6.6.31-rc1 review

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bumyong Lee <[email protected]>

[ Upstream commit 22a9d9585812440211b0b34a6bc02ade62314be4 ]

According to DMA-330 errata notice[1] 71930, DMAKILL cannot clear internal signal, named pipeline_req_active. it makes that pl330 would wait forever in WFP state although dma already send dma request if pl330 gets dma request before entering WFP state.

The errata suggests that polling until entering WFP state as workaround and then peripherals allows to issue dma request.

[1]: https://developer.arm.com/documentation/genc008428/latest

Stable-dep-of: afc89870ea67 ("dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"")

---
 drivers/dma/pl330.c | 3 +++
 1 file changed, 3 insertions(+)

index 3cf0b38387ae5..c29744bfdf2c2 100644
@@ -1053,6 +1053,9 @@ static bool _trigger(struct pl330_thread *thrd)
 
 	thrd->req_running = idx;
 
+	if (desc->rqtype == DMA_MEM_TO_DEV || desc->rqtype == DMA_DEV_TO_MEM)
+		UNTIL(thrd, PL330_STATE_WFP);
+
 	return true;
 }
 

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Okazaki <[email protected]>

[ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ]

If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory.

Move the failure point before registering the nvmem device.

---
 drivers/misc/eeprom/at24.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

index e6d688817b106..c290e849b2ed8 100644
@@ -781,15 +781,6 @@ static int at24_probe(struct i2c_client *client)
 	}
 	pm_runtime_enable(dev);
 
-	at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
-	if (IS_ERR(at24->nvmem)) {
-		pm_runtime_disable(dev);
-		if (!pm_runtime_status_suspended(dev))
-			regulator_disable(at24->vcc_reg);
-		return dev_err_probe(dev, PTR_ERR(at24->nvmem),
-				     "failed to register nvmem\n");
-	}
-
 	/*
 	 * Perform a one-byte test read to verify that the chip is functional,
 	 * unless powering on the device is to be avoided during probe (i.e.

@@ -805,6 +796,15 @@ static int at24_probe(struct i2c_client *client)
 		}
 	}
 
+	at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
+	if (IS_ERR(at24->nvmem)) {
+		pm_runtime_disable(dev);
+		if (!pm_runtime_status_suspended(dev))
+			regulator_disable(at24->vcc_reg);
+		return dev_err_probe(dev, PTR_ERR(at24->nvmem),
+				     "failed to register nvmem\n");
+	}
+
 	/* If this a SPD EEPROM, probe for DDR3 thermal sensor */
 	if (cdata == &at24_data_spd)
 		at24_probe_temp_sensor(client);

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tim Jiang <[email protected]>

[ Upstream commit a7f8dedb4be2cc930a29af24427b885405ecd15d ]

This patch adds support for QCA2066 firmware patch and NVM downloading. as the RF performance of QCA2066 SOC chip from different foundries may vary. Therefore we use different NVM to configure them based on board ID.

Changes in v2
- optimize the function qca_generate_hsp_nvm_name
- remove redundant debug code for function qca_read_fw_board_id

Stable-dep-of: 32868e126c78 ("Bluetooth: qca: fix invalid device address check")

---
 drivers/bluetooth/btqca.c   | 68 +++++++++++++++++++++++++++++++++++++
 drivers/bluetooth/btqca.h   |  5 ++-
 drivers/bluetooth/hci_qca.c | 11 ++++++
 3 files changed, 83 insertions(+), 1 deletion(-)

index 5277090c6d6d7..19cfc342fc7bb 100644
@@ -205,6 +205,44 @@ static int qca_send_reset(struct hci_dev *hdev)
 	return 0;
 }
 
+static int qca_read_fw_board_id(struct hci_dev *hdev, u16 *bid)
+{
+	u8 cmd;
+	struct sk_buff *skb;
+	struct edl_event_hdr *edl;
+	int err = 0;
+
+	cmd = EDL_GET_BID_REQ_CMD;
+	skb = __hci_cmd_sync_ev(hdev, EDL_PATCH_CMD_OPCODE, EDL_PATCH_CMD_LEN,
+				&cmd, 0, HCI_INIT_TIMEOUT);
+	if (IS_ERR(skb)) {
+		err = PTR_ERR(skb);
+		bt_dev_err(hdev, "Reading QCA board ID failed (%d)", err);
+		return err;
+	}
+
+	edl = skb_pull_data(skb, sizeof(*edl));
+	if (!edl) {
+		bt_dev_err(hdev, "QCA read board ID with no header");
+		err = -EILSEQ;
+		goto out;
+	}
+
+	if (edl->cresp != EDL_CMD_REQ_RES_EVT ||
+	    edl->rtype != EDL_GET_BID_REQ_CMD) {
+		bt_dev_err(hdev, "QCA Wrong packet: %d %d", edl->cresp, edl->rtype);
+		err = -EIO;
+		goto out;
+	}
+
+	*bid = (edl->data[1] << 8) + edl->data[2];
+	bt_dev_dbg(hdev, "%s: bid = %x", __func__, *bid);
+
+out:
+	kfree_skb(skb);
+	return err;
+}
+
 int qca_send_pre_shutdown_cmd(struct hci_dev *hdev)
 {
 	struct sk_buff *skb;

@@ -574,6 +612,23 @@ int qca_set_bdaddr_rome(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 }
 EXPORT_SYMBOL_GPL(qca_set_bdaddr_rome);
 
+static void qca_generate_hsp_nvm_name(char *fwname, size_t max_size,
+		struct qca_btsoc_version ver, u8 rom_ver, u16 bid)
+{
+	const char *variant;
+
+	/* hsp gf chip */
+	if ((le32_to_cpu(ver.soc_id) & QCA_HSP_GF_SOC_MASK) == QCA_HSP_GF_SOC_ID)
+		variant = "g";
+	else
+		variant = "";
+
+	if (bid == 0x0)
+		snprintf(fwname, max_size, "qca/hpnv%02x%s.bin", rom_ver, variant);
+	else
+		snprintf(fwname, max_size, "qca/hpnv%02x%s.%x", rom_ver, variant, bid);
+}
+
 int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 		   enum qca_btsoc_type soc_type, struct qca_btsoc_version ver,
 		   const char *firmware_name)

@@ -582,6 +637,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 	int err;
 	u8 rom_ver = 0;
 	u32 soc_ver;
+	u16 boardid = 0;
 
 	bt_dev_dbg(hdev, "QCA setup on UART");
 

@@ -615,6 +671,10 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 		snprintf(config.fwname, sizeof(config.fwname),
 			 "qca/apbtfw%02x.tlv", rom_ver);
 		break;
+	case QCA_QCA2066:
+		snprintf(config.fwname, sizeof(config.fwname),
+			 "qca/hpbtfw%02x.tlv", rom_ver);
+		break;
 	case QCA_QCA6390:
 		snprintf(config.fwname, sizeof(config.fwname),
 			 "qca/htbtfw%02x.tlv", rom_ver);

@@ -649,6 +709,9 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 	/* Give the controller some time to get ready to receive the NVM */
 	msleep(10);
 
+	if (soc_type == QCA_QCA2066)
+		qca_read_fw_board_id(hdev, &boardid);
+
 	/* Download NVM configuration */
 	config.type = TLV_TYPE_NVM;
 	if (firmware_name) {

@@ -671,6 +734,10 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 			snprintf(config.fwname, sizeof(config.fwname),
 				 "qca/apnv%02x.bin", rom_ver);
 			break;
+		case QCA_QCA2066:
+			qca_generate_hsp_nvm_name(config.fwname,
+				sizeof(config.fwname), ver, rom_ver, boardid);
+			break;
 		case QCA_QCA6390:
 			snprintf(config.fwname, sizeof(config.fwname),
 				 "qca/htnv%02x.bin", rom_ver);

@@ -702,6 +769,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 
 	switch (soc_type) {
 	case QCA_WCN3991:
+	case QCA_QCA2066:
 	case QCA_QCA6390:
 	case QCA_WCN6750:
 	case QCA_WCN6855:

index 03bff5c0059de..dc31984f71dc1 100644
@@ -12,6 +12,7 @@
 #define EDL_PATCH_VER_REQ_CMD		(0x19)
 #define EDL_PATCH_TLV_REQ_CMD		(0x1E)
 #define EDL_GET_BUILD_INFO_CMD		(0x20)
+#define EDL_GET_BID_REQ_CMD			(0x23)
 #define EDL_NVM_ACCESS_SET_REQ_CMD	(0x01)
 #define EDL_PATCH_CONFIG_CMD		(0x28)
 #define MAX_SIZE_PER_TLV_SEGMENT	(243)

@@ -47,7 +48,8 @@
 	((le32_to_cpu(soc_id) << 16) | (le16_to_cpu(rom_ver)))
 
 #define QCA_FW_BUILD_VER_LEN		255
-
+#define QCA_HSP_GF_SOC_ID			0x1200
+#define QCA_HSP_GF_SOC_MASK			0x0000ff00
 
 enum qca_baudrate {
 	QCA_BAUDRATE_115200 	= 0,

@@ -146,6 +148,7 @@ enum qca_btsoc_type {
 	QCA_WCN3990,
 	QCA_WCN3998,
 	QCA_WCN3991,
+	QCA_QCA2066,
 	QCA_QCA6390,
 	QCA_WCN6750,
 	QCA_WCN6855,

index 410f146e3f671..cb825987e7f1a 100644
@@ -1845,6 +1845,10 @@ static int qca_setup(struct hci_uart *hu)
 	set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
 
 	switch (soc_type) {
+	case QCA_QCA2066:
+		soc_name = "qca2066";
+		break;
+
 	case QCA_WCN3988:
 	case QCA_WCN3990:
 	case QCA_WCN3991:

@@ -2043,6 +2047,11 @@ static const struct qca_device_data qca_soc_data_wcn3998 __maybe_unused = {
 	.num_vregs = 4,
 };
 
+static const struct qca_device_data qca_soc_data_qca2066 __maybe_unused = {
+	.soc_type = QCA_QCA2066,
+	.num_vregs = 0,
+};
+
 static const struct qca_device_data qca_soc_data_qca6390 __maybe_unused = {
 	.soc_type = QCA_QCA6390,
 	.num_vregs = 0,

@@ -2582,6 +2591,7 @@ static SIMPLE_DEV_PM_OPS(qca_pm_ops, qca_suspend, qca_resume);
 
 #ifdef CONFIG_OF
 static const struct of_device_id qca_bluetooth_of_match[] = {
+	{ .compatible = "qcom,qca2066-bt", .data = &qca_soc_data_qca2066},
 	{ .compatible = "qcom,qca6174-bt" },
 	{ .compatible = "qcom,qca6390-bt", .data = &qca_soc_data_qca6390},
 	{ .compatible = "qcom,qca9377-bt" },

@@ -2599,6 +2609,7 @@ MODULE_DEVICE_TABLE(of, qca_bluetooth_of_match);
 
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id qca_bluetooth_acpi_match[] = {
+	{ "QCOM2066", (kernel_ulong_t)&qca_soc_data_qca2066 },
 	{ "QCOM6390", (kernel_ulong_t)&qca_soc_data_qca6390 },
 	{ "DLA16390", (kernel_ulong_t)&qca_soc_data_qca6390 },
 	{ "DLB16390", (kernel_ulong_t)&qca_soc_data_qca6390 },

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Billy Tsai <[email protected]>

[ Upstream commit c10cd03d69403fa0f00be8631bd4cb4690440ebd ]

The register offset to disable the internal pull-down of GPIOR~T is 0x630 instead of 0x620, as specified in the Ast2600 datasheet v15 The datasheet can download from the official Aspeed website.

Message-ID: <[email protected]>

---
 drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 34 +++++++++++-----------
 1 file changed, 17 insertions(+), 17 deletions(-)

index 80838dc54b3ab..7938741136a2c 100644
@@ -43,7 +43,7 @@
 #define SCU614		0x614 /* Disable GPIO Internal Pull-Down #1 */
 #define SCU618		0x618 /* Disable GPIO Internal Pull-Down #2 */
 #define SCU61C		0x61c /* Disable GPIO Internal Pull-Down #3 */
-#define SCU620		0x620 /* Disable GPIO Internal Pull-Down #4 */
+#define SCU630		0x630 /* Disable GPIO Internal Pull-Down #4 */
 #define SCU634		0x634 /* Disable GPIO Internal Pull-Down #5 */
 #define SCU638		0x638 /* Disable GPIO Internal Pull-Down #6 */
 #define SCU690		0x690 /* Multi-function Pin Control #24 */

@@ -2494,38 +2494,38 @@ static struct aspeed_pin_config aspeed_g6_configs[] = {
 	ASPEED_PULL_DOWN_PINCONF(D14, SCU61C, 0),
 
 	/* GPIOS7 */
-	ASPEED_PULL_DOWN_PINCONF(T24, SCU620, 23),
+	ASPEED_PULL_DOWN_PINCONF(T24, SCU630, 23),
 	/* GPIOS6 */
-	ASPEED_PULL_DOWN_PINCONF(P23, SCU620, 22),
+	ASPEED_PULL_DOWN_PINCONF(P23, SCU630, 22),
 	/* GPIOS5 */
-	ASPEED_PULL_DOWN_PINCONF(P24, SCU620, 21),
+	ASPEED_PULL_DOWN_PINCONF(P24, SCU630, 21),
 	/* GPIOS4 */
-	ASPEED_PULL_DOWN_PINCONF(R26, SCU620, 20),
+	ASPEED_PULL_DOWN_PINCONF(R26, SCU630, 20),
 	/* GPIOS3*/
-	ASPEED_PULL_DOWN_PINCONF(R24, SCU620, 19),
+	ASPEED_PULL_DOWN_PINCONF(R24, SCU630, 19),
 	/* GPIOS2 */
-	ASPEED_PULL_DOWN_PINCONF(T26, SCU620, 18),
+	ASPEED_PULL_DOWN_PINCONF(T26, SCU630, 18),
 	/* GPIOS1 */
-	ASPEED_PULL_DOWN_PINCONF(T25, SCU620, 17),
+	ASPEED_PULL_DOWN_PINCONF(T25, SCU630, 17),
 	/* GPIOS0 */
-	ASPEED_PULL_DOWN_PINCONF(R23, SCU620, 16),
+	ASPEED_PULL_DOWN_PINCONF(R23, SCU630, 16),
 
 	/* GPIOR7 */
-	ASPEED_PULL_DOWN_PINCONF(U26, SCU620, 15),
+	ASPEED_PULL_DOWN_PINCONF(U26, SCU630, 15),
 	/* GPIOR6 */
-	ASPEED_PULL_DOWN_PINCONF(W26, SCU620, 14),
+	ASPEED_PULL_DOWN_PINCONF(W26, SCU630, 14),
 	/* GPIOR5 */
-	ASPEED_PULL_DOWN_PINCONF(T23, SCU620, 13),
+	ASPEED_PULL_DOWN_PINCONF(T23, SCU630, 13),
 	/* GPIOR4 */
-	ASPEED_PULL_DOWN_PINCONF(U25, SCU620, 12),
+	ASPEED_PULL_DOWN_PINCONF(U25, SCU630, 12),
 	/* GPIOR3*/
-	ASPEED_PULL_DOWN_PINCONF(V26, SCU620, 11),
+	ASPEED_PULL_DOWN_PINCONF(V26, SCU630, 11),
 	/* GPIOR2 */
-	ASPEED_PULL_DOWN_PINCONF(V24, SCU620, 10),
+	ASPEED_PULL_DOWN_PINCONF(V24, SCU630, 10),
 	/* GPIOR1 */
-	ASPEED_PULL_DOWN_PINCONF(U24, SCU620, 9),
+	ASPEED_PULL_DOWN_PINCONF(U24, SCU630, 9),
 	/* GPIOR0 */
-	ASPEED_PULL_DOWN_PINCONF(V25, SCU620, 8),
+	ASPEED_PULL_DOWN_PINCONF(V25, SCU630, 8),
 
 	/* GPIOX7 */
 	ASPEED_PULL_DOWN_PINCONF(AB10, SCU634, 31),

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jan Dakinevich <[email protected]>

[ Upstream commit 368a90e651faeeb7049a876599cf2b0d74954796 ]

Other pins have _a or _x suffix, but this one doesn't have any. Most likely this is a typo.

