORT 0x4 /* Root Port */
++#define PCI_EXP_TYPE_UPSTREAM 0x5 /* Upstream Port */
++#define PCI_EXP_TYPE_DOWNSTREAM 0x6 /* Downstream Port */
++#define PCI_EXP_TYPE_PCI_BRIDGE 0x7 /* PCIe to PCI/PCI-X Bridge */
++#define PCI_EXP_TYPE_PCIE_BRIDGE 0x8 /* PCI/PCI-X to PCIe Bridge */
++#define PCI_EXP_TYPE_RC_END 0x9 /* Root Complex Integrated Endpoint */
++#define PCI_EXP_TYPE_RC_EC 0xa /* Root Complex Event Collector */
++#define PCI_EXP_FLAGS_SLOT 0x0100 /* Slot implemented */
++#define PCI_EXP_FLAGS_IRQ 0x3e00 /* Interrupt message number */
+ #define PCI_EXP_DEVCAP 4 /* Device capabilities */
+ #define PCI_EXP_DEVCAP_PAYLOAD 0x00000007 /* Max_Payload_Size */
+ #define PCI_EXP_DEVCAP_PHANTOM 0x00000018 /* Phantom functions */
+@@ -621,8 +619,8 @@
+ #define PCI_EXP_RTCAP 30 /* Root Capabilities */
+ #define PCI_EXP_RTCAP_CRSVIS 0x0001 /* CRS Software Visibility capability */
+ #define PCI_EXP_RTSTA 32 /* Root Status */
+-#define PCI_EXP_RTSTA_PME 0x00010000 /* PME status */
+-#define PCI_EXP_RTSTA_PENDING 0x00020000 /* PME pending */
++#define PCI_EXP_RTSTA_PME 0x00010000 /* PME status */
++#define PCI_EXP_RTSTA_PENDING 0x00020000 /* PME pending */
+ /*
+ * The Device Capabilities 2, Device Status 2, Device Control 2,
+ * Link Capabilities 2, Link Status 2, Link Control 2,
+@@ -642,13 +640,13 @@
+ #define PCI_EXP_DEVCAP2_OBFF_MASK 0x000c0000 /* OBFF support mechanism */
+ #define PCI_EXP_DEVCAP2_OBFF_MSG 0x00040000 /* New message signaling */
+ #define PCI_EXP_DEVCAP2_OBFF_WAKE 0x00080000 /* Re-use WAKE# for OBFF */
+-#define PCI_EXP_DEVCAP2_EE_PREFIX 0x00200000 /* End-End TLP Prefix */
++#define PCI_EXP_DEVCAP2_EE_PREFIX 0x00200000 /* End-End TLP Prefix */
+ #define PCI_EXP_DEVCTL2 40 /* Device Control 2 */
+ #define PCI_EXP_DEVCTL2_COMP_TIMEOUT 0x000f /* Completion Timeout Value */
+ #define PCI_EXP_DEVCTL2_COMP_TMOUT_DIS 0x0010 /* Completion Timeout Disable */
+ #define PCI_EXP_DEVCTL2_ARI 0x0020 /* Alternative Routing-ID */
+-#define PCI_EXP_DEVCTL2_ATOMIC_REQ 0x0040 /* Set Atomic requests */
+-#define PCI_EXP_DEVCTL2_ATOMIC_EGRESS_BLOCK 0x0080 /* Block atomic egress */
++#define PCI_EXP_DEVCTL2_ATOMIC_REQ 0x0040 /* Set Atomic requests */
++#define PCI_EXP_DEVCTL2_ATOMIC_EGRESS_BLOCK 0x0080 /* Block atomic egress */
+ #define PCI_EXP_DEVCTL2_IDO_REQ_EN 0x0100 /* Allow IDO for requests */
+ #define PCI_EXP_DEVCTL2_IDO_CMP_EN 0x0200 /* Allow IDO for completions */
+ #define PCI_EXP_DEVCTL2_LTR_EN 0x0400 /* Enable LTR mechanism */
+@@ -664,11 +662,11 @@
+ #define PCI_EXP_LNKCAP2_SLS_16_0GB 0x00000010 /* Supported Speed 16GT/s */
+ #define PCI_EXP_LNKCAP2_CROSSLINK 0x00000100 /* Crosslink supported */
+ #define PCI_EXP_LNKCTL2 48 /* Link Control 2 */
+-#define PCI_EXP_LNKCTL2_TLS 0x000f
+-#define PCI_EXP_LNKCTL2_TLS_2_5GT 0x0001 /* Supported Speed 2.5GT/s */
+-#define PCI_EXP_LNKCTL2_TLS_5_0GT 0x0002 /* Supported Speed 5GT/s */
+-#define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003 /* Supported Speed 8GT/s */
+-#define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004 /* Supported Speed 16GT/s */
++#define PCI_EXP_LNKCTL2_TLS 0x000f
++#define PCI_EXP_LNKCTL2_TLS_2_5GT 0x0001 /* Supported Speed 2.5GT/s */
++#define PCI_EXP_LNKCTL2_TLS_5_0GT 0x0002 /* Supported Speed 5GT/s */
++#define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003 /* Supported Speed 8GT/s */
++#define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004 /* Supported Speed 16GT/s */
+ #define PCI_EXP_LNKSTA2 50 /* Link Status 2 */
+ #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52 /* v2 endpoints with link end here */
+ #define PCI_EXP_SLTCAP2 52 /* Slot Capabilities 2 */
+@@ -757,18 +755,18 @@
+ #define PCI_ERR_CAP_ECRC_CHKE 0x00000100 /* ECRC Check Enable */
+ #define PCI_ERR_HEADER_LOG 28 /* Header Log Register (16 bytes) */
+ #define PCI_ERR_ROOT_COMMAND 44 /* Root Error Command */
+-#define PCI_ERR_ROOT_CMD_COR_EN 0x00000001 /* Correctable Err Reporting Enable */
+-#define PCI_ERR_ROOT_CMD_NONFATAL_EN 0x00000002 /* Non-Fatal Err Reporting Enable */
+-#define PCI_ERR_ROOT_CMD_FATAL_EN 0x00000004 /* Fatal Err Reporting Enable */
++#define PCI_ERR_ROOT_CMD_COR_EN 0x00000001 /* Correctable Err Reporting Enable */
++#define PCI_ERR_ROOT_CMD_NONFATAL_EN 0x00000002 /* Non-Fatal Err Reporting Enable */
++#define PCI_ERR_ROOT_CMD_FATAL_EN 0x00000004 /* Fatal Err Reporting Enable */
+ #define PCI_ERR_ROOT_STATUS 48
+-#define PCI_ERR_ROOT_COR_RCV 0x00000001 /* ERR_COR Received */
+-#define PCI_ERR_ROOT_MULTI_COR_RCV 0x00000002 /* Multiple ERR_COR */
+-#define PCI_ERR_ROOT_UNCOR_RCV 0x00000004 /* ERR_FATAL/NONFATAL */
+-#define PCI_ERR_ROOT_MULTI_UNCOR_RCV 0x00000008 /* Multiple FATAL/NONFATAL */
+-#define PCI_ERR_ROOT_FIRST_FATAL 0x00000010 /* First UNC is Fatal */
+-#define PCI_ERR_ROOT_NONFATAL_RCV 0x00000020 /* Non-Fatal Received */
+-#define PCI_ERR_ROOT_FATAL_RCV 0x00000040 /* Fatal Received */
+-#define PCI_ERR_ROOT_AER_IRQ 0xf8000000 /* Advanced Error Interrupt Message Number */
++#define PCI_ERR_ROOT_COR_RCV 0x00000001 /* ERR_COR Received */
++#define PCI_ERR_ROOT_MULTI_COR_RCV 0x00000002 /* Multiple ERR_COR */
++#define PCI_ERR_ROOT_UNCOR_RCV 0x00000004 /* ERR_FATAL/NONFATAL */
++#define PCI_ERR_ROOT_MULTI_UNCOR_RCV 0x00000008 /* Multiple FATAL/NONFATAL */
++#define PCI_ERR_ROOT_FIRST_FATAL 0x00000010 /* First UNC is Fatal */
++#define PCI_ERR_ROOT_NONFATAL_RCV 0x00000020 /* Non-Fatal Received */
++#define PCI_ERR_ROOT_FATAL_RCV 0x00000040 /* Fatal Received */
++#define PCI_ERR_ROOT_AER_IRQ 0xf8000000 /* Advanced Error Interrupt Message Number */
+ #define PCI_ERR_ROOT_ERR_SRC 52 /* Error Source Identification */
+
+ /* Virtual Channel */
+@@ -879,12 +877,12 @@
+
+ /* Page Request Interface */
+ #define PCI_PRI_CTRL 0x04 /* PRI control register */
+-#define PCI_PRI_CTRL_ENABLE 0x01 /* Enable */
+-#define PCI_PRI_CTRL_RESET 0x02 /* Reset */
++#define PCI_PRI_CTRL_ENABLE 0x0001 /* Enable */
++#define PCI_PRI_CTRL_RESET 0x0002 /* Reset */
+ #define PCI_PRI_STATUS 0x06 /* PRI status register */
+-#define PCI_PRI_STATUS_RF 0x001 /* Response Failure */
+-#define PCI_PRI_STATUS_UPRGI 0x002 /* Unexpected PRG index */
+-#define PCI_PRI_STATUS_STOPPED 0x100 /* PRI Stopped */
++#define PCI_PRI_STATUS_RF 0x0001 /* Response Failure */
++#define PCI_PRI_STATUS_UPRGI 0x0002 /* Unexpected PRG index */
++#define PCI_PRI_STATUS_STOPPED 0x0100 /* PRI Stopped */
+ #define PCI_PRI_STATUS_PASID 0x8000 /* PRG Response PASID Required */
+ #define PCI_PRI_MAX_REQ 0x08 /* PRI max reqs supported */
+ #define PCI_PRI_ALLOC_REQ 0x0c /* PRI max reqs allowed */
+@@ -902,16 +900,16 @@
+
+ /* Single Root I/O Virtualization */
+ #define PCI_SRIOV_CAP 0x04 /* SR-IOV Capabilities */
+-#define PCI_SRIOV_CAP_VFM 0x01 /* VF Migration Capable */
++#define PCI_SRIOV_CAP_VFM 0x00000001 /* VF Migration Capable */
+ #define PCI_SRIOV_CAP_INTR(x) ((x) >> 21) /* Interrupt Message Number */
+ #define PCI_SRIOV_CTRL 0x08 /* SR-IOV Control */
+-#define PCI_SRIOV_CTRL_VFE 0x01 /* VF Enable */
+-#define PCI_SRIOV_CTRL_VFM 0x02 /* VF Migration Enable */
+-#define PCI_SRIOV_CTRL_INTR 0x04 /* VF Migration Interrupt Enable */
+-#define PCI_SRIOV_CTRL_MSE 0x08 /* VF Memory Space Enable */
+-#define PCI_SRIOV_CTRL_ARI 0x10 /* ARI Capable Hierarchy */
++#define PCI_SRIOV_CTRL_VFE 0x0001 /* VF Enable */
++#define PCI_SRIOV_CTRL_VFM 0x0002 /* VF Migration Enable */
++#define PCI_SRIOV_CTRL_INTR 0x0004 /* VF Migration Interrupt Enable */
++#define PCI_SRIOV_CTRL_MSE 0x0008 /* VF Memory Space Enable */
++#define PCI_SRIOV_CTRL_ARI 0x0010 /* ARI Capable Hierarchy */
+ #define PCI_SRIOV_STATUS 0x0a /* SR-IOV Status */
+-#define PCI_SRIOV_STATUS_VFM 0x01 /* VF Migration Status */
++#define PCI_SRIOV_STATUS_VFM 0x0001 /* VF Migration Status */
+ #define PCI_SRIOV_INITIAL_VF 0x0c /* Initial VFs */
+ #define PCI_SRIOV_TOTAL_VF 0x0e /* Total VFs */
+ #define PCI_SRIOV_NUM_VF 0x10 /* Number of VFs */
+@@ -941,13 +939,13 @@
+
+ /* Access Control Service */
+ #define PCI_ACS_CAP 0x04 /* ACS Capability Register */
+-#define PCI_ACS_SV 0x01 /* Source Validation */
+-#define PCI_ACS_TB 0x02 /* Translation Blocking */
+-#define PCI_ACS_RR 0x04 /* P2P Request Redirect */
+-#define PCI_ACS_CR 0x08 /* P2P Completion Redirect */
+-#define PCI_ACS_UF 0x10 /* Upstream Forwarding */
+-#define PCI_ACS_EC 0x20 /* P2P Egress Control */
+-#define PCI_ACS_DT 0x40 /* Direct Translated P2P */
++#define PCI_ACS_SV 0x0001 /* Source Validation */
++#define PCI_ACS_TB 0x0002 /* Translation Blocking */
++#define PCI_ACS_RR 0x0004 /* P2P Request Redirect */
++#define PCI_ACS_CR 0x0008 /* P2P Completion Redirect */
++#define PCI_ACS_UF 0x0010 /* Upstream Forwarding */
++#define PCI_ACS_EC 0x0020 /* P2P Egress Control */
++#define PCI_ACS_DT 0x0040 /* Direct Translated P2P */
+ #define PCI_ACS_EGRESS_BITS 0x05 /* ACS Egress Control Vector Size */
+ #define PCI_ACS_CTRL 0x06 /* ACS Control Register */
+ #define PCI_ACS_EGRESS_CTL_V 0x08 /* ACS Egress Control Vector */
+@@ -997,9 +995,9 @@
+ #define PCI_EXP_DPC_CAP_DL_ACTIVE 0x1000 /* ERR_COR signal on DL_Active supported */
+
+ #define PCI_EXP_DPC_CTL 6 /* DPC control */
+-#define PCI_EXP_DPC_CTL_EN_FATAL 0x0001 /* Enable trigger on ERR_FATAL message */
+-#define PCI_EXP_DPC_CTL_EN_NONFATAL 0x0002 /* Enable trigger on ERR_NONFATAL message */
+-#define PCI_EXP_DPC_CTL_INT_EN 0x0008 /* DPC Interrupt Enable */
++#define PCI_EXP_DPC_CTL_EN_FATAL 0x0001 /* Enable trigger on ERR_FATAL message */
++#define PCI_EXP_DPC_CTL_EN_NONFATAL 0x0002 /* Enable trigger on ERR_NONFATAL message */
++#define PCI_EXP_DPC_CTL_INT_EN 0x0008 /* DPC Interrupt Enable */
+
+ #define PCI_EXP_DPC_STATUS 8 /* DPC Status */
+ #define PCI_EXP_DPC_STATUS_TRIGGER 0x0001 /* Trigger Status */
+--
+2.40.1
+
--- /dev/null
+From 03da6f1463f7bdb5bfb7929b6893eda205ec2da2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 18:24:43 +0200
+Subject: PCI: Decode PCIe 32 GT/s link speed
+
+From: Gustavo Pimentel <Gustavo.Pimentel@synopsys.com>
+
+[ Upstream commit de76cda215d56256ffcda7ffa538b70f9fb301a7 ]
+
+PCIe r5.0, sec 7.5.3.18, defines a new 32.0 GT/s bit in the Supported Link
+Speeds Vector of Link Capabilities 2. Decode this new speed. This does
+not affect the speed of the link, which should be negotiated automatically
+by the hardware; it only adds decoding when showing the speed to the user.
+
+Previously, reading the speed of a link operating at this speed showed
+"Unknown speed" instead of "32.0 GT/s".