Message-ID: <[email protected]>

---
 drivers/pinctrl/meson/pinctrl-meson-a1.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index 79f5d753d7e1a..50a87d9618a8e 100644
@@ -250,7 +250,7 @@ static const unsigned int pdm_dclk_x_pins[]		= { GPIOX_10 };
 static const unsigned int pdm_din2_a_pins[]		= { GPIOA_6 };
 static const unsigned int pdm_din1_a_pins[]		= { GPIOA_7 };
 static const unsigned int pdm_din0_a_pins[]		= { GPIOA_8 };
-static const unsigned int pdm_dclk_pins[]		= { GPIOA_9 };
+static const unsigned int pdm_dclk_a_pins[]		= { GPIOA_9 };
 
 /* gen_clk */
 static const unsigned int gen_clk_x_pins[]		= { GPIOX_7 };

@@ -591,7 +591,7 @@ static struct meson_pmx_group meson_a1_periphs_groups[] = {
 	GROUP(pdm_din2_a,		3),
 	GROUP(pdm_din1_a,		3),
 	GROUP(pdm_din0_a,		3),
-	GROUP(pdm_dclk,			3),
+	GROUP(pdm_dclk_a,		3),
 	GROUP(pwm_c_a,			3),
 	GROUP(pwm_b_a,			3),
 

@@ -755,7 +755,7 @@ static const char * const spi_a_groups[] = {
 
 static const char * const pdm_groups[] = {
 	"pdm_din0_x", "pdm_din1_x", "pdm_din2_x", "pdm_dclk_x", "pdm_din2_a",
-	"pdm_din1_a", "pdm_din0_a", "pdm_dclk",
+	"pdm_din1_a", "pdm_din0_a", "pdm_dclk_a",
 };
 
 static const char * const gen_clk_groups[] = {

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

[ Upstream commit 5038a66dad0199de60e5671603ea6623eb9e5c79 ]

The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free.

The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.

Message-ID: <[email protected]>

---
 drivers/pinctrl/core.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

index 184ec92241ca8..9e7b3e6c79cb1 100644
@@ -2116,13 +2116,7 @@ int pinctrl_enable(struct pinctrl_dev *pctldev)
 
 	error = pinctrl_claim_hogs(pctldev);
 	if (error) {
-		dev_err(pctldev->dev, "could not claim hogs: %i\n",
-			error);
-		pinctrl_free_pindescs(pctldev, pctldev->desc->pins,
-				      pctldev->desc->npins);
-		mutex_destroy(&pctldev->mutex);
-		kfree(pctldev);
-
+		dev_err(pctldev->dev, "could not claim hogs: %i\n", error);
 		return error;
 	}
 

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chen-Yu Tsai <[email protected]>

[ Upstream commit 08f66a8edd08f6f7cfa769c81634b29a2b123908 ]

In the generic pin config library, readback of some options are handled differently compared to the setting of those options: the argument value is used to convey enable/disable of an option in the set path, but success or -EINVAL is used to convey if an option is enabled or disabled in the debugfs readback path.

PIN_CONFIG_INPUT_SCHMITT_ENABLE is one such option. Fix the readback of the option in the mediatek-paris library, so that the debugfs dump is not showing "input schmitt enabled" for pins that don't have it enabled.

Message-ID: <[email protected]>

---
 drivers/pinctrl/mediatek/pinctrl-paris.c | 2 ++
 1 file changed, 2 insertions(+)

index 33d6c3fb79080..ea60de040e0a0 100644
@@ -193,6 +193,8 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev,
 		}
 
 		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_SMT, &ret);
+		if (!ret)
+			err = -EINVAL;
 		break;
 	case PIN_CONFIG_DRIVE_STRENGTH:
 		if (!hw->soc->drive_get)

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chen-Yu Tsai <[email protected]>

[ Upstream commit c5d3b64c568a344e998830e0e94a7c04e372f89b ]

There is a misinterpretation of some of the PIN_CONFIG_* options in this driver library. PIN_CONFIG_OUTPUT_ENABLE should refer to a buffer or switch in the output direction of the electrical path. The MediaTek hardware does not have such a thing. The driver incorrectly maps this option to the GPIO function's direction.

Likewise, PIN_CONFIG_INPUT_ENABLE should refer to a buffer or switch in the input direction. The hardware does have such a mechanism, and is mapped to the IES bit. The driver however sets the direction in addition to the IES bit, which is incorrect. On readback, the IES bit isn't even considered.

Ironically, the driver does not support readback for PIN_CONFIG_OUTPUT, while its readback of PIN_CONFIG_{INPUT,OUTPUT}_ENABLE is what it should be doing for PIN_CONFIG_OUTPUT.

Rework support for these three options, so that PIN_CONFIG_OUTPUT_ENABLE is completely removed, PIN_CONFIG_INPUT_ENABLE is only linked to the IES bit, and PIN_CONFIG_OUTPUT is linked to the GPIO function's direction and output level.

Message-ID: <[email protected]>

---
 drivers/pinctrl/mediatek/pinctrl-paris.c | 38 +++++++-----------------
 1 file changed, 11 insertions(+), 27 deletions(-)

index ea60de040e0a0..9cd7fe3c3e0df 100644
@@ -165,20 +165,21 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev,
 		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_SR, &ret);
 		break;
 	case PIN_CONFIG_INPUT_ENABLE:
-	case PIN_CONFIG_OUTPUT_ENABLE:
+		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_IES, &ret);
+		if (!ret)
+			err = -EINVAL;
+		break;
+	case PIN_CONFIG_OUTPUT:
 		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_DIR, &ret);
 		if (err)
 			break;
-		/*     CONFIG     Current direction return value
-		 * -------------  ----------------- ----------------------
-		 * OUTPUT_ENABLE       output       1 (= HW value)
-		 *                     input        0 (= HW value)
-		 * INPUT_ENABLE        output       0 (= reverse HW value)
-		 *                     input        1 (= reverse HW value)
-		 */
-		if (param == PIN_CONFIG_INPUT_ENABLE)
-			ret = !ret;
 
+		if (!ret) {
+			err = -EINVAL;
+			break;
+		}
+
+		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_DO, &ret);
 		break;
 	case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
 		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_DIR, &ret);

@@ -283,26 +284,9 @@ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,
 			break;
 		err = hw->soc->bias_set_combo(hw, desc, 0, arg);
 		break;
-	case PIN_CONFIG_OUTPUT_ENABLE:
-		err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_SMT,
-				       MTK_DISABLE);
-		/* Keep set direction to consider the case that a GPIO pin
-		 *  does not have SMT control
-		 */
-		if (err != -ENOTSUPP)
-			break;
-
-		err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_DIR,
-				       MTK_OUTPUT);
-		break;
 	case PIN_CONFIG_INPUT_ENABLE:
 		/* regard all non-zero value as enable */
 		err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_IES, !!arg);
-		if (err)
-			break;
-
-		err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_DIR,
-				       MTK_INPUT);
 		break;
 	case PIN_CONFIG_SLEW_RATE:
 		/* regard all non-zero value as enable */

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

[ Upstream commit 2057a48d0dd00c6a2a94ded7df2bf1d3f2a4a0da ]

We want to be able to have our rpc stats handled in a per network namespace manner, so add an option to rpc_create_args to specify a different rpc_stats struct instead of using the one on the rpc_program.

Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")

---
 include/linux/sunrpc/clnt.h | 1 +
 net/sunrpc/clnt.c           | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

index e9d4377d03c6e..17d84b3ee8a01 100644
@@ -139,6 +139,7 @@ struct rpc_create_args {
 	const char		*servername;
 	const char		*nodename;
 	const struct rpc_program *program;
+	struct rpc_stat		*stats;
 	u32			prognumber;	/* overrides program->number */
 	u32			version;
 	rpc_authflavor_t	authflavor;

index 339dfc5b92246..f4d32cf2cd16a 100644
@@ -399,7 +399,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args,
 	clnt->cl_maxproc  = version->nrprocs;
 	clnt->cl_prog     = args->prognumber ? : program->number;
 	clnt->cl_vers     = version->number;
-	clnt->cl_stats    = program->stats;
+	clnt->cl_stats    = args->stats ? : program->stats;
 	clnt->cl_metrics  = rpc_alloc_iostats(clnt);
 	rpc_init_pipe_dir_head(&clnt->cl_pipedir_objects);
 	err = -ENOMEM;

@@ -685,6 +685,7 @@ struct rpc_clnt *rpc_clone_client(struct rpc_clnt *clnt)
 		.version	= clnt->cl_vers,
 		.authflavor	= clnt->cl_auth->au_flavor,
 		.cred		= clnt->cl_cred,
+		.stats		= clnt->cl_stats,
 	};
 	return __rpc_clone_client(&args, clnt);
 }

@@ -707,6 +708,7 @@ rpc_clone_client_set_auth(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
 		.version	= clnt->cl_vers,
 		.authflavor	= flavor,
 		.cred		= clnt->cl_cred,
+		.stats		= clnt->cl_stats,
 	};
 	return __rpc_clone_client(&args, clnt);
 }

@@ -1053,6 +1055,7 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old,
 		.version	= vers,
 		.authflavor	= old->cl_auth->au_flavor,
 		.cred		= old->cl_cred,
+		.stats		= old->cl_stats,
 	};
 	struct rpc_clnt *clnt;
 	int err;

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

[ Upstream commit d47151b79e3220e72ae323b8b8e9d6da20dc884e ]

We're using nfs mounts inside of containers in production and noticed that the nfs stats are not exposed in /proc. This is a problem for us as we use these stats for monitoring, and have to do this awkward bind mount from the main host into the container in order to get to these states.

Add the rpc_proc_register call to the pernet operations entry and exit points so these stats can be exposed inside of network namespaces.

Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")

---
 fs/nfs/inode.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

index e21c073158e5b..d7d937597001d 100644
@@ -2427,11 +2427,13 @@ EXPORT_SYMBOL_GPL(nfs_net_id);
 static int nfs_net_init(struct net *net)
 {
 	nfs_clients_init(net);
+	rpc_proc_register(net, &nfs_rpcstat);
 	return nfs_fs_proc_net_init(net);
 }
 
 static void nfs_net_exit(struct net *net)
 {
+	rpc_proc_unregister(net, "nfs");
 	nfs_fs_proc_net_exit(net);
 	nfs_clients_exit(net);
 }

@@ -2486,15 +2488,12 @@ static int __init init_nfs_fs(void)
 	if (err)
 		goto out1;
 
-	rpc_proc_register(&init_net, &nfs_rpcstat);
-
 	err = register_nfs_fs();
 	if (err)
 		goto out0;
 
 	return 0;
 out0:
-	rpc_proc_unregister(&init_net, "nfs");
 	nfs_destroy_directcache();
 out1:
 	nfs_destroy_writepagecache();

@@ -2524,7 +2523,6 @@ static void __exit exit_nfs_fs(void)
 	nfs_destroy_inodecache();
 	nfs_destroy_nfspagecache();
 	unregister_pernet_subsys(&nfs_net_ops);
-	rpc_proc_unregister(&init_net, "nfs");
 	unregister_nfs_fs();
 	nfs_fs_proc_exit();
 	nfsiod_stop();

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

[ Upstream commit 1548036ef1204df65ca5a16e8b199c858cb80075 ]

Now that we're exposing the rpc stats on a per-network namespace basis, move this struct into struct nfs_net and use that to make sure only the per-network namespace stats are exposed.

Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")

---
 fs/nfs/client.c   | 5 ++++-
 fs/nfs/inode.c    | 4 +++-
 fs/nfs/internal.h | 2 --
 fs/nfs/netns.h    | 2 ++
 4 files changed, 9 insertions(+), 4 deletions(-)

index 44eca51b28085..4d9249c99989f 100644
@@ -73,7 +73,6 @@ const struct rpc_program nfs_program = {
 	.number			= NFS_PROGRAM,
 	.nrvers			= ARRAY_SIZE(nfs_version),
 	.version		= nfs_version,
-	.stats			= &nfs_rpcstat,
 	.pipe_dir_name		= NFS_PIPE_DIRNAME,
 };
 

@@ -502,6 +501,7 @@ int nfs_create_rpc_client(struct nfs_client *clp,
 			  const struct nfs_client_initdata *cl_init,
 			  rpc_authflavor_t flavor)
 {
+	struct nfs_net		*nn = net_generic(clp->cl_net, nfs_net_id);
 	struct rpc_clnt		*clnt = NULL;
 	struct rpc_create_args args = {
 		.net		= clp->cl_net,

@@ -513,6 +513,7 @@ int nfs_create_rpc_client(struct nfs_client *clp,
 		.servername	= clp->cl_hostname,
 		.nodename	= cl_init->nodename,
 		.program	= &nfs_program,
+		.stats		= &nn->rpcstats,
 		.version	= clp->rpc_ops->version,
 		.authflavor	= flavor,
 		.cred		= cl_init->cred,

@@ -1175,6 +1176,8 @@ void nfs_clients_init(struct net *net)
 #endif
 	spin_lock_init(&nn->nfs_client_lock);
 	nn->boot_time = ktime_get_real();
+	memset(&nn->rpcstats, 0, sizeof(nn->rpcstats));
+	nn->rpcstats.program = &nfs_program;
 
 	nfs_netns_sysfs_setup(nn, net);
 }

index d7d937597001d..e26d892ff4f2d 100644
@@ -2426,8 +2426,10 @@ EXPORT_SYMBOL_GPL(nfs_net_id);
 
 static int nfs_net_init(struct net *net)
 {
+	struct nfs_net *nn = net_generic(net, nfs_net_id);
+
 	nfs_clients_init(net);
-	rpc_proc_register(net, &nfs_rpcstat);
+	rpc_proc_register(net, &nn->rpcstats);
 	return nfs_fs_proc_net_init(net);
 }
 

index b1fa81c9dff6f..c91bce41931fb 100644
@@ -449,8 +449,6 @@ int nfs_try_get_tree(struct fs_context *);
 int nfs_get_tree_common(struct fs_context *);
 void nfs_kill_super(struct super_block *);
 
-extern struct rpc_stat nfs_rpcstat;
-
 extern int __init register_nfs_fs(void);
 extern void __exit unregister_nfs_fs(void);
 extern bool nfs_sb_active(struct super_block *sb);

index c8374f74dce11..a68b21603ea9a 100644
@@ -9,6 +9,7 @@
 #include <linux/nfs4.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
+#include <linux/sunrpc/stats.h>
 
 struct bl_dev_msg {
 	int32_t status;

@@ -34,6 +35,7 @@ struct nfs_net {
 	struct nfs_netns_client *nfs_client;
 	spinlock_t nfs_client_lock;
 	ktime_t boot_time;
+	struct rpc_stat rpcstats;
 #ifdef CONFIG_PROC_FS
 	struct proc_dir_entry *proc_nfsfs;
 #endif

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vinod Koul <[email protected]>

[ Upstream commit afc89870ea677bd5a44516eb981f7a259b74280c ]

This reverts commit 22a9d9585812 ("dmaengine: pl330: issue_pending waits until WFP state") as it seems to cause regression in pl330 driver. Note the issue now exists in mainline so a fix to be done.

---
 drivers/dma/pl330.c | 3 ---
 1 file changed, 3 deletions(-)

index c29744bfdf2c2..3cf0b38387ae5 100644
@@ -1053,9 +1053,6 @@ static bool _trigger(struct pl330_thread *thrd)
 
 	thrd->req_running = idx;
 
-	if (desc->rqtype == DMA_MEM_TO_DEV || desc->rqtype == DMA_DEV_TO_MEM)
-		UNTIL(thrd, PL330_STATE_WFP);
-
 	return true;
 }
 

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kuniyuki Iwashima <[email protected]>

[ Upstream commit 24457f1be29f1e7042e50a7749f5c2dde8c433c8 ]

syzkaller reported a warning [0] triggered while destroying immature netns.

rpc_proc_register() was called in init_nfs_fs(), but its error has been ignored since at least the initial commit 1da177e4c3f4 ("Linux-2.6.12-rc2").

Recently, commit d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs in net namespaces") converted the procfs to per-netns and made the problem more visible.

Even when rpc_proc_register() fails, nfs_net_init() could succeed, and thus nfs_net_exit() will be called while destroying the netns.

Then, remove_proc_entry() will be called for non-existing proc directory and trigger the warning below.

Let's handle the error of rpc_proc_register() properly in nfs_net_init().