+
+Link: https://lore.kernel.org/lkml/92365e3caf0fc559f9ab14bcd053bfc92d4f661c.1559664969.git.gustavo.pimentel@synopsys.com
+Signed-off-by: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
+[bhelgaas: changelog]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-sysfs.c | 3 +++
+ drivers/pci/pci.c | 4 +++-
+ drivers/pci/probe.c | 2 +-
+ drivers/pci/slot.c | 1 +
+ include/linux/pci.h | 1 +
+ include/uapi/linux/pci_regs.h | 4 ++++
+ 6 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index 34a7b3c137bb0..7d3fb70568e3d 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -182,6 +182,9 @@ static ssize_t current_link_speed_show(struct device *dev,
+ return -EINVAL;
+
+ switch (linkstat & PCI_EXP_LNKSTA_CLS) {
++ case PCI_EXP_LNKSTA_CLS_32_0GB:
++ speed = "32 GT/s";
++ break;
+ case PCI_EXP_LNKSTA_CLS_16_0GB:
+ speed = "16 GT/s";
+ break;
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index c8326c7b468fa..2ac400adaee11 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5575,7 +5575,9 @@ enum pci_bus_speed pcie_get_speed_cap(struct pci_dev *dev)
+ */
+ pcie_capability_read_dword(dev, PCI_EXP_LNKCAP2, &lnkcap2);
+ if (lnkcap2) { /* PCIe r3.0-compliant */
+- if (lnkcap2 & PCI_EXP_LNKCAP2_SLS_16_0GB)
++ if (lnkcap2 & PCI_EXP_LNKCAP2_SLS_32_0GB)
++ return PCIE_SPEED_32_0GT;
++ else if (lnkcap2 & PCI_EXP_LNKCAP2_SLS_16_0GB)
+ return PCIE_SPEED_16_0GT;
+ else if (lnkcap2 & PCI_EXP_LNKCAP2_SLS_8_0GB)
+ return PCIE_SPEED_8_0GT;
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 113b7bdf86dd9..5a609848452f2 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -667,7 +667,7 @@ const unsigned char pcie_link_speed[] = {
+ PCIE_SPEED_5_0GT, /* 2 */
+ PCIE_SPEED_8_0GT, /* 3 */
+ PCIE_SPEED_16_0GT, /* 4 */
+- PCI_SPEED_UNKNOWN, /* 5 */
++ PCIE_SPEED_32_0GT, /* 5 */
+ PCI_SPEED_UNKNOWN, /* 6 */
+ PCI_SPEED_UNKNOWN, /* 7 */
+ PCI_SPEED_UNKNOWN, /* 8 */
+diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
+index dfbe9cbf292c0..d575583e49c2c 100644
+--- a/drivers/pci/slot.c
++++ b/drivers/pci/slot.c
+@@ -75,6 +75,7 @@ static const char *pci_bus_speed_strings[] = {
+ "5.0 GT/s PCIe", /* 0x15 */
+ "8.0 GT/s PCIe", /* 0x16 */
+ "16.0 GT/s PCIe", /* 0x17 */
++ "32.0 GT/s PCIe", /* 0x18 */
+ };
+
+ static ssize_t bus_speed_read(enum pci_bus_speed speed, char *buf)
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 1d1b0bfd51968..2636990e0cccf 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -260,6 +260,7 @@ enum pci_bus_speed {
+ PCIE_SPEED_5_0GT = 0x15,
+ PCIE_SPEED_8_0GT = 0x16,
+ PCIE_SPEED_16_0GT = 0x17,
++ PCIE_SPEED_32_0GT = 0x18,
+ PCI_SPEED_UNKNOWN = 0xff,
+ };
+
+diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
+index 9fd0cb2f9d12d..c47dbeeb02318 100644
+--- a/include/uapi/linux/pci_regs.h
++++ b/include/uapi/linux/pci_regs.h
+@@ -527,6 +527,7 @@
+ #define PCI_EXP_LNKCAP_SLS_5_0GB 0x00000002 /* LNKCAP2 SLS Vector bit 1 */
+ #define PCI_EXP_LNKCAP_SLS_8_0GB 0x00000003 /* LNKCAP2 SLS Vector bit 2 */
+ #define PCI_EXP_LNKCAP_SLS_16_0GB 0x00000004 /* LNKCAP2 SLS Vector bit 3 */
++#define PCI_EXP_LNKCAP_SLS_32_0GB 0x00000005 /* LNKCAP2 SLS Vector bit 4 */
+ #define PCI_EXP_LNKCAP_MLW 0x000003f0 /* Maximum Link Width */
+ #define PCI_EXP_LNKCAP_ASPMS 0x00000c00 /* ASPM Support */
+ #define PCI_EXP_LNKCAP_L0SEL 0x00007000 /* L0s Exit Latency */
+@@ -555,6 +556,7 @@
+ #define PCI_EXP_LNKSTA_CLS_5_0GB 0x0002 /* Current Link Speed 5.0GT/s */
+ #define PCI_EXP_LNKSTA_CLS_8_0GB 0x0003 /* Current Link Speed 8.0GT/s */
+ #define PCI_EXP_LNKSTA_CLS_16_0GB 0x0004 /* Current Link Speed 16.0GT/s */
++#define PCI_EXP_LNKSTA_CLS_32_0GB 0x0005 /* Current Link Speed 32.0GT/s */
+ #define PCI_EXP_LNKSTA_NLW 0x03f0 /* Negotiated Link Width */
+ #define PCI_EXP_LNKSTA_NLW_X1 0x0010 /* Current Link Width x1 */
+ #define PCI_EXP_LNKSTA_NLW_X2 0x0020 /* Current Link Width x2 */
+@@ -660,6 +662,7 @@
+ #define PCI_EXP_LNKCAP2_SLS_5_0GB 0x00000004 /* Supported Speed 5GT/s */
+ #define PCI_EXP_LNKCAP2_SLS_8_0GB 0x00000008 /* Supported Speed 8GT/s */
+ #define PCI_EXP_LNKCAP2_SLS_16_0GB 0x00000010 /* Supported Speed 16GT/s */
++#define PCI_EXP_LNKCAP2_SLS_32_0GB 0x00000020 /* Supported Speed 32GT/s */
+ #define PCI_EXP_LNKCAP2_CROSSLINK 0x00000100 /* Crosslink supported */
+ #define PCI_EXP_LNKCTL2 48 /* Link Control 2 */
+ #define PCI_EXP_LNKCTL2_TLS 0x000f
+@@ -667,6 +670,7 @@
+ #define PCI_EXP_LNKCTL2_TLS_5_0GT 0x0002 /* Supported Speed 5GT/s */
+ #define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003 /* Supported Speed 8GT/s */
+ #define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004 /* Supported Speed 16GT/s */
++#define PCI_EXP_LNKCTL2_TLS_32_0GT 0x0005 /* Supported Speed 32GT/s */
+ #define PCI_EXP_LNKSTA2 50 /* Link Status 2 */
+ #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52 /* v2 endpoints with link end here */
+ #define PCI_EXP_SLTCAP2 52 /* Slot Capabilities 2 */
+--
+2.40.1
+
--- /dev/null
+From b518750ce126ce51ea4aee150e58ba9a5dcfe40b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 20:34:11 +0800
+Subject: PCI: Mark NVIDIA T4 GPUs to avoid bus reset
+
+From: Wu Zongyong <wuzongyong@linux.alibaba.com>
+
+[ Upstream commit d5af729dc2071273f14cbb94abbc60608142fd83 ]
+
+NVIDIA T4 GPUs do not work with SBR. This problem is found when the T4 card
+is direct attached to a Root Port only. Avoid bus reset by marking T4 GPUs
+PCI_DEV_FLAGS_NO_BUS_RESET.
+
+Fixes: 4c207e7121fa ("PCI: Mark some NVIDIA GPUs to avoid bus reset")
+Link: https://lore.kernel.org/r/2dcebea53a6eb9bd212ec6d8974af2e5e0333ef6.1681129861.git.wuzongyong@linux.alibaba.com
+Signed-off-by: Wu Zongyong <wuzongyong@linux.alibaba.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index fa9d6c8f1cf89..a43e0e20b1ea6 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3472,7 +3472,7 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ */
+ static void quirk_nvidia_no_bus_reset(struct pci_dev *dev)
+ {
+- if ((dev->device & 0xffc0) == 0x2340)
++ if ((dev->device & 0xffc0) == 0x2340 || dev->device == 0x1eb8)
+ quirk_no_bus_reset(dev);
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
+--
+2.40.1
+
--- /dev/null
+From 4d307827ffd34a1c2fdfc319dce514710ff484d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jul 2023 15:04:55 +0300
+Subject: PCI: pciehp: Use RMW accessors for changing LNKCTL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 5f75f96c61039151c193775d776fde42477eace1 ]
+
+As hotplug is not the only driver touching LNKCTL, use the RMW capability
+accessor which handles concurrent changes correctly.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Fixes: 7f822999e12a ("PCI: pciehp: Add Disable/enable link functions")
+Link: https://lore.kernel.org/r/20230717120503.15276-4-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: "Rafael J. Wysocki" <rafael@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/hotplug/pciehp_hpc.c | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 7392b26e9f158..04630106269af 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -298,17 +298,11 @@ int pciehp_check_link_status(struct controller *ctrl)
+ static int __pciehp_link_set(struct controller *ctrl, bool enable)
+ {
+ struct pci_dev *pdev = ctrl_dev(ctrl);
+- u16 lnk_ctrl;
+
+- pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &lnk_ctrl);
++ pcie_capability_clear_and_set_word(pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_LD,
++ enable ? 0 : PCI_EXP_LNKCTL_LD);
+
+- if (enable)
+- lnk_ctrl &= ~PCI_EXP_LNKCTL_LD;
+- else
+- lnk_ctrl |= PCI_EXP_LNKCTL_LD;
+-
+- pcie_capability_write_word(pdev, PCI_EXP_LNKCTL, lnk_ctrl);
+- ctrl_dbg(ctrl, "%s: lnk_ctrl = %x\n", __func__, lnk_ctrl);
+ return 0;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From 10e61a132fb536f3de0392bdf14032b3621f3b35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 14:53:22 +1100
+Subject: powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
+
+From: Russell Currey <ruscur@russell.cc>
+
+[ Upstream commit c37b6908f7b2bd24dcaaf14a180e28c9132b9c58 ]
+
+fail_iommu_setup() registers the fail_iommu_bus_notifier struct to both
+PCI and VIO buses. struct notifier_block is a linked list node, so this
+causes any notifiers later registered to either bus type to also be
+registered to the other since they share the same node.
+
+This causes issues in (at least) the vgaarb code, which registers a
+notifier for PCI buses. pci_notify() ends up being called on a vio
+device, converted with to_pci_dev() even though it's not a PCI device,
+and finally makes a bad access in vga_arbiter_add_pci_device() as
+discovered with KASAN:
+
+ BUG: KASAN: slab-out-of-bounds in vga_arbiter_add_pci_device+0x60/0xe00
+ Read of size 4 at addr c000000264c26fdc by task swapper/0/1
+
+ Call Trace:
+ dump_stack_lvl+0x1bc/0x2b8 (unreliable)
+ print_report+0x3f4/0xc60
+ kasan_report+0x244/0x698
+ __asan_load4+0xe8/0x250
+ vga_arbiter_add_pci_device+0x60/0xe00
+ pci_notify+0x88/0x444
+ notifier_call_chain+0x104/0x320
+ blocking_notifier_call_chain+0xa0/0x140
+ device_add+0xac8/0x1d30
+ device_register+0x58/0x80
+ vio_register_device_node+0x9ac/0xce0
+ vio_bus_scan_register_devices+0xc4/0x13c
+ __machine_initcall_pseries_vio_device_init+0x94/0xf0
+ do_one_initcall+0x12c/0xaa8
+ kernel_init_freeable+0xa48/0xba8
+ kernel_init+0x64/0x400
+ ret_from_kernel_thread+0x5c/0x64
+
+Fix this by creating separate notifier_block structs for each bus type.
+
+Fixes: d6b9a81b2a45 ("powerpc: IOMMU fault injection")
+Reported-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
+Signed-off-by: Russell Currey <ruscur@russell.cc>
+Tested-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
+Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
+[mpe: Add #ifdef to fix CONFIG_IBMVIO=n build]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230322035322.328709-1-ruscur@russell.cc
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/iommu.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
+index c3d2d5cd7c10c..af1a2bf758c5c 100644
+--- a/arch/powerpc/kernel/iommu.c
++++ b/arch/powerpc/kernel/iommu.c
+@@ -145,17 +145,28 @@ static int fail_iommu_bus_notify(struct notifier_block *nb,
+ return 0;
+ }
+
+-static struct notifier_block fail_iommu_bus_notifier = {
++/*
++ * PCI and VIO buses need separate notifier_block structs, since they're linked
++ * list nodes. Sharing a notifier_block would mean that any notifiers later
++ * registered for PCI buses would also get called by VIO buses and vice versa.
++ */
++static struct notifier_block fail_iommu_pci_bus_notifier = {
+ .notifier_call = fail_iommu_bus_notify
+ };
+
++#ifdef CONFIG_IBMVIO
++static struct notifier_block fail_iommu_vio_bus_notifier = {
++ .notifier_call = fail_iommu_bus_notify
++};
++#endif
++
+ static int __init fail_iommu_setup(void)
+ {
+ #ifdef CONFIG_PCI
+- bus_register_notifier(&pci_bus_type, &fail_iommu_bus_notifier);
++ bus_register_notifier(&pci_bus_type, &fail_iommu_pci_bus_notifier);
+ #endif
+ #ifdef CONFIG_IBMVIO
+- bus_register_notifier(&vio_bus_type, &fail_iommu_bus_notifier);
++ bus_register_notifier(&vio_bus_type, &fail_iommu_vio_bus_notifier);
+ #endif
+
+ return 0;
+--
+2.40.1
+
--- /dev/null
+From 65ed1099283fd93e9cb3a4db7c47def2053b333b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2019 09:39:03 +0800
+Subject: quota: add dqi_dirty_list description to comment of Dquot List
+ Management
+
+From: Chengguang Xu <cgxu519@gmail.com>
+
+[ Upstream commit f44840ad1f822d9ecee6a3f91f2d17825a361307 ]
+
+Actually there are four lists for dquot management, so add
+the description of dqui_dirty_list to comment.
+
+Signed-off-by: Chengguang Xu <cgxu519@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index d901119e25b51..01bec330d54b1 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -223,9 +223,9 @@ static void put_quota_format(struct quota_format_type *fmt)
+
+ /*
+ * Dquot List Management:
+- * The quota code uses three lists for dquot management: the inuse_list,
+- * free_dquots, and dquot_hash[] array. A single dquot structure may be
+- * on all three lists, depending on its current state.
++ * The quota code uses four lists for dquot management: the inuse_list,
++ * free_dquots, dqi_dirty_list, and dquot_hash[] array. A single dquot
++ * structure may be on some of those lists, depending on its current state.
+ *
+ * All dquots are placed to the end of inuse_list when first created, and this
+ * list is used for invalidate operation, which must look at every dquot.
+@@ -236,6 +236,11 @@ static void put_quota_format(struct quota_format_type *fmt)
+ * dqstats.free_dquots gives the number of dquots on the list. When
+ * dquot is invalidated it's completely released from memory.
+ *
++ * Dirty dquots are added to the dqi_dirty_list of quota_info when mark
++ * dirtied, and this list is searched when writing dirty dquots back to
++ * quota file. Note that some filesystems do dirty dquot tracking on their
++ * own (e.g. in a journal) and thus don't use dqi_dirty_list.
++ *
+ * Dquots with a specific identity (device, type and id) are placed on
+ * one of the dquot_hash[] hash chains. The provides an efficient search
+ * mechanism to locate a specific dquot.
+--
+2.40.1
+
--- /dev/null
+From 5d980c01984abb8cca98e078d5cb3c820c00632a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 19:08:20 +0800
+Subject: quota: add new helper dquot_active()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 33bcfafc48cb186bc4bbcea247feaa396594229e ]
+
+Add new helper function dquot_active() to make the code more concise.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Message-Id: <20230630110822.3881712-4-libaokun1@huawei.com>
+Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 368e344b12951..273971b4060d6 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -336,6 +336,11 @@ static void wait_on_dquot(struct dquot *dquot)
+ mutex_unlock(&dquot->dq_lock);
+ }
+
++static inline int dquot_active(struct dquot *dquot)
++{
++ return test_bit(DQ_ACTIVE_B, &dquot->dq_flags);
++}
++
+ static inline int dquot_dirty(struct dquot *dquot)
+ {
+ return test_bit(DQ_MOD_B, &dquot->dq_flags);
+@@ -351,14 +356,14 @@ int dquot_mark_dquot_dirty(struct dquot *dquot)
+ {
+ int ret = 1;
+
+- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
++ if (!dquot_active(dquot))
+ return 0;
+
+ if (sb_dqopt(dquot->dq_sb)->flags & DQUOT_NOLIST_DIRTY)
+ return test_and_set_bit(DQ_MOD_B, &dquot->dq_flags);
+
+ /* If quota is dirty already, we don't have to acquire dq_list_lock */
+- if (test_bit(DQ_MOD_B, &dquot->dq_flags))
++ if (dquot_dirty(dquot))
+ return 1;
+
+ spin_lock(&dq_list_lock);
+@@ -437,7 +442,7 @@ int dquot_acquire(struct dquot *dquot)
+ smp_mb__before_atomic();
+ set_bit(DQ_READ_B, &dquot->dq_flags);
+ /* Instantiate dquot if needed */
+- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags) && !dquot->dq_off) {
++ if (!dquot_active(dquot) && !dquot->dq_off) {
+ ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot);
+ /* Write the info if needed */
+ if (info_dirty(&dqopt->info[dquot->dq_id.type])) {
+@@ -476,7 +481,7 @@ int dquot_commit(struct dquot *dquot)
+ goto out_lock;
+ /* Inactive dquot can be only if there was error during read/init
+ * => we have better not writing it */
+- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
++ if (dquot_active(dquot))
+ ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot);
+ else
+ ret = -EIO;
+@@ -587,7 +592,7 @@ int dquot_scan_active(struct super_block *sb,
+
+ spin_lock(&dq_list_lock);
+ list_for_each_entry(dquot, &inuse_list, dq_inuse) {
+- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
++ if (!dquot_active(dquot))
+ continue;
+ if (dquot->dq_sb != sb)
+ continue;
+@@ -602,7 +607,7 @@ int dquot_scan_active(struct super_block *sb,
+ * outstanding call and recheck the DQ_ACTIVE_B after that.
+ */
+ wait_on_dquot(dquot);
+- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
++ if (dquot_active(dquot)) {
+ ret = fn(dquot, priv);
+ if (ret < 0)
+ goto out;
+@@ -653,7 +658,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type)
+ dquot = list_first_entry(&dirty, struct dquot,
+ dq_dirty);
+
+- WARN_ON(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags));
++ WARN_ON(!dquot_active(dquot));
+
+ /* Now we have active dquot from which someone is
+ * holding reference so we can safely just increase
+@@ -790,7 +795,7 @@ void dqput(struct dquot *dquot)
+ dquot_write_dquot(dquot);
+ goto we_slept;
+ }
+- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
++ if (dquot_active(dquot)) {
+ spin_unlock(&dq_list_lock);
+ dquot->dq_sb->dq_op->release_dquot(dquot);
+ goto we_slept;
+@@ -891,7 +896,7 @@ struct dquot *dqget(struct super_block *sb, struct kqid qid)
+ * already finished or it will be canceled due to dq_count > 1 test */
+ wait_on_dquot(dquot);
+ /* Read the dquot / allocate space in quota file */
+- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
++ if (!dquot_active(dquot)) {
+ int err;
+
+ err = sb->dq_op->acquire_dquot(dquot);
+--
+2.40.1
+
--- /dev/null
+From a306c49b375583a837d22f04e4828fda544f72a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2019 16:34:08 +0800
+Subject: quota: avoid increasing DQST_LOOKUPS when iterating over dirty/inuse
+ list
+
+From: Chengguang Xu <cgxu519@zoho.com.cn>
+
+[ Upstream commit 05848db2083d4f232e84e385845dcd98d5c511b2 ]
+
+It is meaningless to increase DQST_LOOKUPS number while iterating
+over dirty/inuse list, so just avoid it.
+
+Link: https://lore.kernel.org/r/20190926083408.4269-1-cgxu519@zoho.com.cn
+Signed-off-by: Chengguang Xu <cgxu519@zoho.com.cn>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 01bec330d54b1..50aaa5b0706e8 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -594,7 +594,6 @@ int dquot_scan_active(struct super_block *sb,
+ /* Now we have active dquot so we can just increase use count */
+ atomic_inc(&dquot->dq_count);
+ spin_unlock(&dq_list_lock);
+- dqstats_inc(DQST_LOOKUPS);
+ dqput(old_dquot);
+ old_dquot = dquot;
+ /*
+@@ -649,7 +648,6 @@ int dquot_writeback_dquots(struct super_block *sb, int type)
+ * use count */
+ dqgrab(dquot);
+ spin_unlock(&dq_list_lock);
+- dqstats_inc(DQST_LOOKUPS);
+ err = sb->dq_op->write_dquot(dquot);
+ if (err) {
+ /*
+--
+2.40.1
+
--- /dev/null
+From 3f8999518f0372a38a13f4128e4f5d877d7ec639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 19:08:18 +0800
+Subject: quota: factor out dquot_write_dquot()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 024128477809f8073d870307c8157b8826ebfd08 ]
+
+Refactor out dquot_write_dquot() to reduce duplicate code.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Message-Id: <20230630110822.3881712-2-libaokun1@huawei.com>
+Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 39 ++++++++++++++++-----------------------
+ 1 file changed, 16 insertions(+), 23 deletions(-)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 50aaa5b0706e8..aa9d3c4bf0872 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -618,6 +618,18 @@ int dquot_scan_active(struct super_block *sb,
+ }
+ EXPORT_SYMBOL(dquot_scan_active);
+
++static inline int dquot_write_dquot(struct dquot *dquot)
++{
++ int ret = dquot->dq_sb->dq_op->write_dquot(dquot);
++ if (ret < 0) {
++ quota_error(dquot->dq_sb, "Can't write quota structure "
++ "(error %d). Quota may get out of sync!", ret);
++ /* Clear dirty bit anyway to avoid infinite loop. */
++ clear_dquot_dirty(dquot);
++ }
++ return ret;
++}
++
+ /* Write all dquot structures to quota files */
+ int dquot_writeback_dquots(struct super_block *sb, int type)
+ {
+@@ -648,16 +660,9 @@ int dquot_writeback_dquots(struct super_block *sb, int type)
+ * use count */
+ dqgrab(dquot);
+ spin_unlock(&dq_list_lock);
+- err = sb->dq_op->write_dquot(dquot);
+- if (err) {
+- /*
+- * Clear dirty bit anyway to avoid infinite
+- * loop here.
+- */
+- clear_dquot_dirty(dquot);
+- if (!ret)
+- ret = err;
+- }
++ err = dquot_write_dquot(dquot);
++ if (err && !ret)
++ ret = err;
+ dqput(dquot);
+ spin_lock(&dq_list_lock);
+ }
+@@ -755,8 +760,6 @@ static struct shrinker dqcache_shrinker = {
+ */
+ void dqput(struct dquot *dquot)
+ {
+- int ret;
+-
+ if (!dquot)
+ return;
+ #ifdef CONFIG_QUOTA_DEBUG
+@@ -784,17 +787,7 @@ void dqput(struct dquot *dquot)
+ if (dquot_dirty(dquot)) {
+ spin_unlock(&dq_list_lock);
+ /* Commit dquot before releasing */
+- ret = dquot->dq_sb->dq_op->write_dquot(dquot);
+- if (ret < 0) {
+- quota_error(dquot->dq_sb, "Can't write quota structure"
+- " (error %d). Quota may get out of sync!",
+- ret);
+- /*
+- * We clear dirty bit anyway, so that we avoid
+- * infinite loop here
+- */
+- clear_dquot_dirty(dquot);
+- }
++ dquot_write_dquot(dquot);
+ goto we_slept;
+ }
+ if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
+--
+2.40.1
+
--- /dev/null
+From 3011ffdb75896ef2dec77488c1cfeb9d847e3927 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 19:08:21 +0800
+Subject: quota: fix dqput() to follow the guarantees dquot_srcu should provide
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit dabc8b20756601b9e1cc85a81d47d3f98ed4d13a ]
+
+The dquot_mark_dquot_dirty() using dquot references from the inode
+should be protected by dquot_srcu. quota_off code takes care to call
+synchronize_srcu(&dquot_srcu) to not drop dquot references while they
+are used by other users. But dquot_transfer() breaks this assumption.
+We call dquot_transfer() to drop the last reference of dquot and add
+it to free_dquots, but there may still be other users using the dquot
+at this time, as shown in the function graph below:
+
+ cpu1 cpu2
+_________________|_________________
+wb_do_writeback CHOWN(1)
+ ...
+ ext4_da_update_reserve_space
+ dquot_claim_block
+ ...
+ dquot_mark_dquot_dirty // try to dirty old quota
+ test_bit(DQ_ACTIVE_B, &dquot->dq_flags) // still ACTIVE
+ if (test_bit(DQ_MOD_B, &dquot->dq_flags))
+ // test no dirty, wait dq_list_lock
+ ...
+ dquot_transfer
+ __dquot_transfer
+ dqput_all(transfer_from) // rls old dquot
+ dqput // last dqput
+ dquot_release
+ clear_bit(DQ_ACTIVE_B, &dquot->dq_flags)
+ atomic_dec(&dquot->dq_count)
+ put_dquot_last(dquot)
+ list_add_tail(&dquot->dq_free, &free_dquots)
+ // add the dquot to free_dquots
+ if (!test_and_set_bit(DQ_MOD_B, &dquot->dq_flags))
+ add dqi_dirty_list // add released dquot to dirty_list
+
+This can cause various issues, such as dquot being destroyed by
+dqcache_shrink_scan() after being added to free_dquots, which can trigger
+a UAF in dquot_mark_dquot_dirty(); or after dquot is added to free_dquots
+and then to dirty_list, it is added to free_dquots again after
+dquot_writeback_dquots() is executed, which causes the free_dquots list to
+be corrupted and triggers a UAF when dqcache_shrink_scan() is called for
+freeing dquot twice.
+
+As Honza said, we need to fix dquot_transfer() to follow the guarantees
+dquot_srcu should provide. But calling synchronize_srcu() directly from
+dquot_transfer() is too expensive (and mostly unnecessary). So we add
+dquot whose last reference should be dropped to the new global dquot
+list releasing_dquots, and then queue work item which would call
+synchronize_srcu() and after that perform the final cleanup of all the
+dquots on releasing_dquots.
+
+Fixes: 4580b30ea887 ("quota: Do not dirty bad dquots")
+Suggested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Message-Id: <20230630110822.3881712-5-libaokun1@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 96 +++++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 78 insertions(+), 18 deletions(-)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 273971b4060d6..82af42717ef88 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -223,13 +223,22 @@ static void put_quota_format(struct quota_format_type *fmt)
+
+ /*
+ * Dquot List Management:
+- * The quota code uses four lists for dquot management: the inuse_list,
+- * free_dquots, dqi_dirty_list, and dquot_hash[] array. A single dquot
+- * structure may be on some of those lists, depending on its current state.
++ * The quota code uses five lists for dquot management: the inuse_list,
++ * releasing_dquots, free_dquots, dqi_dirty_list, and dquot_hash[] array.
++ * A single dquot structure may be on some of those lists, depending on
++ * its current state.
+ *
+ * All dquots are placed to the end of inuse_list when first created, and this
+ * list is used for invalidate operation, which must look at every dquot.
+ *
++ * When the last reference of a dquot will be dropped, the dquot will be
++ * added to releasing_dquots. We'd then queue work item which would call
++ * synchronize_srcu() and after that perform the final cleanup of all the
++ * dquots on the list. Both releasing_dquots and free_dquots use the
++ * dq_free list_head in the dquot struct. When a dquot is removed from
++ * releasing_dquots, a reference count is always subtracted, and if
++ * dq_count == 0 at that point, the dquot will be added to the free_dquots.
++ *
+ * Unused dquots (dq_count == 0) are added to the free_dquots list when freed,
+ * and this list is searched whenever we need an available dquot. Dquots are
+ * removed from the list as soon as they are used again, and
+@@ -248,6 +257,7 @@ static void put_quota_format(struct quota_format_type *fmt)
+
+ static LIST_HEAD(inuse_list);
+ static LIST_HEAD(free_dquots);
++static LIST_HEAD(releasing_dquots);
+ static unsigned int dq_hash_bits, dq_hash_mask;
+ static struct hlist_head *dquot_hash;
+
+@@ -258,6 +268,9 @@ static qsize_t inode_get_rsv_space(struct inode *inode);
+ static qsize_t __inode_get_rsv_space(struct inode *inode);
+ static int __dquot_initialize(struct inode *inode, int type);
+
++static void quota_release_workfn(struct work_struct *work);
++static DECLARE_DELAYED_WORK(quota_release_work, quota_release_workfn);
++
+ static inline unsigned int
+ hashfn(const struct super_block *sb, struct kqid qid)
+ {
+@@ -305,12 +318,18 @@ static inline void put_dquot_last(struct dquot *dquot)
+ dqstats_inc(DQST_FREE_DQUOTS);
+ }
+
++static inline void put_releasing_dquots(struct dquot *dquot)
++{
++ list_add_tail(&dquot->dq_free, &releasing_dquots);
++}
++
+ static inline void remove_free_dquot(struct dquot *dquot)
+ {
+ if (list_empty(&dquot->dq_free))
+ return;
+ list_del_init(&dquot->dq_free);
+- dqstats_dec(DQST_FREE_DQUOTS);
++ if (!atomic_read(&dquot->dq_count))
++ dqstats_dec(DQST_FREE_DQUOTS);
+ }
+
+ static inline void put_inuse(struct dquot *dquot)
+@@ -542,6 +561,8 @@ static void invalidate_dquots(struct super_block *sb, int type)
+ struct dquot *dquot, *tmp;
+
+ restart:
++ flush_delayed_work("a_release_work);
++
+ spin_lock(&dq_list_lock);
+ list_for_each_entry_safe(dquot, tmp, &inuse_list, dq_inuse) {
+ if (dquot->dq_sb != sb)
+@@ -550,6 +571,12 @@ static void invalidate_dquots(struct super_block *sb, int type)
+ continue;
+ /* Wait for dquot users */
+ if (atomic_read(&dquot->dq_count)) {
++ /* dquot in releasing_dquots, flush and retry */
++ if (!list_empty(&dquot->dq_free)) {
++ spin_unlock(&dq_list_lock);
++ goto restart;
++ }
++
+ atomic_inc(&dquot->dq_count);
+ spin_unlock(&dq_list_lock);
+ /*
+@@ -760,6 +787,49 @@ static struct shrinker dqcache_shrinker = {
+ .seeks = DEFAULT_SEEKS,
+ };
+
++/*
++ * Safely release dquot and put reference to dquot.
++ */
++static void quota_release_workfn(struct work_struct *work)
++{
++ struct dquot *dquot;
++ struct list_head rls_head;
++
++ spin_lock(&dq_list_lock);
++ /* Exchange the list head to avoid livelock. */
++ list_replace_init(&releasing_dquots, &rls_head);
++ spin_unlock(&dq_list_lock);
++
++restart:
++ synchronize_srcu(&dquot_srcu);
++ spin_lock(&dq_list_lock);
++ while (!list_empty(&rls_head)) {
++ dquot = list_first_entry(&rls_head, struct dquot, dq_free);
++ /* Dquot got used again? */
++ if (atomic_read(&dquot->dq_count) > 1) {
++ remove_free_dquot(dquot);
++ atomic_dec(&dquot->dq_count);
++ continue;
++ }
++ if (dquot_dirty(dquot)) {
++ spin_unlock(&dq_list_lock);
++ /* Commit dquot before releasing */
++ dquot_write_dquot(dquot);
++ goto restart;
++ }
++ if (dquot_active(dquot)) {
++ spin_unlock(&dq_list_lock);
++ dquot->dq_sb->dq_op->release_dquot(dquot);
++ goto restart;
++ }
++ /* Dquot is inactive and clean, now move it to free list */
++ remove_free_dquot(dquot);
++ atomic_dec(&dquot->dq_count);
++ put_dquot_last(dquot);
++ }
++ spin_unlock(&dq_list_lock);
++}
++
+ /*
+ * Put reference to dquot
+ */
+@@ -776,7 +846,7 @@ void dqput(struct dquot *dquot)
+ }
+ #endif
+ dqstats_inc(DQST_DROPS);
+-we_slept:
++
+ spin_lock(&dq_list_lock);
+ if (atomic_read(&dquot->dq_count) > 1) {
+ /* We have more than one user... nothing to do */
+@@ -788,25 +858,15 @@ void dqput(struct dquot *dquot)
+ spin_unlock(&dq_list_lock);
+ return;
+ }
++
+ /* Need to release dquot? */
+- if (dquot_dirty(dquot)) {
+- spin_unlock(&dq_list_lock);
+- /* Commit dquot before releasing */
+- dquot_write_dquot(dquot);
+- goto we_slept;
+- }
+- if (dquot_active(dquot)) {
+- spin_unlock(&dq_list_lock);
+- dquot->dq_sb->dq_op->release_dquot(dquot);
+- goto we_slept;
+- }
+- atomic_dec(&dquot->dq_count);
+ #ifdef CONFIG_QUOTA_DEBUG
+ /* sanity check */
+ BUG_ON(!list_empty(&dquot->dq_free));
+ #endif
+- put_dquot_last(dquot);
++ put_releasing_dquots(dquot);
+ spin_unlock(&dq_list_lock);
++ queue_delayed_work(system_unbound_wq, "a_release_work, 1);
+ }
+ EXPORT_SYMBOL(dqput);
+
+--
+2.40.1
+
--- /dev/null
+From a2cb8e8925dac3fa5c38f1c14e7e39508db351f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 19:08:19 +0800
+Subject: quota: rename dquot_active() to inode_quota_active()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 4b9bdfa16535de8f49bf954aeed0f525ee2fc322 ]
+
+Now we have a helper function dquot_dirty() to determine if dquot has
+DQ_MOD_B bit. dquot_active() can easily be misunderstood as a helper
+function to determine if dquot has DQ_ACTIVE_B bit. So we avoid this by
+renaming it to inode_quota_active() and later on we will add the helper
+function dquot_active() to determine if dquot has DQ_ACTIVE_B bit.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Message-Id: <20230630110822.3881712-3-libaokun1@huawei.com>
+Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index aa9d3c4bf0872..368e344b12951 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -1404,7 +1404,7 @@ static int info_bdq_free(struct dquot *dquot, qsize_t space)
+ return QUOTA_NL_NOWARN;
+ }
+
+-static int dquot_active(const struct inode *inode)
++static int inode_quota_active(const struct inode *inode)
+ {
+ struct super_block *sb = inode->i_sb;
+
+@@ -1427,7 +1427,7 @@ static int __dquot_initialize(struct inode *inode, int type)
+ qsize_t rsv;
+ int ret = 0;
+
+- if (!dquot_active(inode))
++ if (!inode_quota_active(inode))
+ return 0;
+
+ dquots = i_dquot(inode);
+@@ -1535,7 +1535,7 @@ bool dquot_initialize_needed(struct inode *inode)
+ struct dquot **dquots;
+ int i;
+
+- if (!dquot_active(inode))
++ if (!inode_quota_active(inode))
+ return false;
+
+ dquots = i_dquot(inode);
+@@ -1646,7 +1646,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
+ int reserve = flags & DQUOT_SPACE_RESERVE;
+ struct dquot **dquots;
+
+- if (!dquot_active(inode)) {
++ if (!inode_quota_active(inode)) {
+ if (reserve) {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) += number;
+@@ -1718,7 +1718,7 @@ int dquot_alloc_inode(struct inode *inode)
+ struct dquot_warn warn[MAXQUOTAS];
+ struct dquot * const *dquots;
+
+- if (!dquot_active(inode))
++ if (!inode_quota_active(inode))
+ return 0;
+ for (cnt = 0; cnt < MAXQUOTAS; cnt++)
+ warn[cnt].w_type = QUOTA_NL_NOWARN;
+@@ -1761,7 +1761,7 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
+ struct dquot **dquots;
+ int cnt, index;
+
+- if (!dquot_active(inode)) {
++ if (!inode_quota_active(inode)) {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) -= number;
+ __inode_add_bytes(inode, number);
+@@ -1803,7 +1803,7 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)
+ struct dquot **dquots;
+ int cnt, index;
+
+- if (!dquot_active(inode)) {
++ if (!inode_quota_active(inode)) {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) += number;
+ __inode_sub_bytes(inode, number);
+@@ -1847,7 +1847,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags)
+ struct dquot **dquots;
+ int reserve = flags & DQUOT_SPACE_RESERVE, index;
+
+- if (!dquot_active(inode)) {
++ if (!inode_quota_active(inode)) {
+ if (reserve) {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) -= number;
+@@ -1902,7 +1902,7 @@ void dquot_free_inode(struct inode *inode)
+ struct dquot * const *dquots;
+ int index;
+
+- if (!dquot_active(inode))
++ if (!inode_quota_active(inode))
+ return;
+
+ dquots = i_dquot(inode);
+@@ -2073,7 +2073,7 @@ int dquot_transfer(struct inode *inode, struct iattr *iattr)
+ struct super_block *sb = inode->i_sb;
+ int ret;
+
+- if (!dquot_active(inode))
++ if (!inode_quota_active(inode))
+ return 0;
+
+ if (iattr->ia_valid & ATTR_UID && !uid_eq(iattr->ia_uid, inode->i_uid)){
+--
+2.40.1
+
--- /dev/null
+From e4eb9e608e105b5c21c167998fd74887029fec59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 17:55:33 +0300
+Subject: regmap: rbtree: Use alloc_flags for memory allocations
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 0c8b0bf42c8cef56f7cd9cd876fbb7ece9217064 ]
+
+The kunit tests discovered a sleeping in atomic bug. The allocations
+in the regcache-rbtree code should use the map->alloc_flags instead of
+GFP_KERNEL.