[0]:
name 'nfs'

WARNING: CPU: 1 PID: 1710 at fs/proc/generic.c:711 remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711
Modules linked in:
CPU: 1 PID: 1710 Comm: syz-executor.2 Not tainted 6.8.0-12822-gcd51db110a7e #12
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
RIP: 0010:remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711
Code: 41 5d 41 5e c3 e8 85 09 b5 ff 48 c7 c7 88 58 64 86 e8 09 0e 71 02 e8 74 09 b5 ff 4c 89 e6 48 c7 c7 de 1b 80 84 e8 c5 ad 97 ff <0f> 0b eb b1 e8 5c 09 b5 ff 48 c7 c7 88 58 64 86 e8 e0 0d 71 02 eb
RSP: 0018:ffffc9000c6d7ce0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8880422b8b00 RCX: ffffffff8110503c
RDX: ffff888030652f00 RSI: ffffffff81105045 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff81bb62cb R12: ffffffff84807ffc
R13: ffff88804ad6fcc0 R14: ffffffff84807ffc R15: ffffffff85741ff8
FS:  00007f30cfba8640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff51afe8000 CR3: 000000005a60a005 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <TASK>
 rpc_proc_unregister+0x64/0x70 net/sunrpc/stats.c:310
 nfs_net_exit+0x1c/0x30 fs/nfs/inode.c:2438
 ops_exit_list+0x62/0xb0 net/core/net_namespace.c:170
 setup_net+0x46c/0x660 net/core/net_namespace.c:372
 copy_net_ns+0x244/0x590 net/core/net_namespace.c:505
 create_new_namespaces+0x2ed/0x770 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xae/0x160 kernel/nsproxy.c:228
 ksys_unshare+0x342/0x760 kernel/fork.c:3322
 __do_sys_unshare kernel/fork.c:3393 [inline]
 __se_sys_unshare kernel/fork.c:3391 [inline]
 __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3391
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x4f/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x46/0x4e
RIP: 0033:0x7f30d0febe5d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48
RSP: 002b:00007f30cfba7cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f30d0febe5d
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c020600
RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 000000000000000b R14: 00007f30d104c530 R15: 0000000000000000
 </TASK>

---
 fs/nfs/inode.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

index e26d892ff4f2d..ca76b0b51b779 100644
@@ -2429,7 +2429,12 @@ static int nfs_net_init(struct net *net)
 	struct nfs_net *nn = net_generic(net, nfs_net_id);
 
 	nfs_clients_init(net);
-	rpc_proc_register(net, &nn->rpcstats);
+
+	if (!rpc_proc_register(net, &nn->rpcstats)) {
+		nfs_clients_exit(net);
+		return -ENOMEM;
+	}
+
 	return nfs_fs_proc_net_init(net);
 }
 

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hans de Goede <[email protected]>

[ Upstream commit fed6d9a8e6a60ecf6506d0ea004040fbaa109927 ]

For all the "score" pin-groups all the intel_pingroup-s to select the non GPIO function are re-used for byt_score_gpio_groups[].

But this is incorrect since a pin-group includes the mode setting, which for the non GPIO functions generally is 1, where as to select the GPIO function mode must be set to 0.

So the GPIO function needs separate intel_pingroup-s with their own mode value of 0.

Add a new PIN_GROUP_GPIO macro which adds a foo_gpio entry to each pin-group defined this way and update byt_score_gpio_groups[] to point to the new foo_gpio entries.

The "sus" usb_oc_grp usb_ulpi_grp and pcu_spi_grp pin-groups are special because these have a non 0 mode value to select the GPIO functions and these already have matching foo_gpio pin-groups, leave these are unchanged.

The pmu_clk "sus" groups added in commit 2f46d7f7e959 ("pinctrl: baytrail:
Add pinconf group + function for the pmu_clk") do need to use the new PIN_GROUP_GPIO macro.

---
 drivers/pinctrl/intel/pinctrl-baytrail.c | 74 ++++++++++++------------
 drivers/pinctrl/intel/pinctrl-intel.h    |  4 ++
 2 files changed, 42 insertions(+), 36 deletions(-)

index 95a8a3a22b2b4..0aaeb54a64765 100644
@@ -277,33 +277,33 @@ static const unsigned int byt_score_plt_clk5_pins[] = { 101 };
 static const unsigned int byt_score_smbus_pins[] = { 51, 52, 53 };
 
 static const struct intel_pingroup byt_score_groups[] = {
-	PIN_GROUP("uart1_grp", byt_score_uart1_pins, 1),
-	PIN_GROUP("uart2_grp", byt_score_uart2_pins, 1),
-	PIN_GROUP("pwm0_grp", byt_score_pwm0_pins, 1),
-	PIN_GROUP("pwm1_grp", byt_score_pwm1_pins, 1),
-	PIN_GROUP("ssp2_grp", byt_score_ssp2_pins, 1),
-	PIN_GROUP("sio_spi_grp", byt_score_sio_spi_pins, 1),
-	PIN_GROUP("i2c5_grp", byt_score_i2c5_pins, 1),
-	PIN_GROUP("i2c6_grp", byt_score_i2c6_pins, 1),
-	PIN_GROUP("i2c4_grp", byt_score_i2c4_pins, 1),
-	PIN_GROUP("i2c3_grp", byt_score_i2c3_pins, 1),
-	PIN_GROUP("i2c2_grp", byt_score_i2c2_pins, 1),
-	PIN_GROUP("i2c1_grp", byt_score_i2c1_pins, 1),
-	PIN_GROUP("i2c0_grp", byt_score_i2c0_pins, 1),
-	PIN_GROUP("ssp0_grp", byt_score_ssp0_pins, 1),
-	PIN_GROUP("ssp1_grp", byt_score_ssp1_pins, 1),
-	PIN_GROUP("sdcard_grp", byt_score_sdcard_pins, byt_score_sdcard_mux_values),
-	PIN_GROUP("sdio_grp", byt_score_sdio_pins, 1),
-	PIN_GROUP("emmc_grp", byt_score_emmc_pins, 1),
-	PIN_GROUP("lpc_grp", byt_score_ilb_lpc_pins, 1),
-	PIN_GROUP("sata_grp", byt_score_sata_pins, 1),
-	PIN_GROUP("plt_clk0_grp", byt_score_plt_clk0_pins, 1),
-	PIN_GROUP("plt_clk1_grp", byt_score_plt_clk1_pins, 1),
-	PIN_GROUP("plt_clk2_grp", byt_score_plt_clk2_pins, 1),
-	PIN_GROUP("plt_clk3_grp", byt_score_plt_clk3_pins, 1),
-	PIN_GROUP("plt_clk4_grp", byt_score_plt_clk4_pins, 1),
-	PIN_GROUP("plt_clk5_grp", byt_score_plt_clk5_pins, 1),
-	PIN_GROUP("smbus_grp", byt_score_smbus_pins, 1),
+	PIN_GROUP_GPIO("uart1_grp", byt_score_uart1_pins, 1),
+	PIN_GROUP_GPIO("uart2_grp", byt_score_uart2_pins, 1),
+	PIN_GROUP_GPIO("pwm0_grp", byt_score_pwm0_pins, 1),
+	PIN_GROUP_GPIO("pwm1_grp", byt_score_pwm1_pins, 1),
+	PIN_GROUP_GPIO("ssp2_grp", byt_score_ssp2_pins, 1),
+	PIN_GROUP_GPIO("sio_spi_grp", byt_score_sio_spi_pins, 1),
+	PIN_GROUP_GPIO("i2c5_grp", byt_score_i2c5_pins, 1),
+	PIN_GROUP_GPIO("i2c6_grp", byt_score_i2c6_pins, 1),
+	PIN_GROUP_GPIO("i2c4_grp", byt_score_i2c4_pins, 1),
+	PIN_GROUP_GPIO("i2c3_grp", byt_score_i2c3_pins, 1),
+	PIN_GROUP_GPIO("i2c2_grp", byt_score_i2c2_pins, 1),
+	PIN_GROUP_GPIO("i2c1_grp", byt_score_i2c1_pins, 1),
+	PIN_GROUP_GPIO("i2c0_grp", byt_score_i2c0_pins, 1),
+	PIN_GROUP_GPIO("ssp0_grp", byt_score_ssp0_pins, 1),
+	PIN_GROUP_GPIO("ssp1_grp", byt_score_ssp1_pins, 1),
+	PIN_GROUP_GPIO("sdcard_grp", byt_score_sdcard_pins, byt_score_sdcard_mux_values),
+	PIN_GROUP_GPIO("sdio_grp", byt_score_sdio_pins, 1),
+	PIN_GROUP_GPIO("emmc_grp", byt_score_emmc_pins, 1),
+	PIN_GROUP_GPIO("lpc_grp", byt_score_ilb_lpc_pins, 1),
+	PIN_GROUP_GPIO("sata_grp", byt_score_sata_pins, 1),
+	PIN_GROUP_GPIO("plt_clk0_grp", byt_score_plt_clk0_pins, 1),
+	PIN_GROUP_GPIO("plt_clk1_grp", byt_score_plt_clk1_pins, 1),
+	PIN_GROUP_GPIO("plt_clk2_grp", byt_score_plt_clk2_pins, 1),
+	PIN_GROUP_GPIO("plt_clk3_grp", byt_score_plt_clk3_pins, 1),
+	PIN_GROUP_GPIO("plt_clk4_grp", byt_score_plt_clk4_pins, 1),
+	PIN_GROUP_GPIO("plt_clk5_grp", byt_score_plt_clk5_pins, 1),
+	PIN_GROUP_GPIO("smbus_grp", byt_score_smbus_pins, 1),
 };
 
 static const char * const byt_score_uart_groups[] = {

@@ -331,12 +331,14 @@ static const char * const byt_score_plt_clk_groups[] = {
 };
 static const char * const byt_score_smbus_groups[] = { "smbus_grp" };
 static const char * const byt_score_gpio_groups[] = {
-	"uart1_grp", "uart2_grp", "pwm0_grp", "pwm1_grp", "ssp0_grp",
-	"ssp1_grp", "ssp2_grp", "sio_spi_grp", "i2c0_grp", "i2c1_grp",
-	"i2c2_grp", "i2c3_grp", "i2c4_grp", "i2c5_grp", "i2c6_grp",
-	"sdcard_grp", "sdio_grp", "emmc_grp", "lpc_grp", "sata_grp",
-	"plt_clk0_grp", "plt_clk1_grp", "plt_clk2_grp", "plt_clk3_grp",
-	"plt_clk4_grp", "plt_clk5_grp", "smbus_grp",
+	"uart1_grp_gpio", "uart2_grp_gpio", "pwm0_grp_gpio",
+	"pwm1_grp_gpio", "ssp0_grp_gpio", "ssp1_grp_gpio", "ssp2_grp_gpio",
+	"sio_spi_grp_gpio", "i2c0_grp_gpio", "i2c1_grp_gpio", "i2c2_grp_gpio",
+	"i2c3_grp_gpio", "i2c4_grp_gpio", "i2c5_grp_gpio", "i2c6_grp_gpio",
+	"sdcard_grp_gpio", "sdio_grp_gpio", "emmc_grp_gpio", "lpc_grp_gpio",
+	"sata_grp_gpio", "plt_clk0_grp_gpio", "plt_clk1_grp_gpio",
+	"plt_clk2_grp_gpio", "plt_clk3_grp_gpio", "plt_clk4_grp_gpio",
+	"plt_clk5_grp_gpio", "smbus_grp_gpio",
 };
 
 static const struct intel_function byt_score_functions[] = {

@@ -455,8 +457,8 @@ static const struct intel_pingroup byt_sus_groups[] = {
 	PIN_GROUP("usb_oc_grp_gpio", byt_sus_usb_over_current_pins, byt_sus_usb_over_current_gpio_mode_values),
 	PIN_GROUP("usb_ulpi_grp_gpio", byt_sus_usb_ulpi_pins, byt_sus_usb_ulpi_gpio_mode_values),
 	PIN_GROUP("pcu_spi_grp_gpio", byt_sus_pcu_spi_pins, byt_sus_pcu_spi_gpio_mode_values),
-	PIN_GROUP("pmu_clk1_grp", byt_sus_pmu_clk1_pins, 1),
-	PIN_GROUP("pmu_clk2_grp", byt_sus_pmu_clk2_pins, 1),
+	PIN_GROUP_GPIO("pmu_clk1_grp", byt_sus_pmu_clk1_pins, 1),
+	PIN_GROUP_GPIO("pmu_clk2_grp", byt_sus_pmu_clk2_pins, 1),
 };
 
 static const char * const byt_sus_usb_groups[] = {

@@ -468,7 +470,7 @@ static const char * const byt_sus_pmu_clk_groups[] = {
 };
 static const char * const byt_sus_gpio_groups[] = {
 	"usb_oc_grp_gpio", "usb_ulpi_grp_gpio", "pcu_spi_grp_gpio",
-	"pmu_clk1_grp", "pmu_clk2_grp",
+	"pmu_clk1_grp_gpio", "pmu_clk2_grp_gpio",
 };
 
 static const struct intel_function byt_sus_functions[] = {

index cee512f97b566..45216b9e852dc 100644
@@ -179,6 +179,10 @@ struct intel_community {
 		.modes = __builtin_choose_expr(__builtin_constant_p((m)), NULL, (m)),	\
 	}
 
+#define PIN_GROUP_GPIO(n, p, m)						\
+	 PIN_GROUP(n, p, m),						\
+	 PIN_GROUP(n "_gpio", p, 0)
+
 #define FUNCTION(n, g)							\
 	{								\
 		.func = PINCTRL_PINFUNCTION((n), (g), ARRAY_SIZE(g)),	\

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

[ Upstream commit 452d8950db3e839aba1bb13bc5378f4bac11fa04 ]

The rt9455_boost_voltage_values[] array is only used when USB PHY support is enabled, causing a W=1 warning otherwise:

drivers/power/supply/rt9455_charger.c:200:18: error: 'rt9455_boost_voltage_values' defined but not used [-Werror=unused-const-variable=]

Enclose the definition in the same #ifdef as the references to it.

---
 drivers/power/supply/rt9455_charger.c | 2 ++
 1 file changed, 2 insertions(+)

index c345a77f9f78c..e4dbacd50a437 100644
@@ -192,6 +192,7 @@ static const int rt9455_voreg_values[] = {
 	4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000
 };
 
+#if IS_ENABLED(CONFIG_USB_PHY)
 /*
  * When the charger is in boost mode, REG02[7:2] represent boost output
  * voltage.

@@ -207,6 +208,7 @@ static const int rt9455_boost_voltage_values[] = {
 	5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000,
 	5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000,
 };
+#endif
 
 /* REG07[3:0] (VMREG) in uV */
 static const int rt9455_vmreg_values[] = {

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email protected]>

[ Upstream commit 1e0fb113646182e073539db96016b00cfeb18ecc ]

The of_match shall correspond to the name of the regulator subnode, or the deprecated regulator-compatible property must be used:
failing to do so, the regulator won't probe (and the driver will as well not probe).

Since the devicetree binding for this driver is actually correct and wants DTs to use the "usb-otg-vbus-regulator" subnode name, fix this driver by aligning the of_match string to what the DT binding wants.

---
 drivers/power/supply/mt6360_charger.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 1305cba61edd4..aca123783efcc 100644
@@ -588,7 +588,7 @@ static const struct regulator_ops mt6360_chg_otg_ops = {
 };
 
 static const struct regulator_desc mt6360_otg_rdesc = {
-	.of_match = "usb-otg-vbus",
+	.of_match = "usb-otg-vbus-regulator",
 	.name = "usb-otg-vbus",
 	.ops = &mt6360_chg_otg_ops,
 	.owner = THIS_MODULE,

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rafał Miłecki <[email protected]>

[ Upstream commit 2cc3b37f5b6df8189d55d0e812d9658ce256dfec ]

Binding for fixed NVMEM cells defined directly as NVMEM device subnodes has been deprecated. It has been replaced by the "fixed-layout" NVMEM layout binding.

New syntax is meant to be clearer and should help avoiding imprecise bindings.

NVMEM subsystem already supports the new binding. It should be a good idea to limit support for old syntax to existing drivers that actually support & use it (we can't break backward compatibility!). That way we additionally encourage new bindings & drivers to ignore deprecated binding.

It wasn't clear (to me) if rtc and w1 code actually uses old syntax fixed cells. I enabled them to don't risk any breakage.

Stable-dep-of: d2d73a6dd173 ("mtd: limit OTP NVMEM cell parse to non-NAND devices")

---
 drivers/mtd/mtdcore.c          | 2 ++
 drivers/nvmem/apple-efuses.c   | 1 +
 drivers/nvmem/core.c           | 8 +++++---
 drivers/nvmem/imx-ocotp-scu.c  | 1 +
 drivers/nvmem/imx-ocotp.c      | 1 +
 drivers/nvmem/meson-efuse.c    | 1 +
 drivers/nvmem/meson-mx-efuse.c | 1 +
 drivers/nvmem/microchip-otpc.c | 1 +
 drivers/nvmem/mtk-efuse.c      | 1 +
 drivers/nvmem/qcom-spmi-sdam.c | 1 +
 drivers/nvmem/qfprom.c         | 1 +
 drivers/nvmem/rave-sp-eeprom.c | 1 +
 drivers/nvmem/rockchip-efuse.c | 1 +
 drivers/nvmem/sc27xx-efuse.c   | 1 +
 drivers/nvmem/sec-qfprom.c     | 1 +
 drivers/nvmem/sprd-efuse.c     | 1 +
 drivers/nvmem/stm32-romem.c    | 1 +
 drivers/nvmem/sunplus-ocotp.c  | 1 +
 drivers/nvmem/sunxi_sid.c      | 1 +
 drivers/nvmem/uniphier-efuse.c | 1 +
 drivers/nvmem/zynqmp_nvmem.c   | 1 +
 drivers/rtc/nvmem.c            | 1 +
 drivers/w1/slaves/w1_ds250x.c  | 1 +
 include/linux/nvmem-provider.h | 2 ++
 24 files changed, 30 insertions(+), 3 deletions(-)

index 9bd661be3ae93..fbf60d1364f0d 100644
@@ -552,6 +552,7 @@ static int mtd_nvmem_add(struct mtd_info *mtd)
 	config.dev = &mtd->dev;
 	config.name = dev_name(&mtd->dev);
 	config.owner = THIS_MODULE;
+	config.add_legacy_fixed_of_cells = of_device_is_compatible(node, "nvmem-cells");
 	config.reg_read = mtd_nvmem_reg_read;
 	config.size = mtd->size;
 	config.word_size = 1;

@@ -898,6 +899,7 @@ static struct nvmem_device *mtd_otp_nvmem_register(struct mtd_info *mtd,
 	config.name = compatible;
 	config.id = NVMEM_DEVID_AUTO;
 	config.owner = THIS_MODULE;
+	config.add_legacy_fixed_of_cells = true;
 	config.type = NVMEM_TYPE_OTP;
 	config.root_only = true;
 	config.ignore_wp = true;

index 9b7c871021043..d3d49d22338b3 100644
@@ -36,6 +36,7 @@ static int apple_efuses_probe(struct platform_device *pdev)
 	struct resource *res;
 	struct nvmem_config config = {
 		.dev = &pdev->dev,
+		.add_legacy_fixed_of_cells = true,
 		.read_only = true,
 		.reg_read = apple_efuses_read,
 		.stride = sizeof(u32),

index 5b3955ad40534..e26f79a132bb5 100644
@@ -1003,9 +1003,11 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config)
 	if (rval)
 		goto err_remove_cells;
 
-	rval = nvmem_add_cells_from_legacy_of(nvmem);
-	if (rval)
-		goto err_remove_cells;
+	if (config->add_legacy_fixed_of_cells) {
+		rval = nvmem_add_cells_from_legacy_of(nvmem);
+		if (rval)
+			goto err_remove_cells;
+	}
 
 	rval = nvmem_add_cells_from_fixed_layout(nvmem);
 	if (rval)

index c38d9c1c3f486..517d83e11af2c 100644
@@ -220,6 +220,7 @@ static int imx_scu_ocotp_write(void *context, unsigned int offset,
 
 static struct nvmem_config imx_scu_ocotp_nvmem_config = {
 	.name = "imx-scu-ocotp",
+	.add_legacy_fixed_of_cells = true,
 	.read_only = false,
 	.word_size = 4,
 	.stride = 1,

index e8b6f194925df..f1e202efaa497 100644
@@ -615,6 +615,7 @@ static int imx_ocotp_probe(struct platform_device *pdev)
 		return PTR_ERR(priv->clk);
 
 	priv->params = of_device_get_match_data(&pdev->dev);
+	imx_ocotp_nvmem_config.add_legacy_fixed_of_cells = true;
 	imx_ocotp_nvmem_config.size = 4 * priv->params->nregs;
 	imx_ocotp_nvmem_config.dev = dev;
 	imx_ocotp_nvmem_config.priv = priv;

index ba2714bef8d0e..33678d0af2c24 100644
@@ -74,6 +74,7 @@ static int meson_efuse_probe(struct platform_device *pdev)
 
 	econfig->dev = dev;
 	econfig->name = dev_name(dev);
+	econfig->add_legacy_fixed_of_cells = true;
 	econfig->stride = 1;
 	econfig->word_size = 1;
 	econfig->reg_read = meson_efuse_read;

index d6d7aeda31f92..3ff04d5ca8f85 100644
@@ -210,6 +210,7 @@ static int meson_mx_efuse_probe(struct platform_device *pdev)
 	efuse->config.owner = THIS_MODULE;
 	efuse->config.dev = &pdev->dev;
 	efuse->config.priv = efuse;
+	efuse->config.add_legacy_fixed_of_cells = true;
 	efuse->config.stride = drvdata->word_size;
 	efuse->config.word_size = drvdata->word_size;
 	efuse->config.size = SZ_512;

index 436e0dc4f3375..7cf81738a3e0a 100644
@@ -261,6 +261,7 @@ static int mchp_otpc_probe(struct platform_device *pdev)
 		return ret;
 
 	mchp_nvmem_config.dev = otpc->dev;
+	mchp_nvmem_config.add_legacy_fixed_of_cells = true;
 	mchp_nvmem_config.size = size;
 	mchp_nvmem_config.priv = otpc;
 	nvmem = devm_nvmem_register(&pdev->dev, &mchp_nvmem_config);

index b36cd0dcc8c7f..87c94686cfd21 100644
@@ -83,6 +83,7 @@ static int mtk_efuse_probe(struct platform_device *pdev)
 		return PTR_ERR(priv->base);
 
 	pdata = device_get_match_data(dev);
+	econfig.add_legacy_fixed_of_cells = true;
 	econfig.stride = 1;
 	econfig.word_size = 1;
 	econfig.reg_read = mtk_reg_read;

index 70f2d4f2efbf1..9aa8f42faa4c9 100644
@@ -142,6 +142,7 @@ static int sdam_probe(struct platform_device *pdev)
 	sdam->sdam_config.name = "spmi_sdam";
 	sdam->sdam_config.id = NVMEM_DEVID_AUTO;
 	sdam->sdam_config.owner = THIS_MODULE;
+	sdam->sdam_config.add_legacy_fixed_of_cells = true;
 	sdam->sdam_config.stride = 1;
 	sdam->sdam_config.word_size = 1;
 	sdam->sdam_config.reg_read = sdam_read;

index 14814cba2dd65..6c554040c6e67 100644
@@ -357,6 +357,7 @@ static int qfprom_probe(struct platform_device *pdev)
 {
 	struct nvmem_config econfig = {
 		.name = "qfprom",
+		.add_legacy_fixed_of_cells = true,
 		.stride = 1,
 		.word_size = 1,
 		.id = NVMEM_DEVID_AUTO,

index df6a1c594b781..9ecf3873cbb76 100644
@@ -328,6 +328,7 @@ static int rave_sp_eeprom_probe(struct platform_device *pdev)
 	of_property_read_string(np, "zii,eeprom-name", &config.name);
 	config.priv		= eeprom;
 	config.dev		= dev;
+	config.add_legacy_fixed_of_cells	= true;
 	config.size		= size;
 	config.reg_read		= rave_sp_eeprom_reg_read;
 	config.reg_write	= rave_sp_eeprom_reg_write;

index 4004c5bece423..2b40978ddb18c 100644
@@ -205,6 +205,7 @@ static int rockchip_rk3399_efuse_read(void *context, unsigned int offset,
 
 static struct nvmem_config econfig = {
 	.name = "rockchip-efuse",
+	.add_legacy_fixed_of_cells = true,
 	.stride = 1,
 	.word_size = 1,
 	.read_only = true,

index 2210da40dfbd7..bff27011f4ff2 100644
@@ -247,6 +247,7 @@ static int sc27xx_efuse_probe(struct platform_device *pdev)
 	econfig.reg_read = sc27xx_efuse_read;
 	econfig.priv = efuse;
 	econfig.dev = &pdev->dev;
+	econfig.add_legacy_fixed_of_cells = true;
 	nvmem = devm_nvmem_register(&pdev->dev, &econfig);
 	if (IS_ERR(nvmem)) {
 		dev_err(&pdev->dev, "failed to register nvmem config\n");

index e48c2dc0c44b3..19799b3fe00aa 100644
@@ -47,6 +47,7 @@ static int sec_qfprom_probe(struct platform_device *pdev)
 {
 	struct nvmem_config econfig = {
 		.name = "sec-qfprom",
+		.add_legacy_fixed_of_cells = true,
 		.stride = 1,
 		.word_size = 1,
 		.id = NVMEM_DEVID_AUTO,

index 7e6e31db4baae..bb3105f3291fc 100644
@@ -408,6 +408,7 @@ static int sprd_efuse_probe(struct platform_device *pdev)
 	econfig.read_only = false;
 	econfig.name = "sprd-efuse";
 	econfig.size = efuse->data->blk_nums * SPRD_EFUSE_BLOCK_WIDTH;
+	econfig.add_legacy_fixed_of_cells = true;
 	econfig.reg_read = sprd_efuse_read;
 	econfig.reg_write = sprd_efuse_write;
 	econfig.priv = efuse;

index 0f84044bd1ade..1541c20709d25 100644
@@ -207,6 +207,7 @@ static int stm32_romem_probe(struct platform_device *pdev)
 	priv->cfg.priv = priv;
 	priv->cfg.owner = THIS_MODULE;
 	priv->cfg.type = NVMEM_TYPE_OTP;
+	priv->cfg.add_legacy_fixed_of_cells = true;
 
 	priv->lower = 0;
 

index f3a18aa0a6c73..38f5d9df39cd5 100644
@@ -145,6 +145,7 @@ static int sp_ocotp_read(void *priv, unsigned int offset, void *value, size_t by
 
 static struct nvmem_config sp_ocotp_nvmem_config = {
 	.name = "sp-ocotp",
+	.add_legacy_fixed_of_cells = true,
 	.read_only = true,
 	.word_size = 1,
 	.size = QAC628_OTP_SIZE,

index 5d364d85347fc..ba14a76208ab6 100644
@@ -153,6 +153,7 @@ static int sunxi_sid_probe(struct platform_device *pdev)
 	nvmem_cfg->dev = dev;
 	nvmem_cfg->name = "sunxi-sid";
 	nvmem_cfg->type = NVMEM_TYPE_OTP;
+	nvmem_cfg->add_legacy_fixed_of_cells = true;
 	nvmem_cfg->read_only = true;
 	nvmem_cfg->size = cfg->size;
 	nvmem_cfg->word_size = 1;

index 0a1dbb80537ec..6ad3295d31951 100644
@@ -52,6 +52,7 @@ static int uniphier_efuse_probe(struct platform_device *pdev)
 	econfig.size = resource_size(res);
 	econfig.priv = priv;
 	econfig.dev = dev;
+	econfig.add_legacy_fixed_of_cells = true;
 	nvmem = devm_nvmem_register(dev, &econfig);
 
 	return PTR_ERR_OR_ZERO(nvmem);

index f49bb9a26d053..7f15aa89a9d09 100644
@@ -58,6 +58,7 @@ static int zynqmp_nvmem_probe(struct platform_device *pdev)
 
 	priv->dev = dev;
 	econfig.dev = dev;
+	econfig.add_legacy_fixed_of_cells = true;
 	econfig.reg_read = zynqmp_nvmem_read;
 	econfig.priv = priv;
 

index 07ede21cee347..37df7e80525b4 100644
@@ -21,6 +21,7 @@ int devm_rtc_nvmem_register(struct rtc_device *rtc,
 
 	nvmem_config->dev = dev;
 	nvmem_config->owner = rtc->owner;
+	nvmem_config->add_legacy_fixed_of_cells = true;
 	nvmem = devm_nvmem_register(dev, nvmem_config);
 	if (IS_ERR(nvmem))
 		dev_err(dev, "failed to register nvmem device for RTC\n");

index 7592c7050d1d7..cb426f7dd23d4 100644
@@ -168,6 +168,7 @@ static int w1_eprom_add_slave(struct w1_slave *sl)
 	struct nvmem_device *nvmem;
 	struct nvmem_config nvmem_cfg = {
 		.dev = &sl->dev,
+		.add_legacy_fixed_of_cells = true,
 		.reg_read = w1_nvmem_read,
 		.type = NVMEM_TYPE_OTP,
 		.read_only = true,

index dae26295e6bed..1b81adebdb8be 100644
@@ -82,6 +82,7 @@ struct nvmem_cell_info {
  * @owner:	Pointer to exporter module. Used for refcounting.
  * @cells:	Optional array of pre-defined NVMEM cells.
  * @ncells:	Number of elements in cells.
+ * @add_legacy_fixed_of_cells:	Read fixed NVMEM cells from old OF syntax.
  * @keepout:	Optional array of keepout ranges (sorted ascending by start).
  * @nkeepout:	Number of elements in the keepout array.
  * @type:	Type of the nvmem storage

@@ -112,6 +113,7 @@ struct nvmem_config {
 	struct module		*owner;
 	const struct nvmem_cell_info	*cells;
 	int			ncells;
+	bool			add_legacy_fixed_of_cells;
 	const struct nvmem_keepout *keepout;
 	unsigned int		nkeepout;
 	enum nvmem_type		type;

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Marangi <[email protected]>

[ Upstream commit d2d73a6dd17365c43e109263841f7c26da55cfb0 ]

MTD OTP logic is very fragile on parsing NVMEM cell and can be problematic with some specific kind of devices.

The problem was discovered by e87161321a40 ("mtd: rawnand: macronix:
OTP access for MX30LFxG18AC") where OTP support was added to a NAND device. With the case of NAND devices, it does require a node where ECC info are declared and all the fixed partitions, and this cause the OTP codepath to parse this node as OTP NVMEM cells, making probe fail and the NAND device registration fail.

MTD OTP parsing should have been limited to always using compatible to prevent this error by using node with compatible "otp-user" or "otp-factory".

NVMEM across the years had various iteration on how cells could be declared in DT, in some old implementation, no_of_node should have been enabled but now add_legacy_fixed_of_cells should be used to disable NVMEM to parse child node as NVMEM cell.

To fix this and limit any regression with other MTD that makes use of declaring OTP as direct child of the dev node, disable add_legacy_fixed_of_cells if we detect the MTD type is Nand.

With the following logic, the OTP NVMEM entry is correctly created with no cells and the MTD Nand is correctly probed and partitions are correctly exposed.

---
 drivers/mtd/mtdcore.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index fbf60d1364f0d..5c32208b17a1d 100644
@@ -899,7 +899,7 @@ static struct nvmem_device *mtd_otp_nvmem_register(struct mtd_info *mtd,
 	config.name = compatible;
 	config.id = NVMEM_DEVID_AUTO;
 	config.owner = THIS_MODULE;
-	config.add_legacy_fixed_of_cells = true;
+	config.add_legacy_fixed_of_cells = !mtd_type_is_nand(mtd);
 	config.type = NVMEM_TYPE_OTP;
 	config.root_only = true;
 	config.ignore_wp = true;

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Bertschinger <[email protected]>

[ Upstream commit 1b6170ff7a203a5e8354f19b7839fe8b897a9c0d ]

Currently Rust kernel modules have their init code placed in the .text section of the .ko file. I don't think this causes any real problems for Rust modules as long as all code called during initialization lives in .text.

However, if a Rust init_module() function (that lives in .text) calls a function marked with __init (in C) or #[link_section = ".init.text"] (in Rust), then a warning is generated by modpost because that function lives in .init.text. For example:

WARNING: modpost: fs/bcachefs/bcachefs: section mismatch in reference: init_module+0x6 (section: .text) -> _RNvXCsj7d3tFpT5JS_15bcachefs_moduleNtB2_8BcachefsNtCsjDtqRIL3JAG_6kernel6Module4init (section: .init.text)

I ran into this while experimenting with converting the bcachefs kernel module from C to Rust. The module's init(), written in Rust, calls C functions like bch2_vfs_init() which are placed in .init.text.

This patch places the macro-generated init_module() Rust function in the .init.text section. It also marks init_module() as unsafe--now it may not be called after module initialization completes because it may be freed already.

Note that this is not enough on its own to actually get all the module initialization code in that section. The module author must still add the #[link_section = ".init.text"] attribute to the Rust init() in the impl kernel::Module block in order to then call __init functions. However, this patch enables module authors do so, when previously it would not be possible (without warnings).

Stable-dep-of: 7044dcff8301 ("rust: macros: fix soundness issue in module! macro")

---
 rust/macros/module.rs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

index d62d8710d77ab..27979e582e4b9 100644
@@ -222,10 +222,15 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream {
             }};
 
             // Loadable modules need to export the `{{init,cleanup}}_module` identifiers.
+            /// # Safety
+            ///
+            /// This function must not be called after module initialization, because it may be
+            /// freed after that completes.
             #[cfg(MODULE)]
             #[doc(hidden)]
             #[no_mangle]
-            pub extern \"C\" fn init_module() -> core::ffi::c_int {{
+            #[link_section = \".init.text\"]
+            pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{
                 __init()
             }}
 

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Benno Lossin <[email protected]>

[ Upstream commit 7044dcff8301b29269016ebd17df27c4736140d2 ]

The module! macro creates glue code that are called by C to initialize the Rust modules using the Module::init function. Part of this glue code are the local functions __init and __exit that are used to initialize/destroy the Rust module.

These functions are safe and also visible to the Rust mod in which the module! macro is invoked. This means that they can be called by other safe Rust code. But since they contain unsafe blocks that rely on only being called at the right time, this is a soundness issue.

Wrap these generated functions inside of two private modules, this guarantees that the public functions cannot be called from the outside. Make the safe functions unsafe and add SAFETY comments.