+
+[ 5.005510] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:306
+[ 5.005960] in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 117, name: kunit_try_catch
+[ 5.006219] preempt_count: 1, expected: 0
+[ 5.006414] 1 lock held by kunit_try_catch/117:
+[ 5.006590] #0: 833b9010 (regmap_kunit:86:(config)->lock){....}-{2:2}, at: regmap_lock_spinlock+0x14/0x1c
+[ 5.007493] irq event stamp: 162
+[ 5.007627] hardirqs last enabled at (161): [<80786738>] crng_make_state+0x1a0/0x294
+[ 5.007871] hardirqs last disabled at (162): [<80c531ec>] _raw_spin_lock_irqsave+0x7c/0x80
+[ 5.008119] softirqs last enabled at (0): [<801110ac>] copy_process+0x810/0x2138
+[ 5.008356] softirqs last disabled at (0): [<00000000>] 0x0
+[ 5.008688] CPU: 0 PID: 117 Comm: kunit_try_catch Tainted: G N 6.4.4-rc3-g0e8d2fdfb188 #1
+[ 5.009011] Hardware name: Generic DT based system
+[ 5.009277] unwind_backtrace from show_stack+0x18/0x1c
+[ 5.009497] show_stack from dump_stack_lvl+0x38/0x5c
+[ 5.009676] dump_stack_lvl from __might_resched+0x188/0x2d0
+[ 5.009860] __might_resched from __kmem_cache_alloc_node+0x1dc/0x25c
+[ 5.010061] __kmem_cache_alloc_node from kmalloc_trace+0x30/0xc8
+[ 5.010254] kmalloc_trace from regcache_rbtree_write+0x26c/0x468
+[ 5.010446] regcache_rbtree_write from _regmap_write+0x88/0x140
+[ 5.010634] _regmap_write from regmap_write+0x44/0x68
+[ 5.010803] regmap_write from basic_read_write+0x8c/0x270
+[ 5.010980] basic_read_write from kunit_try_run_case+0x48/0xa0
+
+Fixes: 28644c809f44 ("regmap: Add the rbtree cache support")
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Closes: https://lore.kernel.org/all/ee59d128-413c-48ad-a3aa-d9d350c80042@roeck-us.net/
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/58f12a07-5f4b-4a8f-ab84-0a42d1908cb9@moroto.mountain
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regcache-rbtree.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index e9b7ce8c272c6..7353c55270874 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -291,7 +291,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+
+ blk = krealloc(rbnode->block,
+ blklen * map->cache_word_size,
+- GFP_KERNEL);
++ map->alloc_flags);
+ if (!blk)
+ return -ENOMEM;
+
+@@ -300,7 +300,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+ if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
+ present = krealloc(rbnode->cache_present,
+ BITS_TO_LONGS(blklen) * sizeof(*present),
+- GFP_KERNEL);
++ map->alloc_flags);
+ if (!present)
+ return -ENOMEM;
+
+@@ -334,7 +334,7 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg)
+ const struct regmap_range *range;
+ int i;
+
+- rbnode = kzalloc(sizeof(*rbnode), GFP_KERNEL);
++ rbnode = kzalloc(sizeof(*rbnode), map->alloc_flags);
+ if (!rbnode)
+ return NULL;
+
+@@ -360,13 +360,13 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg)
+ }
+
+ rbnode->block = kmalloc_array(rbnode->blklen, map->cache_word_size,
+- GFP_KERNEL);
++ map->alloc_flags);
+ if (!rbnode->block)
+ goto err_free;
+
+ rbnode->cache_present = kcalloc(BITS_TO_LONGS(rbnode->blklen),
+ sizeof(*rbnode->cache_present),
+- GFP_KERNEL);
++ map->alloc_flags);
+ if (!rbnode->cache_present)
+ goto err_free_block;
+
+--
+2.40.1
+
--- /dev/null
+From c1717f342b47a3c51c4d34a88beb78a69b52d064 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 12:16:06 +0100
+Subject: reiserfs: Check the return value from __getblk()
+
+From: Matthew Wilcox <willy@infradead.org>
+
+[ Upstream commit ba38980add7ffc9e674ada5b4ded4e7d14e76581 ]
+
+__getblk() can return a NULL pointer if we run out of memory or if we
+try to access beyond the end of the device; check it and handle it
+appropriately.
+
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Link: https://lore.kernel.org/lkml/CAFcO6XOacq3hscbXevPQP7sXRoYFz34ZdKPYjmd6k5sZuhGFDw@mail.gmail.com/
+Tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") # probably introduced in 2002
+Acked-by: Edward Shishkin <edward.shishkin@gmail.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/reiserfs/journal.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
+index 78be6dbcd7627..3425a04bc8a01 100644
+--- a/fs/reiserfs/journal.c
++++ b/fs/reiserfs/journal.c
+@@ -2336,7 +2336,7 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
+ int i, j;
+
+ bh = __getblk(dev, block, bufsize);
+- if (buffer_uptodate(bh))
++ if (!bh || buffer_uptodate(bh))
+ return (bh);
+
+ if (block + BUFNR > max_block) {
+@@ -2346,6 +2346,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
+ j = 1;
+ for (i = 1; i < blocks; i++) {
+ bh = __getblk(dev, block + i, bufsize);
++ if (!bh)
++ break;
+ if (buffer_uptodate(bh)) {
+ brelse(bh);
+ break;
+--
+2.40.1
+
--- /dev/null
+From 6529e05e9e9b553c130527ccfc0ec9555a6a1ec1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Aug 2023 10:57:14 +0300
+Subject: Revert "IB/isert: Fix incorrect release of isert connection"
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit dfe261107c080709459c32695847eec96238852b ]
+
+Commit: 699826f4e30a ("IB/isert: Fix incorrect release of isert connection") is
+causing problems on OPA when DEVICE_REMOVAL is happening.
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 52 PID: 2117247 at drivers/infiniband/core/cq.c:359
+ib_cq_pool_cleanup+0xac/0xb0 [ib_core]
+ Modules linked in: nfsd nfs_acl target_core_user uio tcm_fc libfc
+scsi_transport_fc tcm_loop target_core_pscsi target_core_iblock target_core_file
+rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs
+rfkill rpcrdma rdma_ucm ib_srpt sunrpc ib_isert iscsi_target_mod target_core_mod
+opa_vnic ib_iser libiscsi ib_umad scsi_transport_iscsi rdma_cm ib_ipoib iw_cm
+ib_cm hfi1(-) rdmavt ib_uverbs intel_rapl_msr intel_rapl_common sb_edac ib_core
+x86_pkg_temp_thermal intel_powerclamp coretemp i2c_i801 mxm_wmi rapl iTCO_wdt
+ipmi_si iTCO_vendor_support mei_me ipmi_devintf mei intel_cstate ioatdma
+intel_uncore i2c_smbus joydev pcspkr lpc_ich ipmi_msghandler acpi_power_meter
+acpi_pad xfs libcrc32c sr_mod sd_mod cdrom t10_pi sg crct10dif_pclmul
+crc32_pclmul crc32c_intel drm_kms_helper drm_shmem_helper ahci libahci
+ghash_clmulni_intel igb drm libata dca i2c_algo_bit wmi fuse
+ CPU: 52 PID: 2117247 Comm: modprobe Not tainted 6.5.0-rc1+ #1
+ Hardware name: Intel Corporation S2600CWR/S2600CW, BIOS
+SE5C610.86B.01.01.0014.121820151719 12/18/2015
+ RIP: 0010:ib_cq_pool_cleanup+0xac/0xb0 [ib_core]
+ Code: ff 48 8b 43 40 48 8d 7b 40 48 83 e8 40 4c 39 e7 75 b3 49 83
+c4 10 4d 39 fc 75 94 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc <0f> 0b eb a1
+90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f
+ RSP: 0018:ffffc10bea13fc80 EFLAGS: 00010206
+ RAX: 000000000000010c RBX: ffff9bf5c7e66c00 RCX: 000000008020001d
+ RDX: 000000008020001e RSI: fffff175221f9900 RDI: ffff9bf5c7e67640
+ RBP: ffff9bf5c7e67600 R08: ffff9bf5c7e64400 R09: 000000008020001d
+ R10: 0000000040000000 R11: 0000000000000000 R12: ffff9bee4b1e8a18
+ R13: dead000000000122 R14: dead000000000100 R15: ffff9bee4b1e8a38
+ FS: 00007ff1e6d38740(0000) GS:ffff9bfd9fb00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00005652044ecc68 CR3: 0000000889b5c005 CR4: 00000000001706e0
+ Call Trace:
+ <TASK>
+ ? __warn+0x80/0x130
+ ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core]
+ ? report_bug+0x195/0x1a0
+ ? handle_bug+0x3c/0x70
+ ? exc_invalid_op+0x14/0x70
+ ? asm_exc_invalid_op+0x16/0x20
+ ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core]
+ disable_device+0x9d/0x160 [ib_core]
+ __ib_unregister_device+0x42/0xb0 [ib_core]
+ ib_unregister_device+0x22/0x30 [ib_core]
+ rvt_unregister_device+0x20/0x90 [rdmavt]
+ hfi1_unregister_ib_device+0x16/0xf0 [hfi1]
+ remove_one+0x55/0x1a0 [hfi1]
+ pci_device_remove+0x36/0xa0
+ device_release_driver_internal+0x193/0x200
+ driver_detach+0x44/0x90
+ bus_remove_driver+0x69/0xf0
+ pci_unregister_driver+0x2a/0xb0
+ hfi1_mod_cleanup+0xc/0x3c [hfi1]
+ __do_sys_delete_module.constprop.0+0x17a/0x2f0
+ ? exit_to_user_mode_prepare+0xc4/0xd0
+ ? syscall_trace_enter.constprop.0+0x126/0x1a0
+ do_syscall_64+0x5c/0x90
+ ? syscall_exit_to_user_mode+0x12/0x30
+ ? do_syscall_64+0x69/0x90
+ ? syscall_exit_work+0x103/0x130
+ ? syscall_exit_to_user_mode+0x12/0x30
+ ? do_syscall_64+0x69/0x90
+ ? exc_page_fault+0x65/0x150
+ entry_SYSCALL_64_after_hwframe+0x6e/0xd8
+ RIP: 0033:0x7ff1e643f5ab
+ Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3
+66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0
+ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48
+ RSP: 002b:00007ffec9103cc8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
+ RAX: ffffffffffffffda RBX: 00005615267fdc50 RCX: 00007ff1e643f5ab
+ RDX: 0000000000000000 RSI: 0000000000000800 RDI: 00005615267fdcb8
+ RBP: 00005615267fdc50 R08: 0000000000000000 R09: 0000000000000000
+ R10: 00007ff1e659eac0 R11: 0000000000000206 R12: 00005615267fdcb8
+ R13: 0000000000000000 R14: 00005615267fdcb8 R15: 00007ffec9105ff8
+ </TASK>
+ ---[ end trace 0000000000000000 ]---
+
+And...
+
+ restrack: ------------[ cut here ]------------
+ infiniband hfi1_0: BUG: RESTRACK detected leak of resources
+ restrack: Kernel PD object allocated by ib_isert is not freed
+ restrack: Kernel CQ object allocated by ib_core is not freed
+ restrack: Kernel QP object allocated by rdma_cm is not freed
+ restrack: ------------[ cut here ]------------
+
+Fixes: 699826f4e30a ("IB/isert: Fix incorrect release of isert connection")
+Reported-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Closes: https://lore.kernel.org/all/921cd1d9-2879-f455-1f50-0053fe6a6655@cornelisnetworks.com
+Link: https://lore.kernel.org/r/a27982d3235005c58f6d321f3fad5eb6e1beaf9e.1692604607.git.leonro@nvidia.com
+Tested-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index de6fc8887c4a4..60594dad55455 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -2654,6 +2654,8 @@ static void isert_wait_conn(struct iscsi_conn *conn)
+ isert_put_unsol_pending_cmds(conn);
+ isert_wait4cmds(conn);
+ isert_wait4logout(isert_conn);
++
++ queue_work(isert_release_wq, &isert_conn->release_work);
+ }
+
+ static void isert_free_conn(struct iscsi_conn *conn)
+--
+2.40.1
+
--- /dev/null
+From 65615a4e86e36816ae776505c4282f6bfbca80af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jun 2023 11:06:31 +0800
+Subject: rpmsg: glink: Add check for kstrdup
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit b5c9ee8296a3760760c7b5d2e305f91412adc795 ]
+
+Add check for the return value of kstrdup() and return the error
+if it fails in order to avoid NULL pointer dereference.
+
+Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20230619030631.12361-1-jiasheng@iscas.ac.cn
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rpmsg/qcom_glink_native.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index 940f099c2092f..02e39778d3c6b 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -222,6 +222,10 @@ static struct glink_channel *qcom_glink_alloc_channel(struct qcom_glink *glink,
+
+ channel->glink = glink;
+ channel->name = kstrdup(name, GFP_KERNEL);
++ if (!channel->name) {
++ kfree(channel);
++ return ERR_PTR(-ENOMEM);
++ }
+
+ init_completion(&channel->open_req);
+ init_completion(&channel->open_ack);
+--
+2.40.1
+
--- /dev/null
+From 54678ca8f5a1fbe45ed105c5f1204115ad8de521 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jul 2023 15:59:38 +0800
+Subject: scsi: be2iscsi: Add length check when parsing nlattrs
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit ee0268f230f66cb472df3424f380ea668da2749a ]
+
+beiscsi_iface_set_param() parses nlattr with nla_for_each_attr and assumes
+every attributes can be viewed as struct iscsi_iface_param_info.
+
+This is not true because there is no any nla_policy to validate the
+attributes passed from the upper function iscsi_set_iface_params().
+
+Add the nla_len check before accessing the nlattr data and return EINVAL if
+the length check fails.