[ Moved THIS_MODULE out of the private-in-private modules since it
should remain public, as Dirk Behme noticed [1]. Capitalized comments, avoided newline in non-list SAFETY comments and reworded to add Reported-by and newline. ]

---
 rust/macros/module.rs | 190 +++++++++++++++++++++++++-----------------
 1 file changed, 115 insertions(+), 75 deletions(-)

index 27979e582e4b9..acd0393b50957 100644
@@ -199,17 +199,6 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream {
             /// Used by the printing macros, e.g. [`info!`].
             const __LOG_PREFIX: &[u8] = b\"{name}\\0\";
 
-            /// The \"Rust loadable module\" mark.
-            //
-            // This may be best done another way later on, e.g. as a new modinfo
-            // key or a new section. For the moment, keep it simple.
-            #[cfg(MODULE)]
-            #[doc(hidden)]
-            #[used]
-            static __IS_RUST_MODULE: () = ();
-
-            static mut __MOD: Option<{type_}> = None;
-
             // SAFETY: `__this_module` is constructed by the kernel at load time and will not be
             // freed until the module is unloaded.
             #[cfg(MODULE)]

@@ -221,81 +210,132 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream {
                 kernel::ThisModule::from_ptr(core::ptr::null_mut())
             }};
 
-            // Loadable modules need to export the `{{init,cleanup}}_module` identifiers.
-            /// # Safety
-            ///
-            /// This function must not be called after module initialization, because it may be
-            /// freed after that completes.
-            #[cfg(MODULE)]
-            #[doc(hidden)]
-            #[no_mangle]
-            #[link_section = \".init.text\"]
-            pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{
-                __init()
-            }}
-
-            #[cfg(MODULE)]
-            #[doc(hidden)]
-            #[no_mangle]
-            pub extern \"C\" fn cleanup_module() {{
-                __exit()
-            }}
+            // Double nested modules, since then nobody can access the public items inside.
+            mod __module_init {{
+                mod __module_init {{
+                    use super::super::{type_};
+
+                    /// The \"Rust loadable module\" mark.
+                    //
+                    // This may be best done another way later on, e.g. as a new modinfo
+                    // key or a new section. For the moment, keep it simple.
+                    #[cfg(MODULE)]
+                    #[doc(hidden)]
+                    #[used]
+                    static __IS_RUST_MODULE: () = ();
+
+                    static mut __MOD: Option<{type_}> = None;
+
+                    // Loadable modules need to export the `{{init,cleanup}}_module` identifiers.
+                    /// # Safety
+                    ///
+                    /// This function must not be called after module initialization, because it may be
+                    /// freed after that completes.
+                    #[cfg(MODULE)]
+                    #[doc(hidden)]
+                    #[no_mangle]
+                    #[link_section = \".init.text\"]
+                    pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{
+                        // SAFETY: This function is inaccessible to the outside due to the double
+                        // module wrapping it. It is called exactly once by the C side via its
+                        // unique name.
+                        unsafe {{ __init() }}
+                    }}
 
-            // Built-in modules are initialized through an initcall pointer
-            // and the identifiers need to be unique.
-            #[cfg(not(MODULE))]
-            #[cfg(not(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS))]
-            #[doc(hidden)]
-            #[link_section = \"{initcall_section}\"]
-            #[used]
-            pub static __{name}_initcall: extern \"C\" fn() -> core::ffi::c_int = __{name}_init;
+                    #[cfg(MODULE)]
+                    #[doc(hidden)]
+                    #[no_mangle]
+                    pub extern \"C\" fn cleanup_module() {{
+                        // SAFETY:
+                        // - This function is inaccessible to the outside due to the double
+                        //   module wrapping it. It is called exactly once by the C side via its
+                        //   unique name,
+                        // - furthermore it is only called after `init_module` has returned `0`
+                        //   (which delegates to `__init`).
+                        unsafe {{ __exit() }}
+                    }}
 
-            #[cfg(not(MODULE))]
-            #[cfg(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)]
-            core::arch::global_asm!(
-                r#\".section \"{initcall_section}\", \"a\"
-                __{name}_initcall:
-                    .long   __{name}_init - .
-                    .previous
-                \"#
-            );
+                    // Built-in modules are initialized through an initcall pointer
+                    // and the identifiers need to be unique.
+                    #[cfg(not(MODULE))]
+                    #[cfg(not(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS))]
+                    #[doc(hidden)]
+                    #[link_section = \"{initcall_section}\"]
+                    #[used]
+                    pub static __{name}_initcall: extern \"C\" fn() -> core::ffi::c_int = __{name}_init;
+
+                    #[cfg(not(MODULE))]
+                    #[cfg(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)]
+                    core::arch::global_asm!(
+                        r#\".section \"{initcall_section}\", \"a\"
+                        __{name}_initcall:
+                            .long   __{name}_init - .
+                            .previous
+                        \"#
+                    );
+
+                    #[cfg(not(MODULE))]
+                    #[doc(hidden)]
+                    #[no_mangle]
+                    pub extern \"C\" fn __{name}_init() -> core::ffi::c_int {{
+                        // SAFETY: This function is inaccessible to the outside due to the double
+                        // module wrapping it. It is called exactly once by the C side via its
+                        // placement above in the initcall section.
+                        unsafe {{ __init() }}
+                    }}
 
-            #[cfg(not(MODULE))]
-            #[doc(hidden)]
-            #[no_mangle]
-            pub extern \"C\" fn __{name}_init() -> core::ffi::c_int {{
-                __init()
-            }}
+                    #[cfg(not(MODULE))]
+                    #[doc(hidden)]
+                    #[no_mangle]
+                    pub extern \"C\" fn __{name}_exit() {{
+                        // SAFETY:
+                        // - This function is inaccessible to the outside due to the double
+                        //   module wrapping it. It is called exactly once by the C side via its
+                        //   unique name,
+                        // - furthermore it is only called after `__{name}_init` has returned `0`
+                        //   (which delegates to `__init`).
+                        unsafe {{ __exit() }}
+                    }}
 
-            #[cfg(not(MODULE))]
-            #[doc(hidden)]
-            #[no_mangle]
-            pub extern \"C\" fn __{name}_exit() {{
-                __exit()
-            }}
+                    /// # Safety
+                    ///
+                    /// This function must only be called once.
+                    unsafe fn __init() -> core::ffi::c_int {{
+                        match <{type_} as kernel::Module>::init(&super::super::THIS_MODULE) {{
+                            Ok(m) => {{
+                                // SAFETY: No data race, since `__MOD` can only be accessed by this
+                                // module and there only `__init` and `__exit` access it. These
+                                // functions are only called once and `__exit` cannot be called
+                                // before or during `__init`.
+                                unsafe {{
+                                    __MOD = Some(m);
+                                }}
+                                return 0;
+                            }}
+                            Err(e) => {{
+                                return e.to_errno();
+                            }}
+                        }}
+                    }}
 
-            fn __init() -> core::ffi::c_int {{
-                match <{type_} as kernel::Module>::init(&THIS_MODULE) {{
-                    Ok(m) => {{
+                    /// # Safety
+                    ///
+                    /// This function must
+                    /// - only be called once,
+                    /// - be called after `__init` has been called and returned `0`.
+                    unsafe fn __exit() {{
+                        // SAFETY: No data race, since `__MOD` can only be accessed by this module
+                        // and there only `__init` and `__exit` access it. These functions are only
+                        // called once and `__init` was already called.
                         unsafe {{
-                            __MOD = Some(m);
+                            // Invokes `drop()` on `__MOD`, which should be used for cleanup.
+                            __MOD = None;
                         }}
-                        return 0;
-                    }}
-                    Err(e) => {{
-                        return e.to_errno();
                     }}
-                }}
-            }}
 
-            fn __exit() {{
-                unsafe {{
-                    // Invokes `drop()` on `__MOD`, which should be used for cleanup.
-                    __MOD = None;
+                    {modinfo}
                 }}
             }}
-
-            {modinfo}
         ",
         type_ = info.type_,
         name = info.name,

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Berg <[email protected]>

[ Upstream commit 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7 ]

If the parsing fails, we can dereference a NULL pointer here.

---
 net/wireless/nl80211.c | 2 ++
 1 file changed, 2 insertions(+)

index 9f6d8bcecfebe..c4f08f7eb741d 100644
@@ -14052,6 +14052,8 @@ static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
 error:
 	for (i = 0; i < new_coalesce.n_rules; i++) {
 		tmp_rule = &new_coalesce.rules[i];
+		if (!tmp_rule)
+			continue;
 		for (j = 0; j < tmp_rule->n_patterns; j++)
 			kfree(tmp_rule->patterns[j].mask);
 		kfree(tmp_rule->patterns);

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wedson Almeida Filho <[email protected]>

[ Upstream commit 323617f649c0966ad5e741e47e27e06d3a680d8f ]

The thread that calls the module initialisation code when a module is loaded is not guaranteed [in fact, it is unlikely] to be the same one that calls the module cleanup code on module unload, therefore, Module implementations must be Send to account for them moving from one thread to another implicitly.

---
 rust/kernel/lib.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index e8811700239aa..de54d5fede6f8 100644
@@ -60,7 +60,7 @@
 /// The top level entrypoint to implementing a kernel module.
 ///
 /// For any teardown or cleanup operations, your type may implement [`Drop`].
-pub trait Module: Sized + Sync {
+pub trait Module: Sized + Sync + Send {
     /// Called at module initialization time.
     ///
     /// Use this method to perform whatever setup or registration your module

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heiner Kallweit <[email protected]>

[ Upstream commit caba40ec3531b0849f44502a03117796e8c9f4a1 ]

The DDR3 SPD data structure advertises the presence of a thermal sensor on a DDR3 module in byte 32, bit 7. Let's use this information to explicitly instantiate the thermal sensor I2C client instead of having to rely on class-based I2C probing.

The temp sensor i2c address can be derived from the SPD i2c address, so we can directly instantiate the device and don't have to probe for it. If the temp sensor has been instantiated already by other means (e.g. class-based auto-detection), then the busy-check in i2c_new_client_device will detect this.

Note: Thermal sensors on DDR4 DIMM's are instantiated from the

      ee1004 driver.

Stable-dep-of: f42c97027fb7 ("eeprom: at24: fix memory corruption race condition")

---
 drivers/misc/eeprom/at24.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

index dbbf7db4ff2f4..e6d688817b106 100644
@@ -581,6 +581,31 @@ static unsigned int at24_get_offset_adj(u8 flags, unsigned int byte_len)
 	}
 }
 
+static void at24_probe_temp_sensor(struct i2c_client *client)
+{
+	struct at24_data *at24 = i2c_get_clientdata(client);
+	struct i2c_board_info info = { .type = "jc42" };
+	int ret;
+	u8 val;
+
+	/*
+	 * Byte 2 has value 11 for DDR3, earlier versions don't
+	 * support the thermal sensor present flag
+	 */
+	ret = at24_read(at24, 2, &val, 1);
+	if (ret || val != 11)
+		return;
+
+	/* Byte 32, bit 7 is set if temp sensor is present */
+	ret = at24_read(at24, 32, &val, 1);
+	if (ret || !(val & BIT(7)))
+		return;
+
+	info.addr = 0x18 | (client->addr & 7);
+
+	i2c_new_client_device(client->adapter, &info);
+}
+
 static int at24_probe(struct i2c_client *client)
 {
 	struct regmap_config regmap_config = { };

@@ -780,6 +805,10 @@ static int at24_probe(struct i2c_client *client)
 		}
 	}
 
+	/* If this a SPD EEPROM, probe for DDR3 thermal sensor */
+	if (cdata == &at24_data_spd)
+		at24_probe_temp_sensor(client);
+
 	pm_runtime_idle(dev);
 
 	if (writable)

2.43.0

This is the start of the stable review cycle for the 6.6.31 release. There are 301 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 16 May 2024 10:09:32 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.31-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.31-rc1

Johan Hovold <[email protected]>
Bluetooth: qca: fix firmware check error path

Johan Hovold <[email protected]>
Bluetooth: qca: fix info leak when fetching fw build id

Johan Hovold <[email protected]>
Bluetooth: qca: fix info leak when fetching board id

Johan Hovold <[email protected]>
Bluetooth: qca: generalise device address check

Johan Hovold <[email protected]>
Bluetooth: qca: fix NVM configuration parsing

Johan Hovold <[email protected]>
Bluetooth: qca: add missing firmware sanity checks

Johan Hovold <[email protected]>
Bluetooth: qca: fix wcn3991 device address check

Johan Hovold <[email protected]>
Bluetooth: qca: fix invalid device address check

Steven Rostedt (Google) <[email protected]>
eventfs: Do not treat events directory different than other directories

Steven Rostedt (Google) <[email protected]>
eventfs: Do not differentiate the toplevel events directory

Steven Rostedt (Google) <[email protected]>
tracefs: Still use mount point as default permissions for instances

Steven Rostedt (Google) <[email protected]>
tracefs: Reset permissions on remount if permissions are options

Namjae Jeon <[email protected]>
ksmbd: do not grant v2 lease if parent lease key and epoch are not set

Namjae Jeon <[email protected]>
ksmbd: avoid to send duplicate lease break notifications

Namjae Jeon <[email protected]>
ksmbd: off ipv6only for both ipv4/ipv6 binding

Conor Dooley <[email protected]>
spi: microchip-core-qspi: fix setting spi bus clock rate

Johan Hovold <[email protected]>
regulator: core: fix debugfs creation regression

Sean Anderson <[email protected]>
nvme-pci: Add quirk for broken MSIs

Peter Xu <[email protected]>
mm/userfaultfd: reset ptes when close() for wr-protected ones

Kefeng Wang <[email protected]>
mm: use memalloc_nofs_save() in page_cache_ra_order()

Michael Ellerman <[email protected]>
selftests/mm: fix powerpc ARCH check

Thomas Gleixner <[email protected]>
x86/apic: Don't access the APIC when disabling x2APIC

Lakshmi Yadlapati <[email protected]>

    hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us

Thadeu Lima de Souza Cascardo <[email protected]>
net: fix out-of-bounds access in ops_init

Volodymyr Babchuk <[email protected]>
arm64: dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration

Hersen Wu <[email protected]>
drm/amd/display: Fix incorrect DSC instance for MST

George Shen <[email protected]>
drm/amd/display: Handle Y carry-over in VCP X.Y calculation

Karthikeyan Ramasubramanian <[email protected]>
drm/i915/bios: Fix parsing backlight BDB data

Andi Shyti <[email protected]>
drm/i915/gt: Automate CCS Mode setting during engine resets

Chaitanya Kumar Borah <[email protected]>
drm/i915/audio: Fix audio time stamp programming for DP

Zack Rusin <[email protected]>
drm/vmwgfx: Fix invalid reads in fence signaled events

Ian Forbes <[email protected]>
drm/vmwgfx: Fix Legacy Display Unit

Zack Rusin <[email protected]>
drm/ttm: Print the memory decryption status just once

Alex Deucher <[email protected]>
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages

Dave Airlie <[email protected]>
Revert "drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()"

Lyude Paul <[email protected]>
drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()

Alexander Usyskin <[email protected]>
mei: me: add lunar lake point M DID

Frank Oltmanns <[email protected]>
clk: sunxi-ng: a64: Set minimum and maximum rate for PLL-MIPI

Frank Oltmanns <[email protected]>
clk: sunxi-ng: common: Support minimum and maximum rate

Viken Dadhaniya <[email protected]>
slimbus: qcom-ngd-ctrl: Add timeout for wait operation

Jim Cromie <[email protected]>
dyndbg: fix old BUG_ON in >control parser

Joao Paulo Goncalves <[email protected]>
ASoC: ti: davinci-mcasp: Fix race condition during probe

Sameer Pujar <[email protected]>
ASoC: tegra: Fix DSPK 16-bit playback

Doug Berger <[email protected]>
net: bcmgenet: synchronize UMAC_CMD access

Doug Berger <[email protected]>
net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()

Doug Berger <[email protected]>
net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access

Max Filippov <[email protected]>
xtensa: fix MAKE_PC_FROM_RA second argument

Paolo Abeni <[email protected]>
tipc: fix UAF in error path

Vitaly Lifshits <[email protected]>
e1000e: change usleep_range to udelay in PHY mdic access

Alexander Potapenko <[email protected]>
kmsan: compiler_types: declare __no_sanitize_or_inline

Hans de Goede <[email protected]>
iio: accel: mxc4005: Interrupt handling fixes

Vasileios Amoiridis <[email protected]>
iio: pressure: Fixes BME280 SPI driver data

Ramona Gradinariu <[email protected]>
iio:imu: adis16475: Fix sync mode setting

Javier Carrasco <[email protected]>
dt-bindings: iio: health: maxim,max30102: fix compatible check

Sven Schnelle <[email protected]>
workqueue: Fix selection of wake_cpu in kick_pool()

Gregory Detal <[email protected]>
mptcp: only allow set existing scheduler for net.mptcp.scheduler

Paolo Abeni <[email protected]>
mptcp: ensure snd_nxt is properly initialized on connect

Dan Carpenter <[email protected]>
mm/slab: make __free(kfree) accept error pointers

Liam R. Howlett <[email protected]>
maple_tree: fix mas_empty_area_rev() null pointer dereference

Qu Wenruo <[email protected]>
btrfs: set correct ram_bytes when splitting ordered extent

Dominique Martinet <[email protected]>
btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()

Takashi Sakamoto <[email protected]>
firewire: ohci: fulfill timestamp for some local asynchronous transaction

Aman Dhoot <[email protected]>
ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU

Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Check for port partner validity before consuming it

Amit Sunil Dhamne <[email protected]>
usb: typec: tcpm: unregister existing source caps before re-registration

RD Babiera <[email protected]>
usb: typec: tcpm: clear pd_event queue in PORT_RESET

Thinh Nguyen <[email protected]>
usb: dwc3: core: Prevent phy suspend during init

Thinh Nguyen <[email protected]>
usb: xhci-plat: Don't include xhci.h

Chris Wulff <[email protected]>
usb: gadget: f_fs: Fix a race condition when processing setup packets.