+
+Fixes: 0e43895ec1f4 ("[SCSI] be2iscsi: adding functionality to change network settings using iscsiadm")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Link: https://lore.kernel.org/r/20230723075938.3713864-1-linma@zju.edu.cn
+Reviewed-by: Chris Leech <cleech@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/be2iscsi/be_iscsi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c
+index c8f0a2144b443..818a690771e05 100644
+--- a/drivers/scsi/be2iscsi/be_iscsi.c
++++ b/drivers/scsi/be2iscsi/be_iscsi.c
+@@ -445,6 +445,10 @@ int beiscsi_iface_set_param(struct Scsi_Host *shost,
+ }
+
+ nla_for_each_attr(attrib, data, dt_len, rm_len) {
++ /* ignore nla_type as it is never used */
++ if (nla_len(attrib) < sizeof(*iface_param))
++ return -EINVAL;
++
+ iface_param = nla_data(attrib);
+
+ if (iface_param->param_type != ISCSI_NET_PARAM)
+--
+2.40.1
+
--- /dev/null
+From e78aac44adef6b8dcc42f757c1d961169d21329d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Aug 2023 10:03:25 -0400
+Subject: scsi: core: Use 32-bit hostnum in scsi_host_lookup()
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 62ec2092095b678ff89ce4ba51c2938cd1e8e630 ]
+
+Change scsi_host_lookup() hostnum argument type from unsigned short to
+unsigned int to match the type used everywhere else.
+
+Fixes: 6d49f63b415c ("[SCSI] Make host_no an unsigned int")
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://lore.kernel.org/r/a02497e7-c12b-ef15-47fc-3f0a0b00ffce@cybernetics.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hosts.c | 4 ++--
+ include/scsi/scsi_host.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
+index 2ffc2e15d822b..c5a0ef6f67c0f 100644
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -532,7 +532,7 @@ EXPORT_SYMBOL(scsi_host_alloc);
+ static int __scsi_host_match(struct device *dev, const void *data)
+ {
+ struct Scsi_Host *p;
+- const unsigned short *hostnum = data;
++ const unsigned int *hostnum = data;
+
+ p = class_to_shost(dev);
+ return p->host_no == *hostnum;
+@@ -549,7 +549,7 @@ static int __scsi_host_match(struct device *dev, const void *data)
+ * that scsi_host_get() took. The put_device() below dropped
+ * the reference from class_find_device().
+ **/
+-struct Scsi_Host *scsi_host_lookup(unsigned short hostnum)
++struct Scsi_Host *scsi_host_lookup(unsigned int hostnum)
+ {
+ struct device *cdev;
+ struct Scsi_Host *shost = NULL;
+diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
+index 5ea06d310a256..c4e38448507de 100644
+--- a/include/scsi/scsi_host.h
++++ b/include/scsi/scsi_host.h
+@@ -760,7 +760,7 @@ extern void scsi_remove_host(struct Scsi_Host *);
+ extern struct Scsi_Host *scsi_host_get(struct Scsi_Host *);
+ extern int scsi_host_busy(struct Scsi_Host *shost);
+ extern void scsi_host_put(struct Scsi_Host *t);
+-extern struct Scsi_Host *scsi_host_lookup(unsigned short);
++extern struct Scsi_Host *scsi_host_lookup(unsigned int hostnum);
+ extern const char *scsi_host_state_name(enum scsi_host_state);
+ extern void scsi_cmd_get_serial(struct Scsi_Host *, struct scsi_cmnd *);
+
+--
+2.40.1
+
--- /dev/null
+From 3cf6e056a279e745ed5eeb7331e3596dfcf8e5e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 07:47:08 +0000
+Subject: scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
+
+From: Chengfeng Ye <dg573847474@gmail.com>
+
+[ Upstream commit 1a1975551943f681772720f639ff42fbaa746212 ]
+
+There is a long call chain that &fip->ctlr_lock is acquired by isr
+fnic_isr_msix_wq_copy() under hard IRQ context. Thus other process context
+code acquiring the lock should disable IRQ, otherwise deadlock could happen
+if the IRQ preempts the execution while the lock is held in process context
+on the same CPU.
+
+[ISR]
+fnic_isr_msix_wq_copy()
+ -> fnic_wq_copy_cmpl_handler()
+ -> fnic_fcpio_cmpl_handler()
+ -> fnic_fcpio_flogi_reg_cmpl_handler()
+ -> fnic_flush_tx()
+ -> fnic_send_frame()
+ -> fcoe_ctlr_els_send()
+ -> spin_lock_bh(&fip->ctlr_lock)
+
+[Process Context]
+1. fcoe_ctlr_timer_work()
+ -> fcoe_ctlr_flogi_send()
+ -> spin_lock_bh(&fip->ctlr_lock)
+
+2. fcoe_ctlr_recv_work()
+ -> fcoe_ctlr_recv_handler()
+ -> fcoe_ctlr_recv_els()
+ -> fcoe_ctlr_announce()
+ -> spin_lock_bh(&fip->ctlr_lock)
+
+3. fcoe_ctlr_recv_work()
+ -> fcoe_ctlr_recv_handler()
+ -> fcoe_ctlr_recv_els()
+ -> fcoe_ctlr_flogi_retry()
+ -> spin_lock_bh(&fip->ctlr_lock)
+
+4. -> fcoe_xmit()
+ -> fcoe_ctlr_els_send()
+ -> spin_lock_bh(&fip->ctlr_lock)
+
+spin_lock_bh() is not enough since fnic_isr_msix_wq_copy() is a
+hardirq.
+
+These flaws were found by an experimental static analysis tool I am
+developing for irq-related deadlock.
+
+The patch fix the potential deadlocks by spin_lock_irqsave() to disable
+hard irq.
+
+Fixes: 794d98e77f59 ("[SCSI] libfcoe: retry rejected FLOGI to another FCF if possible")
+Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
+Link: https://lore.kernel.org/r/20230817074708.7509-1-dg573847474@gmail.com
+Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fcoe/fcoe_ctlr.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
+index 1e087a206f48e..c49986eba47b6 100644
+--- a/drivers/scsi/fcoe/fcoe_ctlr.c
++++ b/drivers/scsi/fcoe/fcoe_ctlr.c
+@@ -330,16 +330,17 @@ static void fcoe_ctlr_announce(struct fcoe_ctlr *fip)
+ {
+ struct fcoe_fcf *sel;
+ struct fcoe_fcf *fcf;
++ unsigned long flags;
+
+ mutex_lock(&fip->ctlr_mutex);
+- spin_lock_bh(&fip->ctlr_lock);
++ spin_lock_irqsave(&fip->ctlr_lock, flags);
+
+ kfree_skb(fip->flogi_req);
+ fip->flogi_req = NULL;
+ list_for_each_entry(fcf, &fip->fcfs, list)
+ fcf->flogi_sent = 0;
+
+- spin_unlock_bh(&fip->ctlr_lock);
++ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+ sel = fip->sel_fcf;
+
+ if (sel && ether_addr_equal(sel->fcf_mac, fip->dest_addr))
+@@ -709,6 +710,7 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
+ {
+ struct fc_frame *fp;
+ struct fc_frame_header *fh;
++ unsigned long flags;
+ u16 old_xid;
+ u8 op;
+ u8 mac[ETH_ALEN];
+@@ -742,11 +744,11 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
+ op = FIP_DT_FLOGI;
+ if (fip->mode == FIP_MODE_VN2VN)
+ break;
+- spin_lock_bh(&fip->ctlr_lock);
++ spin_lock_irqsave(&fip->ctlr_lock, flags);
+ kfree_skb(fip->flogi_req);
+ fip->flogi_req = skb;
+ fip->flogi_req_send = 1;
+- spin_unlock_bh(&fip->ctlr_lock);
++ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+ schedule_work(&fip->timer_work);
+ return -EINPROGRESS;
+ case ELS_FDISC:
+@@ -1723,10 +1725,11 @@ static int fcoe_ctlr_flogi_send_locked(struct fcoe_ctlr *fip)
+ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
+ {
+ struct fcoe_fcf *fcf;
++ unsigned long flags;
+ int error;
+
+ mutex_lock(&fip->ctlr_mutex);
+- spin_lock_bh(&fip->ctlr_lock);
++ spin_lock_irqsave(&fip->ctlr_lock, flags);
+ LIBFCOE_FIP_DBG(fip, "re-sending FLOGI - reselect\n");
+ fcf = fcoe_ctlr_select(fip);
+ if (!fcf || fcf->flogi_sent) {
+@@ -1737,7 +1740,7 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
+ fcoe_ctlr_solicit(fip, NULL);
+ error = fcoe_ctlr_flogi_send_locked(fip);
+ }
+- spin_unlock_bh(&fip->ctlr_lock);
++ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+ mutex_unlock(&fip->ctlr_mutex);
+ return error;
+ }
+@@ -1754,8 +1757,9 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
+ static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
+ {
+ struct fcoe_fcf *fcf;
++ unsigned long flags;
+
+- spin_lock_bh(&fip->ctlr_lock);
++ spin_lock_irqsave(&fip->ctlr_lock, flags);
+ fcf = fip->sel_fcf;
+ if (!fcf || !fip->flogi_req_send)
+ goto unlock;
+@@ -1782,7 +1786,7 @@ static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
+ } else /* XXX */
+ LIBFCOE_FIP_DBG(fip, "No FCF selected - defer send\n");
+ unlock:
+- spin_unlock_bh(&fip->ctlr_lock);
++ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+ }
+
+ /**
+--
+2.40.1
+
--- /dev/null
+From 8c30247ffa8e27a3c8d08fcf12822288f82102ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jul 2023 15:58:20 +0800
+Subject: scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit ce51c817008450ef4188471db31639d42d37a5e1 ]
+
+The functions iscsi_if_set_param() and iscsi_if_set_host_param() convert an
+nlattr payload to type char* and then call C string handling functions like
+sscanf and kstrdup:
+
+ char *data = (char*)ev + sizeof(*ev);
+ ...
+ sscanf(data, "%d", &value);
+
+However, since the nlattr is provided by the user-space program and the
+nlmsg skb is allocated with GFP_KERNEL instead of GFP_ZERO flag (see
+netlink_alloc_large_skb() in netlink_sendmsg()), dirty data on the heap can
+lead to an OOB access for those string handling functions.
+
+By investigating how the bug is introduced, we find it is really
+interesting as the old version parsing code starting from commit
+fd7255f51a13 ("[SCSI] iscsi: add sysfs attrs for uspace sync up") treated
+the nlattr as integer bytes instead of string and had length check in
+iscsi_copy_param():
+
+ if (ev->u.set_param.len != sizeof(uint32_t))
+ BUG();
+
+But, since the commit a54a52caad4b ("[SCSI] iscsi: fixup set/get param
+functions"), the code treated the nlattr as C string while forgetting to
+add any strlen checks(), opening the possibility of an OOB access.
+
+Fix the potential OOB by adding the strlen() check before accessing the
+buf. If the data passes this check, all low-level set_param handlers can
+safely treat this buf as legal C string.
+
+Fixes: fd7255f51a13 ("[SCSI] iscsi: add sysfs attrs for uspace sync up")
+Fixes: 1d9bf13a9cf9 ("[SCSI] iscsi class: add iscsi host set param event")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Link: https://lore.kernel.org/r/20230723075820.3713119-1-linma@zju.edu.cn
+Reviewed-by: Chris Leech <cleech@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_transport_iscsi.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 79581771e6f61..b13d1be1b0f10 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2765,6 +2765,10 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+ if (!conn || !session)
+ return -EINVAL;
+
++ /* data will be regarded as NULL-ended string, do length check */
++ if (strlen(data) > ev->u.set_param.len)
++ return -EINVAL;
++
+ switch (ev->u.set_param.param) {
+ case ISCSI_PARAM_SESS_RECOVERY_TMO:
+ sscanf(data, "%d", &value);
+@@ -2917,6 +2921,10 @@ iscsi_set_host_param(struct iscsi_transport *transport,
+ return -ENODEV;
+ }
+
++ /* see similar check in iscsi_if_set_param() */
++ if (strlen(data) > ev->u.set_host_param.len)
++ return -EINVAL;
++
+ err = transport->set_host_param(shost, ev->u.set_host_param.param,
+ data, ev->u.set_host_param.len);
+ scsi_host_put(shost);
+--
+2.40.1
+
--- /dev/null
+From ff108093bbbd1b683c3997c7821c049336bbce5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jul 2023 10:40:34 +0200
+Subject: scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read()
+ directly
+
+From: Oleksandr Natalenko <oleksandr@redhat.com>
+
+[ Upstream commit 25dbc20deab5165f847b4eb42f376f725a986ee8 ]
+
+The qedf_dbg_fp_int_cmd_read() function invokes sprintf() directly on a
+__user pointer, which may crash the kernel.
+
+Avoid doing that by vmalloc()'ating a buffer for scnprintf() and then
+calling simple_read_from_buffer() which does a proper copy_to_user() call.
+
+Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
+Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/
+Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/
+Cc: Saurav Kashyap <skashyap@marvell.com>
+Cc: Rob Evers <revers@redhat.com>
+Cc: Johannes Thumshirn <Johannes.Thumshirn@wdc.com>
+Cc: David Laight <David.Laight@ACULAB.COM>
+Cc: Jozef Bacik <jobacik@redhat.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: GR-QLogic-Storage-Upstream@marvell.com
+Cc: linux-scsi@vger.kernel.org
+Reviewed-by: Laurence Oberman <loberman@redhat.com>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Tested-by: Laurence Oberman <loberman@redhat.com>
+Acked-by: Saurav Kashyap <skashyap@marvell.com>
+Signed-off-by: Oleksandr Natalenko <oleksandr@redhat.com>
+Link: https://lore.kernel.org/r/20230731084034.37021-4-oleksandr@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedf/qedf_dbg.h | 2 ++
+ drivers/scsi/qedf/qedf_debugfs.c | 21 +++++++++++++++------
+ 2 files changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/qedf/qedf_dbg.h b/drivers/scsi/qedf/qedf_dbg.h
+index dd0109653aa32..9c7f7b444daa7 100644
+--- a/drivers/scsi/qedf/qedf_dbg.h
++++ b/drivers/scsi/qedf/qedf_dbg.h
+@@ -63,6 +63,8 @@ extern uint qedf_debug;
+ #define QEDF_LOG_NOTICE 0x40000000 /* Notice logs */
+ #define QEDF_LOG_WARN 0x80000000 /* Warning logs */
+
++#define QEDF_DEBUGFS_LOG_LEN (2 * PAGE_SIZE)
++
+ /* Debug context structure */
+ struct qedf_dbg_ctx {
+ unsigned int host_no;
+diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c
+index 917b047f66f10..84f1ddcfbb218 100644
+--- a/drivers/scsi/qedf/qedf_debugfs.c
++++ b/drivers/scsi/qedf/qedf_debugfs.c
+@@ -11,6 +11,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/debugfs.h>
+ #include <linux/module.h>
++#include <linux/vmalloc.h>
+
+ #include "qedf.h"
+ #include "qedf_dbg.h"
+@@ -117,7 +118,9 @@ static ssize_t
+ qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,
+ loff_t *ppos)
+ {
++ ssize_t ret;
+ size_t cnt = 0;
++ char *cbuf;
+ int id;
+ struct qedf_fastpath *fp = NULL;
+ struct qedf_dbg_ctx *qedf_dbg =
+@@ -127,19 +130,25 @@ qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,
+
+ QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n");
+
+- cnt = sprintf(buffer, "\nFastpath I/O completions\n\n");
++ cbuf = vmalloc(QEDF_DEBUGFS_LOG_LEN);
++ if (!cbuf)
++ return 0;
++
++ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt, "\nFastpath I/O completions\n\n");
+
+ for (id = 0; id < qedf->num_queues; id++) {
+ fp = &(qedf->fp_array[id]);
+ if (fp->sb_id == QEDF_SB_ID_NULL)
+ continue;
+- cnt += sprintf((buffer + cnt), "#%d: %lu\n", id,
+- fp->completions);
++ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt,
++ "#%d: %lu\n", id, fp->completions);
+ }
+
+- cnt = min_t(int, count, cnt - *ppos);
+- *ppos += cnt;
+- return cnt;
++ ret = simple_read_from_buffer(buffer, count, ppos, cbuf, cnt);
++
++ vfree(cbuf);
++
++ return ret;
+ }
+
+ static ssize_t
+--
+2.40.1
+
--- /dev/null
+From f18d33945e79ec69ea2439f8f6fee04f7e553da2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jul 2023 10:40:32 +0200
+Subject: scsi: qedf: Do not touch __user pointer in
+ qedf_dbg_stop_io_on_error_cmd_read() directly
+
+From: Oleksandr Natalenko <oleksandr@redhat.com>
+
+[ Upstream commit 7d3d20dee4f648ec44e9717d5f647d594d184433 ]
+
+The qedf_dbg_stop_io_on_error_cmd_read() function invokes sprintf()
+directly on a __user pointer, which may crash the kernel.
+
+Avoid doing that by using a small on-stack buffer for scnprintf() and then
+calling simple_read_from_buffer() which does a proper copy_to_user() call.
+
+Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
+Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/
+Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/
+Cc: Saurav Kashyap <skashyap@marvell.com>
+Cc: Rob Evers <revers@redhat.com>
+Cc: Johannes Thumshirn <Johannes.Thumshirn@wdc.com>
+Cc: David Laight <David.Laight@ACULAB.COM>
+Cc: Jozef Bacik <jobacik@redhat.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: GR-QLogic-Storage-Upstream@marvell.com
+Cc: linux-scsi@vger.kernel.org
+Reviewed-by: Laurence Oberman <loberman@redhat.com>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Tested-by: Laurence Oberman <loberman@redhat.com>
+Acked-by: Saurav Kashyap <skashyap@marvell.com>
+Signed-off-by: Oleksandr Natalenko <oleksandr@redhat.com>
+Link: https://lore.kernel.org/r/20230731084034.37021-2-oleksandr@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedf/qedf_debugfs.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c
+index c29c162a494ff..917b047f66f10 100644
+--- a/drivers/scsi/qedf/qedf_debugfs.c
++++ b/drivers/scsi/qedf/qedf_debugfs.c
+@@ -204,18 +204,17 @@ qedf_dbg_stop_io_on_error_cmd_read(struct file *filp, char __user *buffer,
+ size_t count, loff_t *ppos)
+ {
+ int cnt;
++ char cbuf[7];
+ struct qedf_dbg_ctx *qedf_dbg =
+ (struct qedf_dbg_ctx *)filp->private_data;
+ struct qedf_ctx *qedf = container_of(qedf_dbg,
+ struct qedf_ctx, dbg_ctx);
+
+ QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n");
+- cnt = sprintf(buffer, "%s\n",
++ cnt = scnprintf(cbuf, sizeof(cbuf), "%s\n",
+ qedf->stop_io_on_error ? "true" : "false");
+
+- cnt = min_t(int, count, cnt - *ppos);
+- *ppos += cnt;
+- return cnt;
++ return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt);
+ }
+
+ static ssize_t
+--
+2.40.1
+
--- /dev/null
+From 847edcec3ff73b4b5a0d8ee90177686b306f346f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jul 2023 16:00:53 +0800
+Subject: scsi: qla4xxx: Add length check when parsing nlattrs
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 47cd3770e31df942e2bb925a9a855c79ed0662eb ]
+
+There are three places that qla4xxx parses nlattrs:
+
+ - qla4xxx_set_chap_entry()
+
+ - qla4xxx_iface_set_param()
+
+ - qla4xxx_sysfs_ddb_set_param()
+
+and each of them directly converts the nlattr to specific pointer of
+structure without length checking. This could be dangerous as those
+attributes are not validated and a malformed nlattr (e.g., length 0) could
+result in an OOB read that leaks heap dirty data.
+
+Add the nla_len check before accessing the nlattr data and return EINVAL if
+the length check fails.
+
+Fixes: 26ffd7b45fe9 ("[SCSI] qla4xxx: Add support to set CHAP entries")
+Fixes: 1e9e2be3ee03 ("[SCSI] qla4xxx: Add flash node mgmt support")
+Fixes: 00c31889f751 ("[SCSI] qla4xxx: fix data alignment and use nl helpers")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Link: https://lore.kernel.org/r/20230723080053.3714534-1-linma@zju.edu.cn
+Reviewed-by: Chris Leech <cleech@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla4xxx/ql4_os.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index 4ba9f46fcf748..21cc9e2797a28 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -940,6 +940,11 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host *shost, void *data, int len)
+ memset(&chap_rec, 0, sizeof(chap_rec));
+
+ nla_for_each_attr(attr, data, len, rem) {
++ if (nla_len(attr) < sizeof(*param_info)) {
++ rc = -EINVAL;
++ goto exit_set_chap;
++ }
++
+ param_info = nla_data(attr);
+
+ switch (param_info->param) {
+@@ -2724,6 +2729,11 @@ qla4xxx_iface_set_param(struct Scsi_Host *shost, void *data, uint32_t len)
+ }
+
+ nla_for_each_attr(attr, data, len, rem) {
++ if (nla_len(attr) < sizeof(*iface_param)) {
++ rval = -EINVAL;
++ goto exit_init_fw_cb;
++ }
++
+ iface_param = nla_data(attr);
+
+ if (iface_param->param_type == ISCSI_NET_PARAM) {
+@@ -8098,6 +8108,11 @@ qla4xxx_sysfs_ddb_set_param(struct iscsi_bus_flash_session *fnode_sess,
+
+ memset((void *)&chap_tbl, 0, sizeof(chap_tbl));
+ nla_for_each_attr(attr, data, len, rem) {
++ if (nla_len(attr) < sizeof(*fnode_param)) {
++ rc = -EINVAL;
++ goto exit_set_param;
++ }
++
+ fnode_param = nla_data(attr);
+
+ switch (fnode_param->param) {
+--
+2.40.1
+
--- /dev/null
+From bb05d37d7b38288e93acab189251ef5d4e31d6ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 18:54:06 +0800
+Subject: serial: tegra: handle clk prepare error in tegra_uart_hw_init()
+
+From: Yi Yang <yiyang13@huawei.com>
+
+[ Upstream commit 5abd01145d0cc6cd1b7c2fe6ee0b9ea0fa13671e ]
+
+In tegra_uart_hw_init(), the return value of clk_prepare_enable() should
+be checked since it might fail.
+
+Fixes: e9ea096dd225 ("serial: tegra: add serial driver")
+Signed-off-by: Yi Yang <yiyang13@huawei.com>
+Link: https://lore.kernel.org/r/20230817105406.228674-1-yiyang13@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/serial-tegra.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
+index 41fe45f2349ef..a30f7ed123469 100644
+--- a/drivers/tty/serial/serial-tegra.c
++++ b/drivers/tty/serial/serial-tegra.c
+@@ -944,7 +944,11 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup)
+ tup->ier_shadow = 0;
+ tup->current_baud = 0;
+
+- clk_prepare_enable(tup->uart_clk);
++ ret = clk_prepare_enable(tup->uart_clk);
++ if (ret) {
++ dev_err(tup->uport.dev, "could not enable clk\n");
++ return ret;
++ }
+
+ /* Reset the UART controller to clear all previous status.*/
+ reset_control_assert(tup->rst);
+--
+2.40.1
+
udf-check-consistency-of-space-bitmap-descriptor.patch
udf-handle-error-when-adding-extent-to-a-file.patch
revert-net-macsec-preserve-ingress-frame-ordering.patch
+reiserfs-check-the-return-value-from-__getblk.patch
+eventfd-export-eventfd_ctx_do_read.patch
+eventfd-prevent-underflow-for-eventfd-semaphores.patch
+new-helper-lookup_positive_unlocked.patch
+fs-fix-error-checking-for-d_hash_and_lookup.patch
+cpufreq-powernow-k8-use-related_cpus-instead-of-cpus.patch
+bpf-clear-the-probe_addr-for-uprobe.patch
+tcp-tcp_enter_quickack_mode-should-be-static.patch
+regmap-rbtree-use-alloc_flags-for-memory-allocations.patch
+spi-tegra20-sflash-fix-to-check-return-value-of-plat.patch
+can-gs_usb-gs_usb_receive_bulk_callback-count-rx-ove.patch
+wifi-mwifiex-fix-oob-and-integer-underflow-when-rx-p.patch
+mwifiex-drop-set_consistent_dma_mask-log-message.patch
+mwifiex-switch-from-pci_-to-dma_-api.patch
+wifi-mwifiex-fix-error-recovery-in-pcie-buffer-descr.patch
+bluetooth-nokia-fix-value-check-in-nokia_bluetooth_s.patch
+crypto-caam-fix-unchecked-return-value-error.patch
+lwt-check-lwtunnel_xmit_continue-strictly.patch
+fs-ocfs2-namei-check-return-value-of-ocfs2_add_entry.patch
+wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch
+wifi-mwifiex-fix-missed-return-in-oob-checks-failed-.patch
+wifi-ath9k-fix-races-between-ath9k_wmi_cmd-and-ath9k.patch
+wifi-ath9k-protect-wmi-command-response-buffer-repla.patch
+wifi-mwifiex-avoid-possible-null-skb-pointer-derefer.patch
+wifi-ath9k-use-is_err-with-debugfs_create_dir.patch
+net-arcnet-do-not-call-kfree_skb-under-local_irq_dis.patch
+net-sched-sch_hfsc-ensure-inner-classes-have-fsc-cur.patch
+netrom-deny-concurrent-connect.patch
+quota-add-dqi_dirty_list-description-to-comment-of-d.patch
+quota-avoid-increasing-dqst_lookups-when-iterating-o.patch
+quota-factor-out-dquot_write_dquot.patch
+quota-rename-dquot_active-to-inode_quota_active.patch
+quota-add-new-helper-dquot_active.patch
+quota-fix-dqput-to-follow-the-guarantees-dquot_srcu-.patch
+arm64-dts-msm8996-thermal-add-interrupt-support.patch
+arm64-dts-qcom-msm8996-add-missing-interrupt-to-the-.patch
+drm-amdgpu-avoid-integer-overflow-warning-in-amdgpu_.patch
+arm-dts-bcm5301x-harmonize-ehci-ohci-dt-nodes-name.patch
+arm-dts-bcm53573-describe-on-soc-bcm53125-rev-4-swit.patch
+arm-dts-bcm53573-drop-nonexistent-usb-cells.patch
+arm-dts-bcm53573-add-cells-sizes-to-pcie-node.patch
+arm-dts-bcm53573-use-updated-spi-gpio-binding-proper.patch
+arm-dts-s3c6410-move-fixed-clocks-under-root-node-in.patch
+arm-dts-s3c6410-align-node-srom-bus-node-name-with-d.patch
+arm-dts-s3c64xx-align-pinctrl-with-dtschema.patch
+arm-dts-samsung-s3c6410-mini6410-correct-ethernet-re.patch
+arm-dts-s5pv210-add-rtc-32-khz-clock-in-smdkv210.patch
+arm-dts-s5pv210-use-defines-for-irq-flags-in-smdkv21.patch
+arm-dts-s5pv210-correct-ethernet-unit-address-in-smd.patch
+arm-dts-s5pv210-add-dummy-5v-regulator-for-backlight.patch
+arm-dts-samsung-s5pv210-smdkv210-correct-ethernet-re.patch
+drm-adv7511-fix-low-refresh-rate-register-for-adv753.patch
+arm-dts-bcm53573-fix-ethernet-info-for-luxul-devices.patch
+drm-tegra-remove-superfluous-error-messages-around-p.patch
+drm-tegra-dpaux-fix-incorrect-return-value-of-platfo.patch
+of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch
+drm-msm-replace-drm_framebuffer_-un-reference-with-p.patch
+drm-msm-mdp5-don-t-leak-some-plane-state.patch
+smackfs-prevent-underflow-in-smk_set_cipso.patch
+audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch
+md-raid1-free-the-r1bio-before-waiting-for-blocked-r.patch
+md-raid1-hold-the-barrier-until-handle_read_error-fi.patch
+of-unittest-fix-overlay-type-in-apply-revert-check.patch
+alsa-ac97-fix-possible-error-value-of-rac97.patch
+drivers-clk-keystone-fix-parameter-judgment-in-_of_p.patch
+clk-sunxi-ng-modify-mismatched-function-name.patch
+pci-mark-nvidia-t4-gpus-to-avoid-bus-reset.patch
+pci-pciehp-use-rmw-accessors-for-changing-lnkctl.patch
+pci-aspm-use-rmw-accessors-for-changing-lnkctl.patch
+pci-ats-add-pci_prg_resp_pasid_required-interface.patch
+pci-cleanup-register-definition-width-and-whitespace.patch
+pci-decode-pcie-32-gt-s-link-speed.patch
+pci-add-defines-for-enter-compliance-transmit-margin.patch
+drm-amdgpu-correct-transmit-margin-masks.patch
+drm-amdgpu-replace-numbers-with-pci_exp_lnkctl2-defi.patch
+drm-amdgpu-prefer-pcie_capability_read_word.patch
+drm-amdgpu-use-rmw-accessors-for-changing-lnkctl.patch
+drm-radeon-correct-transmit-margin-masks.patch
+drm-radeon-replace-numbers-with-pci_exp_lnkctl2-defi.patch
+drm-radeon-prefer-pcie_capability_read_word.patch
+drm-radeon-use-rmw-accessors-for-changing-lnkctl.patch
+wifi-ath10k-use-rmw-accessors-for-changing-lnkctl.patch
+nfs-blocklayout-use-the-passed-in-gfp-flags.patch
+powerpc-iommu-fix-notifiers-being-shared-by-pci-and-.patch
+jfs-validate-max-amount-of-blocks-before-allocation.patch
+fs-lockd-avoid-possible-wrong-null-parameter.patch
+nfsd-da_addr_body-field-missing-in-some-getdeviceinf.patch
+media-use-of_node_name_eq-for-node-name-comparisons.patch
+media-v4l2-fwnode-fix-v4l2_fwnode_parse_link-handlin.patch
+media-v4l2-fwnode-simplify-v4l2_fwnode_parse_link.patch
+media-v4l2-core-fix-a-potential-resource-leak-in-v4l.patch
+drivers-usb-smsusb-fix-error-handling-code-in-smsusb.patch
+media-dib7000p-fix-potential-division-by-zero.patch
+media-dvb-usb-m920x-fix-a-potential-memory-leak-in-m.patch
+media-cx24120-add-retval-check-for-cx24120_message_s.patch
+media-mediatek-vcodec-return-null-if-no-vdec_fb-is-f.patch
+usb-phy-mxs-fix-getting-wrong-state-with-mxs_phy_is_.patch
+scsi-iscsi-add-strlen-check-in-iscsi_if_set-_host-_p.patch
+scsi-be2iscsi-add-length-check-when-parsing-nlattrs.patch
+scsi-qla4xxx-add-length-check-when-parsing-nlattrs.patch
+x86-apm-drop-the-duplicate-apm_minor_dev-macro.patch
+scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_st.patch
+scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_fp.patch
+dma-buf-sync_file-fix-docs-syntax.patch
+ib-uverbs-fix-an-potential-error-pointer-dereference.patch
+media-go7007-remove-redundant-if-statement.patch
+usb-gadget-f_mass_storage-fix-unused-variable-warnin.patch
+media-i2c-ov2680-set-v4l2_ctrl_flag_modify_layout-on.patch
+media-ov2680-remove-auto-gain-and-auto-exposure-cont.patch
+media-ov2680-fix-ov2680_bayer_order.patch
+media-ov2680-fix-vflip-hflip-set-functions.patch
+media-ov2680-fix-regulators-being-left-enabled-on-ov.patch
+cgroup-namespace-remove-unused-cgroup_namespaces_ini.patch
+scsi-core-use-32-bit-hostnum-in-scsi_host_lookup.patch
+scsi-fcoe-fix-potential-deadlock-on-fip-ctlr_lock.patch
+serial-tegra-handle-clk-prepare-error-in-tegra_uart_.patch
+amba-bus-fix-refcount-leak.patch
+revert-ib-isert-fix-incorrect-release-of-isert-conne.patch
+hid-multitouch-correct-devm-device-reference-for-hid.patch
+rpmsg-glink-add-check-for-kstrdup.patch
+arch-um-drivers-kconfig-pedantic-formatting.patch
+um-fix-hostaudio-build-errors.patch
+dmaengine-ste_dma40-add-missing-irq-check-in-d40_pro.patch
--- /dev/null
+From 9422de2d5591c6fdc929c1f5f930435d1359da0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Jul 2023 08:52:39 +0300
+Subject: smackfs: Prevent underflow in smk_set_cipso()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 3ad49d37cf5759c3b8b68d02e3563f633d9c1aee ]
+
+There is a upper bound to "catlen" but no lower bound to prevent
+negatives. I don't see that this necessarily causes a problem but we
+may as well be safe.
+
+Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/smack/smackfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index a9c516362170a..61e734baa332a 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -923,7 +923,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
+ }
+
+ ret = sscanf(rule, "%d", &catlen);
+- if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
++ if (ret != 1 || catlen < 0 || catlen > SMACK_CIPSO_MAXCATNUM)
+ goto out;
+
+ if (format == SMK_FIXED24_FMT &&
+--
+2.40.1
+
--- /dev/null
+From 9641faa09edb320de5774cc18f37f0f6148f71f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jul 2023 23:49:09 +0800
+Subject: spi: tegra20-sflash: fix to check return value of platform_get_irq()
+ in tegra_sflash_probe()
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit 29a449e765ff70a5bd533be94babb6d36985d096 ]
+
+The platform_get_irq might be failed and return a negative result. So
+there should have an error handling code.
+
+Fixed this by adding an error handling code.
+
+Fixes: 8528547bcc33 ("spi: tegra: add spi driver for sflash controller")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Link: https://lore.kernel.org/r/tencent_71FC162D589E4788C2152AAC84CD8D5C6D06@qq.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra20-sflash.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
+index 749288310c36c..2989795272a16 100644
+--- a/drivers/spi/spi-tegra20-sflash.c
++++ b/drivers/spi/spi-tegra20-sflash.c
+@@ -469,7 +469,11 @@ static int tegra_sflash_probe(struct platform_device *pdev)
+ goto exit_free_master;
+ }
+
+- tsd->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto exit_free_master;
++ tsd->irq = ret;
++
+ ret = request_irq(tsd->irq, tegra_sflash_isr, 0,
+ dev_name(&pdev->dev), tsd);
+ if (ret < 0) {
+--
+2.40.1
+
--- /dev/null
+From 7dff13a50126debbd0c2bbd49c2c28e377ba613b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jul 2023 16:20:49 +0000
+Subject: tcp: tcp_enter_quickack_mode() should be static
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 03b123debcbc8db987bda17ed8412cc011064c22 ]
+
+After commit d2ccd7bc8acd ("tcp: avoid resetting ACK timer in DCTCP"),
+tcp_enter_quickack_mode() is only used from net/ipv4/tcp_input.c.