Wesley Cheng <[email protected]>
usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete

Ivan Avdeev <[email protected]>
usb: gadget: uvc: use correct buffer size when parsing configfs lists

Peter Korsgaard <[email protected]>
usb: gadget: composite: fix OS descriptors w_value logic

Alan Stern <[email protected]>
USB: core: Fix access violation during port device removal

Guenter Roeck <[email protected]>
usb: ohci: Prevent missed ohci interrupts

Alan Stern <[email protected]>
usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device

Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Fix connector check on init

Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Check for notifications after init

Linus Torvalds <[email protected]>
Reapply "drm/qxl: simplify qxl_fence_wait"

Thanassis Avgerinos <[email protected]>
firewire: nosy: ensure user_length is taken into account when fetching packet contents

Dmitry Antipov <[email protected]>
btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()

Christian König <[email protected]>
drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2

Michel Dänzer <[email protected]>
drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible

Gabe Teeger <[email protected]>
drm/amd/display: Atom Integrated System Info v2_2 for DCN35

Kent Gibson <[email protected]>
gpiolib: cdev: fix uninitialised kfifo

Kent Gibson <[email protected]>
gpiolib: cdev: relocate debounce_period_us from struct gpio_desc

Zhongqiu Han <[email protected]>
gpiolib: cdev: Fix use after free in lineinfo_changed_notify

Mario Limonciello <[email protected]>
dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users

Douglas Anderson <[email protected]>
drm/connector: Add \n to message about demoting connector force-probes

Jerome Brunet <[email protected]>
drm/meson: dw-hdmi: add bandgap setting for g12

Jerome Brunet <[email protected]>
drm/meson: dw-hdmi: power up phy on device init

Steffen Bätz <[email protected]>
net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family

Yonglong Liu <[email protected]>
net: hns3: fix kernel crash when devlink reload during initialization

Yonglong Liu <[email protected]>
net: hns3: fix port vlan filter not disabled issue

Peiyang Wang <[email protected]>
net: hns3: use appropriate barrier function after setting a bit value

Peiyang Wang <[email protected]>
net: hns3: release PTP resources if pf initialization failed

Peiyang Wang <[email protected]>
net: hns3: change type of numa_node_mask as nodemask_t

Jian Shen <[email protected]>
net: hns3: direct return when receive a unknown mailbox message

Peiyang Wang <[email protected]>
net: hns3: using user configure after hardware reset

Wen Gu <[email protected]>
net/smc: fix neighbour and rtable leak in smc_ib_find_route()

Eric Dumazet <[email protected]>
ipv6: prevent NULL dereference in ip6_output()

Eric Dumazet <[email protected]>
ipv6: annotate data-races around cnf.disable_ipv6

Lukasz Majewski <[email protected]>
hsr: Simplify code for announcing HSR nodes timer setup

Eric Dumazet <[email protected]>

    net-sysfs: convert dev->operstate reads to lockless ones

Eric Dumazet <[email protected]>
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()

Daniel Golle <[email protected]>
dt-bindings: net: mediatek: remove wrongly added clocks and SerDes

David Howells <[email protected]>
rxrpc: Only transmit one ACK per jumbo packet received

David Howells <[email protected]>
rxrpc: Fix congestion control algorithm

David Howells <[email protected]>
rxrpc: Fix the names of the fields in the ACK trailer struct

Ido Schimmel <[email protected]>
selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC

Hangbin Liu <[email protected]>
selftests/net: convert test_bridge_neigh_suppress.sh to run it in unique namespace

Shigeru Yoshida <[email protected]>
ipv6: Fix potential uninit-value access in __ip6_make_skb()

Felix Fietkau <[email protected]>
net: bridge: fix corrupted ethernet header on multicast-to-unicast

Tetsuo Handa <[email protected]>
nfc: nci: Fix kcov check in nci_rx_work()

Eric Dumazet <[email protected]>
phonet: fix rtm_phonet_notify() skb allocation

Aleksa Savic <[email protected]>

    hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock

Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event()

Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Use a separate buffer for sending commands

Roded Zats <[email protected]>
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

Marek Vasut <[email protected]>
net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs

Duoming Zhou <[email protected]>
Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout

Sungwoo Kim <[email protected]>
Bluetooth: HCI: Fix potential null-ptr-deref

Sungwoo Kim <[email protected]>
Bluetooth: msft: fix slab-use-after-free in msft_do_close()

Duoming Zhou <[email protected]>
Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout

Kuniyuki Iwashima <[email protected]>
tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().

Eric Dumazet <[email protected]>
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets

Boy.Wu <[email protected]>
ARM: 9381/1: kasan: clear stale stack poison

Paul Davey <[email protected]>
xfrm: Preserve vlan tags for transport mode software GRO

Al Viro <[email protected]>
qibfs: fix dentry leak

Olga Kornievskaia <[email protected]>
SUNRPC: add a missing rpc_stat for TCP TLS

Li Nan <[email protected]>
blk-iocost: do not WARN if iocg was already offlined

Vanillan Wang <[email protected]>
net:usb:qmi_wwan: support Rolling modules

Alex Deucher <[email protected]>
drm/radeon: silence UBSAN warning (v3)

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Add Granite Rapids-D to HPM CPU list

Lyude Paul <[email protected]>
drm/nouveau/dp: Don't probe eDP ports twice harder

Krzysztof Kozlowski <[email protected]>
gpio: lpc32xx: fix module autoloading

Joakim Sindholt <[email protected]>
fs/9p: drop inodes immediately on non-.L too

Stephen Boyd <[email protected]>
clk: Don't hold prepare_lock when calling kref_put()

Andy Shevchenko <[email protected]>
gpio: crystalcove: Use -ENOTSUPP consistently

Andy Shevchenko <[email protected]>
gpio: wcove: Use -ENOTSUPP consistently

Michael Ellerman <[email protected]>
powerpc/crypto/chacha-p10: Fix failure on non Power10

Jeff Layton <[email protected]>
9p: explicitly deny setlease attempts

Joakim Sindholt <[email protected]>
fs/9p: fix the cache always being enabled on files with qid flags

Joakim Sindholt <[email protected]>
fs/9p: translate O_TRUNC into OTRUNC

Joakim Sindholt <[email protected]>
fs/9p: only translate RWX permissions for plain 9P2000

Krzysztof Kozlowski <[email protected]>
iommu: mtk: fix module autoloading

Steve French <[email protected]>
smb3: fix broken reconnect when password changing on the server by allowing password rotation

Michael Kelley <[email protected]>
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted

Rick Edgecombe <[email protected]>
uio_hv_generic: Don't free decrypted memory

Rick Edgecombe <[email protected]>
hv_netvsc: Don't free decrypted memory

Rick Edgecombe <[email protected]>
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl

Rick Edgecombe <[email protected]>
Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails

John Stultz <[email protected]>
selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior

Zhigang Luo <[email protected]>
amd/amdkfd: sync all devices to wait all processes being evicted

Lijo Lazar <[email protected]>
drm/amdgpu: Fix VCN allocation in CPX partition

Alex Hung <[email protected]>
drm/amd/display: Skip on writeback when it's not applicable

Tao Zhou <[email protected]>
drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2

Lijo Lazar <[email protected]>
drm/amdgpu: Refine IB schedule error logging

Justin Ernst <[email protected]>
tools/power/turbostat: Fix uncore frequency file string

Jiaxun Yang <[email protected]>
MIPS: scall: Save thread_info.syscall unconditionally on entry

Thierry Reding <[email protected]>
gpu: host1x: Do not setup DMA for virtual devices

Rik van Riel <[email protected]>
blk-iocost: avoid out of bounds shift

Xiang Chen <[email protected]>
scsi: hisi_sas: Handle the NCQ error returned by D2H frame

Maurizio Lombardi <[email protected]>
scsi: target: Fix SELinux error when systemd-modules loads the target module

Wei Yang <[email protected]>
memblock tests: fix undefined reference to `BIT'

Wei Yang <[email protected]>
memblock tests: fix undefined reference to `panic'

Wei Yang <[email protected]>
memblock tests: fix undefined reference to `early_pfn_to_nid'

Boris Burkov <[email protected]>
btrfs: always clear PERTRANS metadata during commit

Boris Burkov <[email protected]>
btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve

Len Brown <[email protected]>
tools/power turbostat: Fix warning upon failed /dev/cpu_dma_latency read

Patryk Wlazlyn <[email protected]>
tools/power turbostat: Print ucode revision only if valid

Peng Liu <[email protected]>
tools/power turbostat: Fix Bzy_MHz documentation typo

Wyes Karny <[email protected]>
tools/power turbostat: Increase the limit for fd opened

Doug Smythies <[email protected]>
tools/power turbostat: Fix added raw MSR output

Adam Goldman <[email protected]>
firewire: ohci: mask bus reset interrupts between ISR and bottom half

Chen Ni <[email protected]>
ata: sata_gemini: Check clk_enable() result

Jeff Layton <[email protected]>
vboxsf: explicitly deny setlease attempts

Phil Elwell <[email protected]>
net: bcmgenet: Reset RBUF on first open

Li Nan <[email protected]>
block: fix overflow in blk_ioctl_discard()

Takashi Iwai <[email protected]>
ALSA: line6: Zero-initialize message buffers

Peter Wang <[email protected]>
scsi: ufs: core: Fix MCQ mode dev command timeout

Yihang Li <[email protected]>
scsi: libsas: Align SMP request allocation to ARCH_DMA_MINALIGN

Peter Wang <[email protected]>
scsi: ufs: core: WLUN suspend dev/link state error recovery

André Apitzsch <[email protected]>
regulator: tps65132: Add of_match table

Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend

Borislav Petkov (AMD) <[email protected]>
kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries

Mark Rutland <[email protected]>
selftests/ftrace: Fix event filter target_func selection

Andrei Matei <[email protected]>
bpf: Check bloom filter map value size

Jonathan Kim <[email protected]>
drm/amdkfd: range check cp bad op exception interrupts

Mukul Joshi <[email protected]>
drm/amdkfd: Check cgroup when returning DMABuf info

Anand Jain <[email protected]>
btrfs: return accurate error code on open failure in open_fs_devices()

Saurav Kashyap <[email protected]>
scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload

Shin'ichiro Kawasaki <[email protected]>
scsi: mpi3mr: Avoid memcpy field-spanning write WARNING

linke li <[email protected]>

    net: mark racy access on sk->sk_rcvbuf

Benjamin Berg <[email protected]>
wifi: iwlwifi: mvm: guard against invalid STA ID on removal

Johannes Berg <[email protected]>

    wifi: iwlwifi: read txq->read_ptr under lock

Johannes Berg <[email protected]>
wifi: mac80211: fix prep_connection error path

Igor Artemiev <[email protected]>
wifi: cfg80211: fix rdev_dump_mpp() arguments order

Jeff Johnson <[email protected]>

    wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc

Andrew Price <[email protected]>
gfs2: Fix invalid metadata access in punch_hole

Justin Tee <[email protected]>
scsi: lpfc: Use a dedicated lock for ras_fwlog state

Justin Tee <[email protected]>
scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()

Justin Tee <[email protected]>
scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()

Justin Tee <[email protected]>
scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic

Justin Tee <[email protected]>
scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling

Justin Tee <[email protected]>
scsi: lpfc: Move NPIV's transport unregistration to after resource clean up

Rohit Ner <[email protected]>
scsi: ufs: core: Fix MCQ MAC configuration

Oliver Upton <[email protected]>
KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()

Marc Zyngier <[email protected]>
KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id

Will Deacon <[email protected]>
swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y

Gaurav Batra <[email protected]>
powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE

Nayna Jain <[email protected]>
powerpc/pseries: make max polling consistent for longer H_CALLs

Jernej Skrabec <[email protected]>
clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change

Adam Skladowski <[email protected]>
clk: qcom: smd-rpm: Restore msm8976 num_clk

Richard Gobert <[email protected]>
net: gro: add flush check in udp_gro_receive_segment

Richard Gobert <[email protected]>
net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb

Richard Gobert <[email protected]>
net: gro: parse ipv6 ext headers without frag0 invalidation

Shigeru Yoshida <[email protected]>
ipv4: Fix uninit-value access in __ip_make_skb()

Andy Shevchenko <[email protected]>
drm/panel: ili9341: Use predefined error codes

Andy Shevchenko <[email protected]>
drm/panel: ili9341: Respect deferred probe

Andy Shevchenko <[email protected]>
drm/panel: ili9341: Correct use of device property APIs

Alexandra Winter <[email protected]>
s390/qeth: Fix kernel panic after setting hsuid

Guillaume Nault <[email protected]>
vxlan: Pull inner IP header in vxlan_rcv().

Xin Long <[email protected]>
tipc: fix a possible memleak in tipc_buf_append

Jeffrey Altman <[email protected]>
rxrpc: Clients must accept conn from any address

Felix Fietkau <[email protected]>
net: core: reject skb_copy(_expand) for fraglist GSO skbs

Felix Fietkau <[email protected]>
net: bridge: fix multicast-to-unicast with fraglist GSO

Mans Rullgard <[email protected]>
spi: fix null pointer dereference within spi_sync

Shashank Sharma <[email protected]>
drm/amdgpu: fix doorbell regression

Marek Behún <[email protected]>

    net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341

Sebastian Andrzej Siewior <[email protected]>
cxgb4: Properly lock TX queue for the selftest.

Bui Quang Minh <[email protected]>
s390/cio: Ensure the copied buf is NUL terminated

Pierre-Louis Bossart <[email protected]>
ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()

Jerome Brunet <[email protected]>
ASoC: meson: cards: select SND_DYNAMIC_MINORS

Jerome Brunet <[email protected]>
ASoC: meson: axg-tdm-interface: manage formatters in trigger

Jerome Brunet <[email protected]>
ASoC: meson: axg-card: make links nonatomic

Jerome Brunet <[email protected]>
ASoC: meson: axg-fifo: use threaded irq to check periods

Jerome Brunet <[email protected]>
ASoC: meson: axg-fifo: use FIELD helpers

Guillaume Nault <[email protected]>
vxlan: Add missing VNI filter counter update in arp_reduce().

Guillaume Nault <[email protected]>
vxlan: Fix racy device stats updates.

Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_actions()

Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_flow_attr() for flow_spec

Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_flow_attr() for flower

Asbjørn Sloth Tønnesen <[email protected]>
net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()

Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: fix E-MU dock initialization

Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: move the whole GPIO event handling to the workqueue

Oswald Buddenhagen <[email protected]>

    ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware()

Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: fix E-MU card dock presence monitoring

David Howells <[email protected]>
Fix a potential infinite loop in extract_user_to_sg()

Jens Remus <[email protected]>
s390/vdso: Add CFI for RA register to asm macro vdso_func

David Bauer <[email protected]>
net l2tp: drop flow hash on forward

Kuniyuki Iwashima <[email protected]>

    nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().