+
+Fixes: d2ccd7bc8acd ("tcp: avoid resetting ACK timer in DCTCP")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Cc: Neal Cardwell <ncardwell@google.com>
+Link: https://lore.kernel.org/r/20230718162049.1444938-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/tcp.h | 1 -
+ net/ipv4/tcp_input.c | 3 +--
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index c6c48409e7b42..9c43299ff8708 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -346,7 +346,6 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos,
+ struct pipe_inode_info *pipe, size_t len,
+ unsigned int flags);
+
+-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks);
+ static inline void tcp_dec_quickack_mode(struct sock *sk,
+ const unsigned int pkts)
+ {
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 281f7799aeafc..9e1ec69fe5b46 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -216,7 +216,7 @@ static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks)
+ icsk->icsk_ack.quick = quickacks;
+ }
+
+-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
++static void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
+ {
+ struct inet_connection_sock *icsk = inet_csk(sk);
+
+@@ -224,7 +224,6 @@ void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
+ icsk->icsk_ack.pingpong = 0;
+ icsk->icsk_ack.ato = TCP_ATO_MIN;
+ }
+-EXPORT_SYMBOL(tcp_enter_quickack_mode);
+
+ /* Send ACKs quickly, if "quick" count is not exhausted
+ * and the session is not interactive.
+--
+2.40.1
+
--- /dev/null
+From cbcb22cc42d178e7c1d190b7c0a67bcfaaa28caa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Aug 2023 22:15:00 -0700
+Subject: um: Fix hostaudio build errors
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit db4bfcba7bb8d10f00bba2a3da6b9a9c2a1d7b71 ]
+
+Use "select" to ensure that the required kconfig symbols are set
+as expected.
+Drop HOSTAUDIO since it is now equivalent to UML_SOUND.
+
+Set CONFIG_SOUND=m in ARCH=um defconfig files to maintain the
+status quo of the default configs.
+
+Allow SOUND with UML regardless of HAS_IOMEM. Otherwise there is a
+kconfig warning for unmet dependencies. (This was not an issue when
+SOUND was defined in arch/um/drivers/Kconfig. I have done 50 randconfig
+builds and didn't find any issues.)
+
+This fixes build errors when CONFIG_SOUND is not set:
+
+ld: arch/um/drivers/hostaudio_kern.o: in function `hostaudio_cleanup_module':
+hostaudio_kern.c:(.exit.text+0xa): undefined reference to `unregister_sound_mixer'
+ld: hostaudio_kern.c:(.exit.text+0x15): undefined reference to `unregister_sound_dsp'
+ld: arch/um/drivers/hostaudio_kern.o: in function `hostaudio_init_module':
+hostaudio_kern.c:(.init.text+0x19): undefined reference to `register_sound_dsp'
+ld: hostaudio_kern.c:(.init.text+0x31): undefined reference to `register_sound_mixer'
+ld: hostaudio_kern.c:(.init.text+0x49): undefined reference to `unregister_sound_dsp'
+
+and this kconfig warning:
+WARNING: unmet direct dependencies detected for SOUND
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Fixes: d886e87cb82b ("sound: make OSS sound core optional")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: lore.kernel.org/r/202307141416.vxuRVpFv-lkp@intel.com
+Cc: Richard Weinberger <richard@nod.at>
+Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Cc: linux-um@lists.infradead.org
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Masahiro Yamada <masahiroy@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: Nicolas Schier <nicolas@fjasle.eu>
+Cc: linux-kbuild@vger.kernel.org
+Cc: alsa-devel@alsa-project.org
+Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/configs/i386_defconfig | 1 +
+ arch/um/configs/x86_64_defconfig | 1 +
+ arch/um/drivers/Kconfig | 16 +++-------------
+ arch/um/drivers/Makefile | 2 +-
+ sound/Kconfig | 2 +-
+ 5 files changed, 7 insertions(+), 15 deletions(-)
+
+diff --git a/arch/um/configs/i386_defconfig b/arch/um/configs/i386_defconfig
+index 8f114e3b0a7a3..8d06b799a0e4e 100644
+--- a/arch/um/configs/i386_defconfig
++++ b/arch/um/configs/i386_defconfig
+@@ -35,6 +35,7 @@ CONFIG_TTY_CHAN=y
+ CONFIG_XTERM_CHAN=y
+ CONFIG_CON_CHAN="pts"
+ CONFIG_SSL_CHAN="pts"
++CONFIG_SOUND=m
+ CONFIG_UML_SOUND=m
+ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+ CONFIG_DEVTMPFS=y
+diff --git a/arch/um/configs/x86_64_defconfig b/arch/um/configs/x86_64_defconfig
+index 5d0875fc0db25..446bdda4cbfb6 100644
+--- a/arch/um/configs/x86_64_defconfig
++++ b/arch/um/configs/x86_64_defconfig
+@@ -33,6 +33,7 @@ CONFIG_TTY_CHAN=y
+ CONFIG_XTERM_CHAN=y
+ CONFIG_CON_CHAN="pts"
+ CONFIG_SSL_CHAN="pts"
++CONFIG_SOUND=m
+ CONFIG_UML_SOUND=m
+ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+ CONFIG_DEVTMPFS=y
+diff --git a/arch/um/drivers/Kconfig b/arch/um/drivers/Kconfig
+index 2638e46f50ccd..494f7c27056e3 100644
+--- a/arch/um/drivers/Kconfig
++++ b/arch/um/drivers/Kconfig
+@@ -104,24 +104,14 @@ config SSL_CHAN
+
+ config UML_SOUND
+ tristate "Sound support"
++ depends on SOUND
++ select SOUND_OSS_CORE
+ help
+ This option enables UML sound support. If enabled, it will pull in
+- soundcore and the UML hostaudio relay, which acts as a intermediary
++ the UML hostaudio relay, which acts as a intermediary
+ between the host's dsp and mixer devices and the UML sound system.
+ It is safe to say 'Y' here.
+
+-config SOUND
+- tristate
+- default UML_SOUND
+-
+-config SOUND_OSS_CORE
+- bool
+- default UML_SOUND
+-
+-config HOSTAUDIO
+- tristate
+- default UML_SOUND
+-
+ endmenu
+
+ menu "UML Network Devices"
+diff --git a/arch/um/drivers/Makefile b/arch/um/drivers/Makefile
+index 693319839f69e..d945abf90c319 100644
+--- a/arch/um/drivers/Makefile
++++ b/arch/um/drivers/Makefile
+@@ -52,7 +52,7 @@ obj-$(CONFIG_UML_NET) += net.o
+ obj-$(CONFIG_MCONSOLE) += mconsole.o
+ obj-$(CONFIG_MMAPPER) += mmapper_kern.o
+ obj-$(CONFIG_BLK_DEV_UBD) += ubd.o
+-obj-$(CONFIG_HOSTAUDIO) += hostaudio.o
++obj-$(CONFIG_UML_SOUND) += hostaudio.o
+ obj-$(CONFIG_NULL_CHAN) += null.o
+ obj-$(CONFIG_PORT_CHAN) += port.o
+ obj-$(CONFIG_PTY_CHAN) += pty.o
+diff --git a/sound/Kconfig b/sound/Kconfig
+index 1140e9988fc50..76febc37862de 100644
+--- a/sound/Kconfig
++++ b/sound/Kconfig
+@@ -1,6 +1,6 @@
+ menuconfig SOUND
+ tristate "Sound card support"
+- depends on HAS_IOMEM
++ depends on HAS_IOMEM || UML
+ help
+ If you have a sound card in your computer, i.e. if it can say more
+ than an occasional beep, say Y.
+--
+2.40.1
+
--- /dev/null
+From 519741210e7fd7348cbaa4c5220f5148ce561e62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Aug 2023 13:47:04 -0400
+Subject: USB: gadget: f_mass_storage: Fix unused variable warning
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+[ Upstream commit 55c3e571d2a0aabef4f1354604443f1c415d2e85 ]
+
+Fix a "variable set but not used" warning in f_mass_storage.c. rc is
+used if verbose debugging is enabled but not otherwise.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Fixes: d5e2b67aae79 ("USB: g_mass_storage: template f_mass_storage.c file created")
+Link: https://lore.kernel.org/r/cfed16c7-aa46-494b-ba84-b0e0dc99be3a@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_mass_storage.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
+index 0b7b4d09785b6..4f221ca7aad15 100644
+--- a/drivers/usb/gadget/function/f_mass_storage.c
++++ b/drivers/usb/gadget/function/f_mass_storage.c
+@@ -950,7 +950,7 @@ static void invalidate_sub(struct fsg_lun *curlun)
+ {
+ struct file *filp = curlun->filp;
+ struct inode *inode = file_inode(filp);
+- unsigned long rc;
++ unsigned long __maybe_unused rc;
+
+ rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
+ VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
+--
+2.40.1
+
--- /dev/null
+From 9cf9105ddc2e5111e869aea22dc891c2a8bef8b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 19:03:52 +0800
+Subject: usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 5eda42aebb7668b4dcff025cd3ccb0d3d7c53da6 ]
+
+The function mxs_phy_is_otg_host() will return true if OTG_ID_VALUE is
+0 at USBPHY_CTRL register. However, OTG_ID_VALUE will not reflect the real
+state if the ID pin is float, such as Host-only or Type-C cases. The value
+of OTG_ID_VALUE is always 1 which means device mode.
+This patch will fix the issue by judging the current mode based on
+last_event. The controller will update last_event in time.
+
+Fixes: 7b09e67639d6 ("usb: phy: mxs: refine mxs_phy_disconnect_line")
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://lore.kernel.org/r/20230627110353.1879477-2-xu.yang_2@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-mxs-usb.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
+index e5aa24c1e4fd7..8af2ee3713b6d 100644
+--- a/drivers/usb/phy/phy-mxs-usb.c
++++ b/drivers/usb/phy/phy-mxs-usb.c
+@@ -312,14 +312,8 @@ static void __mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool disconnect)
+
+ static bool mxs_phy_is_otg_host(struct mxs_phy *mxs_phy)
+ {
+- void __iomem *base = mxs_phy->phy.io_priv;
+- u32 phyctrl = readl(base + HW_USBPHY_CTRL);
+-
+- if (IS_ENABLED(CONFIG_USB_OTG) &&
+- !(phyctrl & BM_USBPHY_CTRL_OTG_ID_VALUE))
+- return true;
+-
+- return false;
++ return IS_ENABLED(CONFIG_USB_OTG) &&
++ mxs_phy->phy.last_event == USB_EVENT_ID;
+ }
+
+ static void mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool on)
+--
+2.40.1
+
--- /dev/null
+From f8e37b8e1da2b374966510fff372174f6a4caf25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jul 2023 15:05:02 +0300
+Subject: wifi: ath10k: Use RMW accessors for changing LNKCTL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit f139492a09f15254fa261245cdbd65555cdf39e3 ]
+
+Don't assume that only the driver would be accessing LNKCTL. ASPM policy
+changes can trigger write to LNKCTL outside of driver's control.
+
+Use RMW capability accessors which does proper locking to avoid losing
+concurrent updates to the register value. On restore, clear the ASPMC field
+properly.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Fixes: 76d870ed09ab ("ath10k: enable ASPM")
+Link: https://lore.kernel.org/r/20230717120503.15276-11-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Acked-by: Kalle Valo <kvalo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/pci.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index 92757495c73b6..c929a62c722ad 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -1957,8 +1957,9 @@ static int ath10k_pci_hif_start(struct ath10k *ar)
+ ath10k_pci_irq_enable(ar);
+ ath10k_pci_rx_post(ar);
+
+- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL,
+- ar_pci->link_ctl);
++ pcie_capability_clear_and_set_word(ar_pci->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_ASPMC,
++ ar_pci->link_ctl & PCI_EXP_LNKCTL_ASPMC);
+
+ return 0;
+ }
+@@ -2813,8 +2814,8 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar)
+
+ pcie_capability_read_word(ar_pci->pdev, PCI_EXP_LNKCTL,
+ &ar_pci->link_ctl);
+- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL,
+- ar_pci->link_ctl & ~PCI_EXP_LNKCTL_ASPMC);
++ pcie_capability_clear_word(ar_pci->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_ASPMC);
+
+ /*
+ * Bring the target up cleanly.
+--
+2.40.1
+
--- /dev/null
+From 4642121a07218612e151ad61541f55a9729d5ad8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 22:26:06 +0300
+Subject: wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit b674fb513e2e7a514fcde287c0f73915d393fdb6 ]
+
+Currently, the synchronization between ath9k_wmi_cmd() and
+ath9k_wmi_ctrl_rx() is exposed to a race condition which, although being
+rather unlikely, can lead to invalid behaviour of ath9k_wmi_cmd().
+
+Consider the following scenario:
+
+CPU0 CPU1
+
+ath9k_wmi_cmd(...)
+ mutex_lock(&wmi->op_mutex)
+ ath9k_wmi_cmd_issue(...)
+ wait_for_completion_timeout(...)
+ ---
+ timeout
+ ---
+ /* the callback is being processed
+ * before last_seq_id became zero
+ */
+ ath9k_wmi_ctrl_rx(...)
+ spin_lock_irqsave(...)
+ /* wmi->last_seq_id check here
+ * doesn't detect timeout yet
+ */
+ spin_unlock_irqrestore(...)
+ /* last_seq_id is zeroed to
+ * indicate there was a timeout
+ */
+ wmi->last_seq_id = 0
+ mutex_unlock(&wmi->op_mutex)
+ return -ETIMEDOUT
+
+ath9k_wmi_cmd(...)
+ mutex_lock(&wmi->op_mutex)
+ /* the buffer is replaced with
+ * another one
+ */
+ wmi->cmd_rsp_buf = rsp_buf
+ wmi->cmd_rsp_len = rsp_len
+ ath9k_wmi_cmd_issue(...)
+ spin_lock_irqsave(...)
+ spin_unlock_irqrestore(...)
+ wait_for_completion_timeout(...)
+ /* the continuation of the
+ * callback left after the first
+ * ath9k_wmi_cmd call
+ */
+ ath9k_wmi_rsp_callback(...)
+ /* copying data designated
+ * to already timeouted
+ * WMI command into an
+ * inappropriate wmi_cmd_buf
+ */
+ memcpy(...)
+ complete(&wmi->cmd_wait)
+ /* awakened by the bogus callback
+ * => invalid return result
+ */
+ mutex_unlock(&wmi->op_mutex)
+ return 0
+
+To fix this, update last_seq_id on timeout path inside ath9k_wmi_cmd()
+under the wmi_lock. Move ath9k_wmi_rsp_callback() under wmi_lock inside
+ath9k_wmi_ctrl_rx() so that the wmi->cmd_wait can be completed only for
+initially designated wmi_cmd call, otherwise the path would be rejected
+with last_seq_id check.
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230425192607.18015-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/wmi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
+index 5e2a610df61cf..44faa12a7205c 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.c
++++ b/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -239,10 +239,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
+ spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+ goto free_skb;
+ }
+- spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+
+ /* WMI command response */
+ ath9k_wmi_rsp_callback(wmi, skb);
++ spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+
+ free_skb:
+ kfree_skb(skb);
+@@ -305,8 +305,8 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+ struct ath_common *common = ath9k_hw_common(ah);
+ u16 headroom = sizeof(struct htc_frame_hdr) +
+ sizeof(struct wmi_cmd_hdr);
++ unsigned long time_left, flags;
+ struct sk_buff *skb;
+- unsigned long time_left;
+ int ret = 0;
+
+ if (ah->ah_flags & AH_UNPLUGGED)
+@@ -342,7 +342,9 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+ if (!time_left) {
+ ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
+ wmi_cmd_to_name(cmd_id));
++ spin_lock_irqsave(&wmi->wmi_lock, flags);
+ wmi->last_seq_id = 0;
++ spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+ mutex_unlock(&wmi->op_mutex);
+ kfree_skb(skb);
+ return -ETIMEDOUT;
+--
+2.40.1
+
--- /dev/null
+From ea4b12b3fcfb69acb917906f6ab9405667823c47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 22:26:07 +0300
+Subject: wifi: ath9k: protect WMI command response buffer replacement with a
+ lock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 454994cfa9e4c18b6df9f78b60db8eadc20a6c25 ]
+
+If ath9k_wmi_cmd() has exited with a timeout, it is possible that during
+next ath9k_wmi_cmd() call the wmi_rsp callback for previous wmi command
+writes to new wmi->cmd_rsp_buf and makes a completion. This results in an
+invalid ath9k_wmi_cmd() return value.
+
+Move the replacement of WMI command response buffer and length under
+wmi_lock. Note that last_seq_id value is updated there, too.
+
+Thus, the buffer cannot be written to by a belated wmi_rsp callback
+because that path is properly rejected by the last_seq_id check.
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230425192607.18015-2-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/wmi.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
+index 44faa12a7205c..78ce349a48f7e 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.c
++++ b/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -280,7 +280,8 @@ int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi,
+
+ static int ath9k_wmi_cmd_issue(struct wmi *wmi,
+ struct sk_buff *skb,
+- enum wmi_cmd_id cmd, u16 len)
++ enum wmi_cmd_id cmd, u16 len,
++ u8 *rsp_buf, u32 rsp_len)
+ {
+ struct wmi_cmd_hdr *hdr;
+ unsigned long flags;
+@@ -290,6 +291,11 @@ static int ath9k_wmi_cmd_issue(struct wmi *wmi,
+ hdr->seq_no = cpu_to_be16(++wmi->tx_seq_id);
+
+ spin_lock_irqsave(&wmi->wmi_lock, flags);
++
++ /* record the rsp buffer and length */
++ wmi->cmd_rsp_buf = rsp_buf;
++ wmi->cmd_rsp_len = rsp_len;
++
+ wmi->last_seq_id = wmi->tx_seq_id;
+ spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+
+@@ -330,11 +336,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+ goto out;
+ }
+
+- /* record the rsp buffer and length */
+- wmi->cmd_rsp_buf = rsp_buf;
+- wmi->cmd_rsp_len = rsp_len;
+-
+- ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len);
++ ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len, rsp_buf, rsp_len);
+ if (ret)
+ goto out;
+
+--
+2.40.1
+
--- /dev/null
+From b7a4649005b8c42941883db65e7cf68c72c1fe01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jul 2023 11:03:44 +0800
+Subject: wifi: ath9k: use IS_ERR() with debugfs_create_dir()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wang Ming <machel@vivo.com>
+
+[ Upstream commit 1e4134610d93271535ecf900a676e1f094e9944c ]
+
+The debugfs_create_dir() function returns error pointers,
+it never returns NULL. Most incorrect error checks were fixed,
+but the one in ath9k_htc_init_debug() was forgotten.
+
+Fix the remaining error check.
+
+Fixes: e5facc75fa91 ("ath9k_htc: Cleanup HTC debugfs")
+Signed-off-by: Wang Ming <machel@vivo.com>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230713030358.12379-1-machel@vivo.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+index b3ed65e5c4da8..c55aab01fff5d 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+@@ -491,7 +491,7 @@ int ath9k_htc_init_debug(struct ath_hw *ah)
+
+ priv->debug.debugfs_phy = debugfs_create_dir(KBUILD_MODNAME,
+ priv->hw->wiphy->debugfsdir);
+- if (!priv->debug.debugfs_phy)
++ if (IS_ERR(priv->debug.debugfs_phy))
+ return -ENOMEM;
+
+ ath9k_cmn_spectral_init_debug(&priv->spec_priv, priv->debug.debugfs_phy);
+--
+2.40.1
+
--- /dev/null
+From 563838dbe1731b021bcd5de6128da0b39248eb1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Aug 2023 12:49:57 +0300
+Subject: wifi: mwifiex: avoid possible NULL skb pointer dereference
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 35a7a1ce7c7d61664ee54f5239a1f120ab95a87e ]
+
+In 'mwifiex_handle_uap_rx_forward()', always check the value
+returned by 'skb_copy()' to avoid potential NULL pointer
+dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop
+original skb in case of copying failure.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 838e4f449297 ("mwifiex: improve uAP RX handling")
+Acked-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230814095041.16416-1-dmantipov@yandex.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+index c723eb16d0914..987057af00fb3 100644
+--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+@@ -266,7 +266,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv,
+
+ if (is_multicast_ether_addr(ra)) {
+ skb_uap = skb_copy(skb, GFP_ATOMIC);
+- mwifiex_uap_queue_bridged_pkt(priv, skb_uap);
++ if (likely(skb_uap)) {
++ mwifiex_uap_queue_bridged_pkt(priv, skb_uap);
++ } else {
++ mwifiex_dbg(adapter, ERROR,
++ "failed to copy skb for uAP\n");
++ priv->stats.rx_dropped++;
++ dev_kfree_skb_any(skb);
++ return -1;
++ }
+ } else {
+ if (mwifiex_get_sta_entry(priv, ra)) {
+ /* Requeue Intra-BSS packet */
+--
+2.40.1
+
--- /dev/null
+From 6e72f3220733c144970c75016b641a365899ec22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jul 2023 10:43:07 +0300
+Subject: wifi: mwifiex: fix error recovery in PCIE buffer descriptor
+ management
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 288c63d5cb4667a51a04668b3e2bb0ea499bc5f4 ]
+
+Add missing 'kfree_skb()' in 'mwifiex_init_rxq_ring()' and never do
+'kfree(card->rxbd_ring_vbase)' because this area is DMAed and should
+be released with 'dma_free_coherent()'. The latter is performed in
+'mwifiex_pcie_delete_rxbd_ring()', which is now called to recover
+from possible errors in 'mwifiex_pcie_create_rxbd_ring()'. Likewise
+for 'mwifiex_pcie_init_evt_ring()', 'kfree(card->evtbd_ring_vbase)'
+'mwifiex_pcie_delete_evtbd_ring()' and 'mwifiex_pcie_create_rxbd_ring()'.
+
+Fixes: d930faee141b ("mwifiex: add support for Marvell pcie8766 chipset")
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Acked-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230731074334.56463-1-dmantipov@yandex.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/pcie.c | 25 ++++++++++++++-------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
+index 4fce133c3dcac..7e9111965b233 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -50,6 +50,8 @@ static int mwifiex_pcie_probe_of(struct device *dev)
+ }
+
+ static void mwifiex_pcie_work(struct work_struct *work);
++static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter);
++static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter);
+
+ static int
+ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
+@@ -631,14 +633,15 @@ static int mwifiex_init_rxq_ring(struct mwifiex_adapter *adapter)
+ if (!skb) {
+ mwifiex_dbg(adapter, ERROR,
+ "Unable to allocate skb for RX ring.\n");
+- kfree(card->rxbd_ring_vbase);
+ return -ENOMEM;
+ }
+
+ if (mwifiex_map_pci_memory(adapter, skb,
+ MWIFIEX_RX_DATA_BUF_SIZE,
+- DMA_FROM_DEVICE))
+- return -1;
++ DMA_FROM_DEVICE)) {
++ kfree_skb(skb);
++ return -ENOMEM;
++ }
+
+ buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
+
+@@ -688,7 +691,6 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)
+ if (!skb) {
+ mwifiex_dbg(adapter, ERROR,
+ "Unable to allocate skb for EVENT buf.\n");
+- kfree(card->evtbd_ring_vbase);
+ return -ENOMEM;
+ }
+ skb_put(skb, MAX_EVENT_SIZE);
+@@ -696,8 +698,7 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)
+ if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE,
+ DMA_FROM_DEVICE)) {
+ kfree_skb(skb);
+- kfree(card->evtbd_ring_vbase);
+- return -1;
++ return -ENOMEM;
+ }
+
+ buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
+@@ -896,6 +897,7 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)
+ */
+ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
+ {
++ int ret;
+ struct pcie_service_card *card = adapter->card;
+ const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
+@@ -934,7 +936,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
+ (u32)((u64)card->rxbd_ring_pbase >> 32),
+ card->rxbd_ring_size);
+
+- return mwifiex_init_rxq_ring(adapter);
++ ret = mwifiex_init_rxq_ring(adapter);
++ if (ret)
++ mwifiex_pcie_delete_rxbd_ring(adapter);
++ return ret;
+ }
+
+ /*
+@@ -965,6 +970,7 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)
+ */
+ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
+ {
++ int ret;
+ struct pcie_service_card *card = adapter->card;
+ const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
+@@ -999,7 +1005,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
+ (u32)((u64)card->evtbd_ring_pbase >> 32),
+ card->evtbd_ring_size);
+
+- return mwifiex_pcie_init_evt_ring(adapter);
++ ret = mwifiex_pcie_init_evt_ring(adapter);
++ if (ret)
++ mwifiex_pcie_delete_evtbd_ring(adapter);
++ return ret;
+ }
+
+ /*
+--
+2.40.1
+
--- /dev/null
+From fe146b4be2c0b8b4831b7566dc11f0048f799cf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Aug 2023 19:07:15 +0300
+Subject: wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 9c8fd72a5c2a031cbc680a2990107ecd958ffcdb ]
+
+Always free the zeroed page on return from 'mwifiex_histogram_read()'.
+
+Fixes: cbf6e05527a7 ("mwifiex: add rx histogram statistics support")
+
+Acked-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230802160726.85545-1-dmantipov@yandex.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/debugfs.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+index cbe4493b32664..0f62da50e11a2 100644
+--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c
++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+@@ -265,8 +265,11 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ if (!p)
+ return -ENOMEM;
+
+- if (!priv || !priv->hist_data)
+- return -EFAULT;
++ if (!priv || !priv->hist_data) {
++ ret = -EFAULT;
++ goto free_and_exit;
++ }
++
+ phist_data = priv->hist_data;
+
+ p += sprintf(p, "\n"
+@@ -321,6 +324,8 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ ret = simple_read_from_buffer(ubuf, count, ppos, (char *)page,
+ (unsigned long)p - page);
+
++free_and_exit:
++ free_page(page);
+ return ret;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From df11a3a72c6e938d84c8fdfd41160dad9e8b1236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Aug 2023 08:39:11 +0000
+Subject: wifi: mwifiex: Fix missed return in oob checks failed path
+
+From: Polaris Pi <pinkperfect2021@gmail.com>
+
+[ Upstream commit 2785851c627f2db05f9271f7f63661b5dbd95c4c ]
+
+Add missed return in mwifiex_uap_queue_bridged_pkt() and
+mwifiex_process_rx_packet().
+
+Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets")
+Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com>
+Reported-by: Dmitry Antipov <dmantipov@yandex.ru>
+Acked-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230810083911.3725248-1-pinkperfect2021@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/sta_rx.c | 1 +
+ drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
+index a3d716a215ef2..f3c6daeba1b85 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
+@@ -104,6 +104,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
+ skb->len, rx_pkt_off);
+ priv->stats.rx_dropped++;
+ dev_kfree_skb_any(skb);
++ return -1;
+ }
+
+ if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
+diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+index c1dec186784b9..c723eb16d0914 100644
+--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+@@ -123,6 +123,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
+ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
+ priv->stats.rx_dropped++;
+ dev_kfree_skb_any(skb);
++ return;
+ }
+
+ if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
+--
+2.40.1
+
--- /dev/null
+From dfb3863e7af68e130feb25ed8a84b927fa575fed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jul 2023 07:07:41 +0000
+Subject: wifi: mwifiex: Fix OOB and integer underflow when rx packets
+
+From: Polaris Pi <pinkperfect2021@gmail.com>
+
+[ Upstream commit 11958528161731c58e105b501ed60b83a91ea941 ]
+
+Make sure mwifiex_process_mgmt_packet,
+mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet,
+mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet
+not out-of-bounds access the skb->data buffer.
+
+Fixes: 2dbaf751b1de ("mwifiex: report received management frames to cfg80211")
+Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com>
+Reviewed-by: Matthew Wang <matthewmwang@chromium.org>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230723070741.1544662-1-pinkperfect2021@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/sta_rx.c | 11 ++++++++++-
+ .../net/wireless/marvell/mwifiex/uap_txrx.c | 19 +++++++++++++++++++
+ drivers/net/wireless/marvell/mwifiex/util.c | 10 +++++++---
+ 3 files changed, 36 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
+index 00fcbda09349e..a3d716a215ef2 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
+@@ -98,6 +98,14 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
+ rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length);
+ rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off;
+
++ if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) {
++ mwifiex_dbg(priv->adapter, ERROR,
++ "wrong rx packet offset: len=%d, rx_pkt_off=%d\n",
++ skb->len, rx_pkt_off);
++ priv->stats.rx_dropped++;
++ dev_kfree_skb_any(skb);
++ }
++
+ if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
+ sizeof(bridge_tunnel_header))) ||
+ (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
+@@ -203,7 +211,8 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
+
+ rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_offset;
+
+- if ((rx_pkt_offset + rx_pkt_length) > (u16) skb->len) {
++ if ((rx_pkt_offset + rx_pkt_length) > skb->len ||
++ sizeof(rx_pkt_hdr->eth803_hdr) + rx_pkt_offset > skb->len) {
+ mwifiex_dbg(adapter, ERROR,
+ "wrong rx packet: len=%d, rx_pkt_offset=%d, rx_pkt_length=%d\n",
+ skb->len, rx_pkt_offset, rx_pkt_length);
+diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+index 5ce85d5727e4b..c1dec186784b9 100644
+--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+@@ -116,6 +116,15 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
+ return;
+ }
+
++ if (sizeof(*rx_pkt_hdr) +
++ le16_to_cpu(uap_rx_pd->rx_pkt_offset) > skb->len) {
++ mwifiex_dbg(adapter, ERROR,
++ "wrong rx packet offset: len=%d,rx_pkt_offset=%d\n",
++ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
++ priv->stats.rx_dropped++;
++ dev_kfree_skb_any(skb);
++ }
++
+ if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
+ sizeof(bridge_tunnel_header))) ||
+ (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
+@@ -385,6 +394,16 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv,
+ rx_pkt_type = le16_to_cpu(uap_rx_pd->rx_pkt_type);
+ rx_pkt_hdr = (void *)uap_rx_pd + le16_to_cpu(uap_rx_pd->rx_pkt_offset);
+
++ if (le16_to_cpu(uap_rx_pd->rx_pkt_offset) +
++ sizeof(rx_pkt_hdr->eth803_hdr) > skb->len) {
++ mwifiex_dbg(adapter, ERROR,
++ "wrong rx packet for struct ethhdr: len=%d, offset=%d\n",
++ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
++ priv->stats.rx_dropped++;
++ dev_kfree_skb_any(skb);
++ return 0;
++ }
++
+ ether_addr_copy(ta, rx_pkt_hdr->eth803_hdr.h_source);
+
+ if ((le16_to_cpu(uap_rx_pd->rx_pkt_offset) +
+diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c
+index f9b71539d33e6..c45f72779d08a 100644
+--- a/drivers/net/wireless/marvell/mwifiex/util.c
++++ b/drivers/net/wireless/marvell/mwifiex/util.c
+@@ -405,11 +405,15 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
+ }
+
+ rx_pd = (struct rxpd *)skb->data;
++ pkt_len = le16_to_cpu(rx_pd->rx_pkt_length);
++ if (pkt_len < sizeof(struct ieee80211_hdr) + sizeof(pkt_len)) {
++ mwifiex_dbg(priv->adapter, ERROR, "invalid rx_pkt_length");
++ return -1;
++ }
+
+ skb_pull(skb, le16_to_cpu(rx_pd->rx_pkt_offset));
+ skb_pull(skb, sizeof(pkt_len));
+-
+- pkt_len = le16_to_cpu(rx_pd->rx_pkt_length);
++ pkt_len -= sizeof(pkt_len);
+
+ ieee_hdr = (void *)skb->data;
+ if (ieee80211_is_mgmt(ieee_hdr->frame_control)) {
+@@ -422,7 +426,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
+ skb->data + sizeof(struct ieee80211_hdr),
+ pkt_len - sizeof(struct ieee80211_hdr));
+
+- pkt_len -= ETH_ALEN + sizeof(pkt_len);
++ pkt_len -= ETH_ALEN;
+ rx_pd->rx_pkt_length = cpu_to_le16(pkt_len);
+
+ cfg80211_rx_mgmt(&priv->wdev, priv->roc_cfg.chan.center_freq,
+--
+2.40.1
+
--- /dev/null
+From 370805502c65f83a667efe68ba211d584605575a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jul 2023 18:11:20 -0700
+Subject: x86/APM: drop the duplicate APM_MINOR_DEV macro
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 4ba2909638a29630a346d6c4907a3105409bee7d ]
+
+This source file already includes <linux/miscdevice.h>, which contains
+the same macro. It doesn't need to be defined here again.
+
+Fixes: 874bcd00f520 ("apm-emulation: move APM_MINOR_DEV to include/linux/miscdevice.h")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Jiri Kosina <jikos@kernel.org>
+Cc: x86@kernel.org
+Cc: Sohil Mehta <sohil.mehta@intel.com>
+Cc: Corentin Labbe <clabbe.montjoie@gmail.com>
+Reviewed-by: Sohil Mehta <sohil.mehta@intel.com>
+Link: https://lore.kernel.org/r/20230728011120.759-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apm_32.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
+index f7151cd03cb08..3d7a8049f6376 100644
+--- a/arch/x86/kernel/apm_32.c
++++ b/arch/x86/kernel/apm_32.c
+@@ -246,12 +246,6 @@
+ extern int (*console_blank_hook)(int);
+ #endif
+
+-/*
+- * The apm_bios device is one of the misc char devices.
+- * This is its minor number.
+- */
+-#define APM_MINOR_DEV 134
+-
+ /*
+ * Various options can be changed at boot time as follows:
+ * (We allow underscores for compatibility with the modules code)
+--
+2.40.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