Bui Quang Minh <[email protected]>
octeontx2-af: avoid off-by-one read from userspace

Bui Quang Minh <[email protected]>
bna: ensure the copied buf is NUL terminated

Toke Høiland-Jørgensen <[email protected]>
xdp: use flags field to disambiguate broadcast redirect

Claudio Imbrenda <[email protected]>
s390/mm: Fix clearing storage keys for huge pages

Claudio Imbrenda <[email protected]>
s390/mm: Fix storage key clearing for guest huge pages

Srinivas Kandagatla <[email protected]>
ASoC: codecs: wsa881x: set clk_stop_mode1 flag

Amadeusz Sławiński <[email protected]>
ASoC: Intel: avs: Set name of control as in topology

Xu Kuohai <[email protected]>
riscv, bpf: Fix incorrect runtime stats

Xu Kuohai <[email protected]>
bpf, arm64: Fix incorrect runtime stats

Devyn Liu <[email protected]>
spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs

David Lechner <[email protected]>
spi: axi-spi-engine: fix version format string

David Lechner <[email protected]>
spi: axi-spi-engine: use common AXI macros

David Lechner <[email protected]>
spi: axi-spi-engine: move msg state to new struct

David Lechner <[email protected]>
spi: axi-spi-engine: use devm_spi_alloc_host()

David Lechner <[email protected]>
spi: axi-spi-engine: simplify driver data allocation

Li Zetao <[email protected]>
spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled()

Anton Protopopov <[email protected]>
bpf: Fix a verifier verbose message

Yi Zhang <[email protected]>
nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH

Pierre-Louis Bossart <[email protected]>
ASoC: SOF: Intel: add default firmware library path for LNL

Peter Ujfalusi <[email protected]>
ASoC: SOF: Introduce generic names for IPC types

Richard Fitzgerald <[email protected]>
regmap: Add regmap_read_bypassed()

Jason Xing <[email protected]>
bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue

Andrii Nakryiko <[email protected]>
bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition

Matti Vaittinen <[email protected]>
regulator: change devm_regulator_get_enable_optional() stub to return Ok

Matti Vaittinen <[email protected]>
regulator: change stubbed devm_regulator_get_enable to return Ok

AngeloGioacchino Del Regno <[email protected]>
regulator: mt6360: De-capitalize devicetree regulator subnodes

Zeng Heng <[email protected]>
pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()

AngeloGioacchino Del Regno <[email protected]>
power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator

Arnd Bergmann <[email protected]>
power: rt9455: hide unused rt9455_boost_voltage_values

Hans de Goede <[email protected]>
pinctrl: baytrail: Fix selecting gpio pinctrl state

Kuniyuki Iwashima <[email protected]>
nfs: Handle error of rpc_proc_register() in nfs_net_init().

Josef Bacik <[email protected]>
nfs: make the rpc_stat per net namespace

Josef Bacik <[email protected]>
nfs: expose /proc/net/sunrpc/nfs in net namespaces

Josef Bacik <[email protected]>
sunrpc: add a struct rpc_stats arg to rpc_create_args

Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE

Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback

Dan Carpenter <[email protected]>
pinctrl: core: delete incorrect free in pinctrl_enable()

Jan Dakinevich <[email protected]>
pinctrl/meson: fix typo in PDM's pin name

Billy Tsai <[email protected]>
pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T

Tim Jiang <[email protected]>
Bluetooth: qca: add support for QCA2066

Daniel Okazaki <[email protected]>
eeprom: at24: fix memory corruption race condition

Heiner Kallweit <[email protected]>
eeprom: at24: Probe for DDR3 thermal sensor in the SPD case

Wedson Almeida Filho <[email protected]>
rust: kernel: require Send for Module implementations

Johannes Berg <[email protected]>
wifi: nl80211: don't free NULL coalescing rule

Benno Lossin <[email protected]>
rust: macros: fix soundness issue in module! macro

Thomas Bertschinger <[email protected]>
rust: module: place generated init_module() function in .init.text

Christian Marangi <[email protected]>
mtd: limit OTP NVMEM cell parse to non-NAND devices

Rafał Miłecki <[email protected]>
nvmem: add explicit config option to read old syntax fixed OF cells

Vinod Koul <[email protected]>
dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"

Bumyong Lee <[email protected]>
dmaengine: pl330: issue_pending waits until WFP state

-------------

Diffstat:

 .../bindings/iio/health/maxim,max30102.yaml        |   2 +-
 .../devicetree/bindings/net/mediatek,net.yaml      |  22 +-
 Makefile                                           |   4 +-
 arch/arm/kernel/sleep.S                            |   4 +
 arch/arm64/boot/dts/qcom/sa8155p-adp.dts           |  30 +-
 arch/arm64/kvm/vgic/vgic-kvm-device.c              |  12 +-
 arch/arm64/net/bpf_jit_comp.c                      |   6 +-
 arch/mips/include/asm/ptrace.h                     |   2 +-
 arch/mips/kernel/asm-offsets.c                     |   1 +
 arch/mips/kernel/ptrace.c                          |  15 +-
 arch/mips/kernel/scall32-o32.S                     |  23 +-
 arch/mips/kernel/scall64-n32.S                     |   3 +-
 arch/mips/kernel/scall64-n64.S                     |   3 +-
 arch/mips/kernel/scall64-o32.S                     |  33 +-
 arch/powerpc/crypto/chacha-p10-glue.c              |   8 +-
 arch/powerpc/include/asm/plpks.h                   |   5 +-
 arch/powerpc/platforms/pseries/iommu.c             |   8 +
 arch/powerpc/platforms/pseries/plpks.c             |  10 +-
 arch/riscv/net/bpf_jit_comp64.c                    |   6 +-
 arch/s390/include/asm/dwarf.h                      |   1 +
 arch/s390/kernel/vdso64/vdso_user_wrapper.S        |   2 +
 arch/s390/mm/gmap.c                                |   2 +-
 arch/s390/mm/hugetlbpage.c                         |   2 +-
 arch/x86/kernel/apic/apic.c                        |  16 +-
 arch/xtensa/include/asm/processor.h                |   8 +-
 arch/xtensa/include/asm/ptrace.h                   |   2 +-
 arch/xtensa/kernel/process.c                       |   5 +-
 arch/xtensa/kernel/stacktrace.c                    |   3 +-
 block/blk-iocost.c                                 |  14 +-
 block/ioctl.c                                      |   5 +-
 drivers/ata/sata_gemini.c                          |   5 +-
 drivers/base/regmap/regmap.c                       |  37 +++
 drivers/bluetooth/btqca.c                          | 208 ++++++++++++-
 drivers/bluetooth/btqca.h                          |   8 +-
 drivers/bluetooth/hci_qca.c                        |  13 +-
 drivers/clk/clk.c                                  |  12 +-
 drivers/clk/qcom/clk-smd-rpm.c                     |   1 +
 drivers/clk/sunxi-ng/ccu-sun50i-a64.c              |   2 +
 drivers/clk/sunxi-ng/ccu-sun50i-h6.c               |  19 +-
 drivers/clk/sunxi-ng/ccu_common.c                  |  19 ++
 drivers/clk/sunxi-ng/ccu_common.h                  |   3 +
 drivers/firewire/nosy.c                            |   6 +-
 drivers/firewire/ohci.c                            |  14 +-
 drivers/gpio/gpio-crystalcove.c                    |   2 +-
 drivers/gpio/gpio-lpc32xx.c                        |   1 +
 drivers/gpio/gpio-wcove.c                          |   2 +-
 drivers/gpio/gpiolib-cdev.c                        | 181 +++++++++--
 drivers/gpu/drm/amd/amdgpu/amdgpu_job.c            |   7 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |  14 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.h         |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  56 ++--
 drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c         |  15 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c           |  16 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |  11 +-
 drivers/gpu/drm/amd/amdkfd/kfd_device.c            |  17 +-
 drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c   |   3 +-
 drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c   |   3 +-
 drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c    |   3 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  10 +
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  |  48 ++-
 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c |   1 +
 .../display/dc/dcn31/dcn31_hpo_dp_link_encoder.c   |   6 +
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c   |   2 +-
 drivers/gpu/drm/drm_connector.c                    |   2 +-
 drivers/gpu/drm/i915/display/intel_audio.c         | 113 +------
 drivers/gpu/drm/i915/display/intel_bios.c          |  19 +-
 drivers/gpu/drm/i915/display/intel_vbt_defs.h      |   5 -
 drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c        |   6 +-
 drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.h        |   2 +-
 drivers/gpu/drm/i915/gt/intel_workarounds.c        |   4 +-
 drivers/gpu/drm/meson/meson_dw_hdmi.c              |  70 ++---
 drivers/gpu/drm/nouveau/nouveau_dp.c               |  13 +-
 drivers/gpu/drm/panel/Kconfig                      |   2 +-
 drivers/gpu/drm/panel/panel-ilitek-ili9341.c       |  13 +-
 drivers/gpu/drm/qxl/qxl_release.c                  |  50 +---
 drivers/gpu/drm/radeon/pptable.h                   |  10 +-
 drivers/gpu/drm/ttm/ttm_tt.c                       |   2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_bo.c                 |   1 +
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c              |   2 +-
 drivers/gpu/host1x/bus.c                           |   8 -
 drivers/hv/channel.c                               |  29 +-
 drivers/hv/connection.c                            |  29 +-
 drivers/hwmon/corsair-cpro.c                       |  43 ++-
 drivers/hwmon/pmbus/ucd9000.c                      |   6 +-
 drivers/iio/accel/mxc4005.c                        |  24 +-
 drivers/iio/imu/adis16475.c                        |   4 +-
 drivers/iio/pressure/bmp280-spi.c                  |   4 +-
 drivers/infiniband/hw/qib/qib_fs.c                 |   1 +
 drivers/iommu/mtk_iommu.c                          |   1 +
 drivers/iommu/mtk_iommu_v1.c                       |   1 +
 drivers/misc/eeprom/at24.c                         |  47 ++-
 drivers/misc/mei/hw-me-regs.h                      |   2 +
 drivers/misc/mei/pci-me.c                          |   2 +
 drivers/mtd/mtdcore.c                              |   2 +
 drivers/net/dsa/mv88e6xxx/chip.c                   |  20 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |  32 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.h     |   4 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c |   8 +-
 drivers/net/ethernet/broadcom/genet/bcmmii.c       |   6 +-
 drivers/net/ethernet/brocade/bna/bnad_debugfs.c    |   4 +-
 drivers/net/ethernet/chelsio/cxgb4/sge.c           |   6 +-
 drivers/net/ethernet/hisilicon/hns3/hnae3.h        |   2 +-
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    |  52 ++--
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h    |   5 +-
 .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c |   7 +-
 .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c  |  20 +-
 .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h  |   2 +-
 drivers/net/ethernet/intel/e1000e/phy.c            |   8 +-
 .../ethernet/marvell/octeontx2/af/rvu_debugfs.c    |   4 +-
 drivers/net/ethernet/micrel/ks8851_common.c        |  16 +-
 drivers/net/ethernet/qlogic/qede/qede_filter.c     |  14 +-
 drivers/net/hyperv/netvsc.c                        |   7 +-
 drivers/net/usb/qmi_wwan.c                         |   1 +
 drivers/net/vxlan/vxlan_core.c                     |  49 ++-
 drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c   |   7 +-
 drivers/net/wireless/intel/iwlwifi/queue/tx.c      |   2 +-
 drivers/nvme/host/core.c                           |   2 +-
 drivers/nvme/host/nvme.h                           |   5 +
 drivers/nvme/host/pci.c                            |  14 +-
 drivers/nvmem/apple-efuses.c                       |   1 +
 drivers/nvmem/core.c                               |   8 +-
 drivers/nvmem/imx-ocotp-scu.c                      |   1 +
 drivers/nvmem/imx-ocotp.c                          |   1 +
 drivers/nvmem/meson-efuse.c                        |   1 +
 drivers/nvmem/meson-mx-efuse.c                     |   1 +
 drivers/nvmem/microchip-otpc.c                     |   1 +
 drivers/nvmem/mtk-efuse.c                          |   1 +
 drivers/nvmem/qcom-spmi-sdam.c                     |   1 +
 drivers/nvmem/qfprom.c                             |   1 +
 drivers/nvmem/rave-sp-eeprom.c                     |   1 +
 drivers/nvmem/rockchip-efuse.c                     |   1 +
 drivers/nvmem/sc27xx-efuse.c                       |   1 +
 drivers/nvmem/sec-qfprom.c                         |   1 +
 drivers/nvmem/sprd-efuse.c                         |   1 +
 drivers/nvmem/stm32-romem.c                        |   1 +
 drivers/nvmem/sunplus-ocotp.c                      |   1 +
 drivers/nvmem/sunxi_sid.c                          |   1 +
 drivers/nvmem/uniphier-efuse.c                     |   1 +
 drivers/nvmem/zynqmp_nvmem.c                       |   1 +
 drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c         |  34 +--
 drivers/pinctrl/core.c                             |   8 +-
 drivers/pinctrl/devicetree.c                       |  10 +-
 drivers/pinctrl/intel/pinctrl-baytrail.c           |  74 ++---
 drivers/pinctrl/intel/pinctrl-intel.h              |   4 +
 drivers/pinctrl/mediatek/pinctrl-paris.c           |  40 +--
 drivers/pinctrl/meson/pinctrl-meson-a1.c           |   6 +-
 .../x86/intel/speed_select_if/isst_if_common.c     |   1 +
 drivers/power/supply/mt6360_charger.c              |   2 +-
 drivers/power/supply/rt9455_charger.c              |   2 +
 drivers/regulator/core.c                           |  27 +-
 drivers/regulator/mt6360-regulator.c               |  32 +-
 drivers/regulator/tps65132-regulator.c             |   7 +
 drivers/rtc/nvmem.c                                |   1 +
 drivers/s390/cio/cio_inject.c                      |   2 +-
 drivers/s390/net/qeth_core_main.c                  |  69 ++---
 drivers/scsi/bnx2fc/bnx2fc_tgt.c                   |   2 -
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c             |  10 +-
 drivers/scsi/libsas/sas_expander.c                 |   2 +-
 drivers/scsi/lpfc/lpfc.h                           |   2 +-
 drivers/scsi/lpfc/lpfc_attr.c                      |   4 +-
 drivers/scsi/lpfc/lpfc_bsg.c                       |  20 +-
 drivers/scsi/lpfc/lpfc_debugfs.c                   |  12 +-
 drivers/scsi/lpfc/lpfc_els.c                       |  20 +-
 drivers/scsi/lpfc/lpfc_hbadisc.c                   |   5 +-
 drivers/scsi/lpfc/lpfc_init.c                      |   5 +-
 drivers/scsi/lpfc/lpfc_nvme.c                      |   4 +-
 drivers/scsi/lpfc/lpfc_scsi.c                      |  13 +-
 drivers/scsi/lpfc/lpfc_sli.c                       |  34 +--
 drivers/scsi/lpfc/lpfc_vport.c                     |   8 +-
 drivers/scsi/mpi3mr/mpi3mr_app.c                   |   2 +-
 drivers/slimbus/qcom-ngd-ctrl.c                    |   6 +-
 drivers/spi/spi-axi-spi-engine.c                   | 229 +++++++-------
 drivers/spi/spi-hisi-kunpeng.c                     |   2 -
 drivers/spi/spi-microchip-core-qspi.c              |   1 +
 drivers/spi/spi.c                                  |   1 +
 drivers/target/target_core_configfs.c              |  12 +
 drivers/ufs/core/ufs-mcq.c                         |   2 +-
 drivers/ufs/core/ufshcd.c                          |   9 +-
 drivers/uio/uio_hv_generic.c                       |  12 +-
 drivers/usb/core/hub.c                             |   5 +-
 drivers/usb/core/port.c                            |   8 +-
 drivers/usb/dwc3/core.c                            |  90 +++---
 drivers/usb/dwc3/core.h                            |   1 +
 drivers/usb/dwc3/gadget.c                          |   2 +
 drivers/usb/dwc3/host.c                            |  27 ++
 drivers/usb/gadget/composite.c                     |   6 +-
 drivers/usb/gadget/function/f_fs.c                 |   9 +-
 drivers/usb/gadget/function/uvc_configfs.c         |   4 +-
 drivers/usb/host/ohci-hcd.c                        |   8 +
 drivers/usb/host/xhci-plat.h                       |   4 +-
 drivers/usb/host/xhci-rzv2m.c                      |   1 +
 drivers/usb/typec/tcpm/tcpm.c                      |  36 ++-
 drivers/usb/typec/ucsi/ucsi.c                      |  12 +-
 drivers/w1/slaves/w1_ds250x.c                      |   1 +
 fs/9p/fid.h                                        |   3 -
 fs/9p/vfs_file.c                                   |   2 +
 fs/9p/vfs_inode.c                                  |   5 +-
 fs/9p/vfs_super.c                                  |   1 +
 fs/btrfs/inode.c                                   |   2 +-
 fs/btrfs/ordered-data.c                            |   1 +
 fs/btrfs/send.c                                    |   4 +-
 fs/btrfs/transaction.c                             |   2 +-
 fs/btrfs/volumes.c                                 |  18 +-
 fs/gfs2/bmap.c                                     |   5 +-
 fs/nfs/client.c                                    |   5 +-
 fs/nfs/inode.c                                     |  13 +-
 fs/nfs/internal.h                                  |   2 -
 fs/nfs/netns.h                                     |   2 +
 fs/smb/client/cifsglob.h                           |   1 +
 fs/smb/client/connect.c                            |   8 +
 fs/smb/client/fs_context.c                         |  21 ++
 fs/smb/client/fs_context.h                         |   2 +
 fs/smb/client/misc.c                               |   1 +
 fs/smb/client/smb2pdu.c                            |  11 +
 fs/smb/server/oplock.c                             |  35 ++-
 fs/smb/server/transport_tcp.c                      |   4 +
 fs/tracefs/event_inode.c                           |  74 ++---
 fs/tracefs/inode.c                                 |  92 +++++-
 fs/tracefs/internal.h                              |  14 +-
 fs/userfaultfd.c                                   |   4 +
 fs/vboxsf/file.c                                   |   1 +
 include/linux/compiler_types.h                     |  11 +
 include/linux/dma-fence.h                          |   7 -
 include/linux/gfp_types.h                          |   2 +
 include/linux/hyperv.h                             |   1 +
 include/linux/nvmem-provider.h                     |   2 +
 include/linux/regmap.h                             |   8 +
 include/linux/regulator/consumer.h                 |   4 +-
 include/linux/skbuff.h                             |  15 +
 include/linux/skmsg.h                              |   2 +
 include/linux/slab.h                               |   2 +-
 include/linux/sunrpc/clnt.h                        |   1 +
 include/net/gro.h                                  |   9 +
 include/net/xfrm.h                                 |   3 +
 include/sound/emu10k1.h                            |   3 +-
 include/sound/sof.h                                |   7 +-
 include/trace/events/rxrpc.h                       |   2 +-
 include/uapi/linux/kfd_ioctl.h                     |  17 +-
 include/uapi/scsi/scsi_bsg_mpi3mr.h                |   2 +-
 kernel/bpf/bloom_filter.c                          |  13 +
 kernel/bpf/verifier.c                              |   3 +-
 kernel/dma/swiotlb.c                               |   1 +
 kernel/workqueue.c                                 |   8 +-
 lib/Kconfig.debug                                  |   5 +-
 lib/dynamic_debug.c                                |   6 +-
 lib/maple_tree.c                                   |  16 +-
 lib/scatterlist.c                                  |   2 +-
 mm/readahead.c                                     |   4 +
 net/8021q/vlan_core.c                              |   2 +
 net/bluetooth/hci_core.c                           |   3 +-
 net/bluetooth/hci_event.c                          |   2 +
 net/bluetooth/l2cap_core.c                         |   3 +
 net/bluetooth/msft.c                               |   2 +-
 net/bluetooth/msft.h                               |   4 +-
 net/bluetooth/sco.c                                |   4 +
 net/bridge/br_forward.c                            |   9 +-
 net/bridge/br_netlink.c                            |   3 +-
 net/core/filter.c                                  |  42 ++-
 net/core/gro.c                                     |   1 +
 net/core/link_watch.c                              |   4 +-
 net/core/net-sysfs.c                               |   4 +-
 net/core/net_namespace.c                           |  13 +-
 net/core/rtnetlink.c                               |   6 +-
 net/core/skbuff.c                                  |  27 +-
 net/core/skmsg.c                                   |   5 +-
 net/core/sock.c                                    |   4 +-
 net/hsr/hsr_device.c                               |  31 +-
 net/ipv4/af_inet.c                                 |   1 +
 net/ipv4/ip_output.c                               |   2 +-
 net/ipv4/raw.c                                     |   3 +
 net/ipv4/tcp.c                                     |   4 +-
 net/ipv4/tcp_input.c                               |   2 +
 net/ipv4/tcp_ipv4.c                                |   8 +-
 net/ipv4/tcp_output.c                              |   4 +-
 net/ipv4/udp.c                                     |   3 +-
 net/ipv4/udp_offload.c                             |  15 +-
 net/ipv4/xfrm4_input.c                             |   6 +-
 net/ipv6/addrconf.c                                |  11 +-
 net/ipv6/fib6_rules.c                              |   6 +-
 net/ipv6/ip6_input.c                               |   4 +-
 net/ipv6/ip6_offload.c                             |  52 +++-
 net/ipv6/ip6_output.c                              |   4 +-
 net/ipv6/udp.c                                     |   3 +-
 net/ipv6/udp_offload.c                             |   3 +-
 net/ipv6/xfrm6_input.c                             |   6 +-
 net/l2tp/l2tp_eth.c                                |   3 +
 net/mac80211/ieee80211_i.h                         |   4 +-
 net/mac80211/mlme.c                                |   5 +-
 net/mptcp/ctrl.c                                   |  39 ++-
 net/mptcp/protocol.c                               |   3 +
 net/nfc/nci/core.c                                 |   1 +
 net/nsh/nsh.c                                      |  14 +-
 net/phonet/pn_netlink.c                            |   2 +-
 net/rxrpc/ar-internal.h                            |   2 +-
 net/rxrpc/call_object.c                            |   7 +-
 net/rxrpc/conn_event.c                             |  16 +-
 net/rxrpc/conn_object.c                            |   9 +-
 net/rxrpc/input.c                                  |  71 +++--
 net/rxrpc/output.c                                 |  14 +-
 net/rxrpc/protocol.h                               |   6 +-
 net/smc/smc_ib.c                                   |  19 +-
 net/sunrpc/clnt.c                                  |   5 +-
 net/sunrpc/xprtsock.c                              |   1 +
 net/tipc/msg.c                                     |   8 +-
 net/wireless/nl80211.c                             |   2 +
 net/wireless/trace.h                               |   2 +-
 net/xfrm/xfrm_input.c                              |   8 +
 rust/kernel/lib.rs                                 |   2 +-
 rust/macros/module.rs                              | 185 +++++++-----
 scripts/Makefile.modfinal                          |   2 +-
 sound/hda/intel-sdw-acpi.c                         |   2 +
 sound/pci/emu10k1/emu10k1.c                        |   3 +-
 sound/pci/emu10k1/emu10k1_main.c                   | 139 +++++----
 sound/pci/hda/patch_realtek.c                      |   1 +
 sound/soc/codecs/wsa881x.c                         |   1 +
 sound/soc/intel/avs/topology.c                     |   2 +
 sound/soc/meson/Kconfig                            |   1 +
 sound/soc/meson/axg-card.c                         |   1 +
 sound/soc/meson/axg-fifo.c                         |  56 ++--
 sound/soc/meson/axg-fifo.h                         |  12 +-
 sound/soc/meson/axg-frddr.c                        |   5 +-
 sound/soc/meson/axg-tdm-interface.c                |  34 ++-
 sound/soc/meson/axg-toddr.c                        |  22 +-
 sound/soc/sof/intel/hda-dsp.c                      |  20 +-
 sound/soc/sof/intel/pci-lnl.c                      |   3 +
 sound/soc/tegra/tegra186_dspk.c                    |   7 +-
 sound/soc/ti/davinci-mcasp.c                       |  12 +-
 sound/usb/line6/driver.c                           |   6 +-
 tools/include/linux/kernel.h                       |   1 +
 tools/include/linux/mm.h                           |   5 +
 tools/include/linux/panic.h                        |  19 ++
 tools/power/x86/turbostat/turbostat.8              |   2 +-
 tools/power/x86/turbostat/turbostat.c              |  45 ++-
 .../selftests/bpf/prog_tests/bloom_filter_map.c    |   6 +
 .../ftrace/test.d/filter/event-filter-function.tc  |   2 +-
 tools/testing/selftests/mm/Makefile                |   6 +-
 .../selftests/net/test_bridge_neigh_suppress.sh    | 333 ++++++++++-----------
 tools/testing/selftests/timers/valid-adjtimex.c    |  73 +++--
 338 files changed, 3043 insertions(+), 1798 deletions(-)

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email protected]>

[ Upstream commit d3cf8a17498dd9104c04ad28eeac3ef3339f9f9f ]

The MT6360 regulator binding, the example in the MT6360 mfd binding, and the devicetree users of those bindings are rightfully declaring MT6360 regulator subnodes with non-capital names, and luckily without using the deprecated regulator-compatible property.

With this driver declaring capitalized BUCKx/LDOx as of_match string for the node names, obviously no regulator gets probed: fix that by changing the MT6360_REGULATOR_DESC macro to add a "match" parameter which gets assigned to the of_match.

---
 drivers/regulator/mt6360-regulator.c | 32 +++++++++++++++++-----------
 1 file changed, 20 insertions(+), 12 deletions(-)

index ad6587a378d09..24cc9fc94e900 100644
@@ -319,15 +319,15 @@ static unsigned int mt6360_regulator_of_map_mode(unsigned int hw_mode)
 	}
 }
 
-#define MT6360_REGULATOR_DESC(_name, _sname, ereg, emask, vreg,	vmask,	\
-			      mreg, mmask, streg, stmask, vranges,	\
-			      vcnts, offon_delay, irq_tbls)		\
+#define MT6360_REGULATOR_DESC(match, _name, _sname, ereg, emask, vreg,	\
+			      vmask, mreg, mmask, streg, stmask,	\
+			      vranges, vcnts, offon_delay, irq_tbls)	\
 {									\
 	.desc = {							\
 		.name = #_name,						\
 		.supply_name = #_sname,					\
 		.id =  MT6360_REGULATOR_##_name,			\
-		.of_match = of_match_ptr(#_name),			\
+		.of_match = of_match_ptr(match),			\
 		.regulators_node = of_match_ptr("regulator"),		\
 		.of_map_mode = mt6360_regulator_of_map_mode,		\
 		.owner = THIS_MODULE,					\

@@ -351,21 +351,29 @@ static unsigned int mt6360_regulator_of_map_mode(unsigned int hw_mode)
 }
 
 static const struct mt6360_regulator_desc mt6360_regulator_descs[] =  {
-	MT6360_REGULATOR_DESC(BUCK1, BUCK1_VIN, 0x117, 0x40, 0x110, 0xff, 0x117, 0x30, 0x117, 0x04,
+	MT6360_REGULATOR_DESC("buck1", BUCK1, BUCK1_VIN,
+			      0x117, 0x40, 0x110, 0xff, 0x117, 0x30, 0x117, 0x04,
 			      buck_vout_ranges, 256, 0, buck1_irq_tbls),
-	MT6360_REGULATOR_DESC(BUCK2, BUCK2_VIN, 0x127, 0x40, 0x120, 0xff, 0x127, 0x30, 0x127, 0x04,
+	MT6360_REGULATOR_DESC("buck2", BUCK2, BUCK2_VIN,
+			      0x127, 0x40, 0x120, 0xff, 0x127, 0x30, 0x127, 0x04,
 			      buck_vout_ranges, 256, 0, buck2_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO6, LDO_VIN3, 0x137, 0x40, 0x13B, 0xff, 0x137, 0x30, 0x137, 0x04,
+	MT6360_REGULATOR_DESC("ldo6", LDO6, LDO_VIN3,
+			      0x137, 0x40, 0x13B, 0xff, 0x137, 0x30, 0x137, 0x04,
 			      ldo_vout_ranges1, 256, 0, ldo6_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO7, LDO_VIN3, 0x131, 0x40, 0x135, 0xff, 0x131, 0x30, 0x131, 0x04,
+	MT6360_REGULATOR_DESC("ldo7", LDO7, LDO_VIN3,
+			      0x131, 0x40, 0x135, 0xff, 0x131, 0x30, 0x131, 0x04,
 			      ldo_vout_ranges1, 256, 0, ldo7_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO1, LDO_VIN1, 0x217, 0x40, 0x21B, 0xff, 0x217, 0x30, 0x217, 0x04,
+	MT6360_REGULATOR_DESC("ldo1", LDO1, LDO_VIN1,
+			      0x217, 0x40, 0x21B, 0xff, 0x217, 0x30, 0x217, 0x04,
 			      ldo_vout_ranges2, 256, 0, ldo1_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO2, LDO_VIN1, 0x211, 0x40, 0x215, 0xff, 0x211, 0x30, 0x211, 0x04,
+	MT6360_REGULATOR_DESC("ldo2", LDO2, LDO_VIN1,
+			      0x211, 0x40, 0x215, 0xff, 0x211, 0x30, 0x211, 0x04,
 			      ldo_vout_ranges2, 256, 0, ldo2_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO3, LDO_VIN1, 0x205, 0x40, 0x209, 0xff, 0x205, 0x30, 0x205, 0x04,
+	MT6360_REGULATOR_DESC("ldo3", LDO3, LDO_VIN1,
+			      0x205, 0x40, 0x209, 0xff, 0x205, 0x30, 0x205, 0x04,
 			      ldo_vout_ranges2, 256, 100, ldo3_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO5, LDO_VIN2, 0x20B, 0x40, 0x20F, 0x7f, 0x20B, 0x30, 0x20B, 0x04,
+	MT6360_REGULATOR_DESC("ldo5", LDO5, LDO_VIN2,
+			      0x20B, 0x40, 0x20F, 0x7f, 0x20B, 0x30, 0x20B, 0x04,
 			      ldo_vout_ranges3, 128, 100, ldo5_irq_tbls),
 };
 

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Anton Protopopov <[email protected]>

[ Upstream commit 37eacb9f6e89fb399a79e952bc9c78eb3e16290e ]

Long ago a map file descriptor in a pseudo ldimm64 instruction could only be present as an immediate value insn[0].imm, and thus this value was used in a verbose verifier message printed when the file descriptor wasn't valid. Since addition of BPF_PSEUDO_MAP_IDX_VALUE/BPF_PSEUDO_MAP_IDX the insn[0].imm field can also contain an index pointing to the file descriptor in the attr.fd_array array. However, if the file descriptor is invalid, the verifier still prints the verbose message containing value of insn[0].imm. Patch the verifier message to always print the actual file descriptor value.

---
 kernel/bpf/verifier.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index c9fc734989c68..818bac019d0d3 100644
@@ -17655,8 +17655,7 @@ static int resolve_pseudo_ldimm64(struct bpf_verifier_env *env)
 			f = fdget(fd);
 			map = __bpf_map_get(f);
 			if (IS_ERR(map)) {
-				verbose(env, "fd %d is not pointing to valid bpf_map\n",
-					insn[0].imm);
+				verbose(env, "fd %d is not pointing to valid bpf_map\n", fd);
 				return PTR_ERR(map);
 			}
 

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Li Zetao <[email protected]>

[ Upstream commit a08199b309f833fd4221ab5ee2391c791fe26385 ]

Since commit 7ef9651e9792 ("clk: Provide new devm_clk helpers for prepared and enabled clocks"), devm_clk_get() and clk_prepare_enable() can now be replaced by devm_clk_get_enabled() when driver enables (and possibly prepares) the clocks for the whole lifetime of the device. Moreover, it is no longer necessary to unprepare and disable the clocks explicitly.

Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")

---
 drivers/spi/spi-axi-spi-engine.c | 25 +++++--------------------
 1 file changed, 5 insertions(+), 20 deletions(-)

index 0258c9a72fdcc..b96e55f59d1a9 100644
@@ -485,30 +485,22 @@ static int spi_engine_probe(struct platform_device *pdev)
 
 	spin_lock_init(&spi_engine->lock);
 
-	spi_engine->clk = devm_clk_get(&pdev->dev, "s_axi_aclk");
+	spi_engine->clk = devm_clk_get_enabled(&pdev->dev, "s_axi_aclk");
 	if (IS_ERR(spi_engine->clk)) {
 		ret = PTR_ERR(spi_engine->clk);
 		goto err_put_host;
 	}
 
-	spi_engine->ref_clk = devm_clk_get(&pdev->dev, "spi_clk");
+	spi_engine->ref_clk = devm_clk_get_enabled(&pdev->dev, "spi_clk");
 	if (IS_ERR(spi_engine->ref_clk)) {
 		ret = PTR_ERR(spi_engine->ref_clk);
 		goto err_put_host;
 	}
 
-	ret = clk_prepare_enable(spi_engine->clk);
-	if (ret)
-		goto err_put_host;
-
-	ret = clk_prepare_enable(spi_engine->ref_clk);
-	if (ret)
-		goto err_clk_disable;
-
 	spi_engine->base = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(spi_engine->base)) {
 		ret = PTR_ERR(spi_engine->base);
-		goto err_ref_clk_disable;
+		goto err_put_host;
 	}
 
 	version = readl(spi_engine->base + SPI_ENGINE_REG_VERSION);

@@ -518,7 +510,7 @@ static int spi_engine_probe(struct platform_device *pdev)
 			SPI_ENGINE_VERSION_MINOR(version),
 			SPI_ENGINE_VERSION_PATCH(version));
 		ret = -ENODEV;
-		goto err_ref_clk_disable;
+		goto err_put_host;
 	}
 
 	writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_RESET);

@@ -527,7 +519,7 @@ static int spi_engine_probe(struct platform_device *pdev)
 
 	ret = request_irq(irq, spi_engine_irq, 0, pdev->name, host);
 	if (ret)
-		goto err_ref_clk_disable;
+		goto err_put_host;
 
 	host->dev.of_node = pdev->dev.of_node;
 	host->mode_bits = SPI_CPOL | SPI_CPHA | SPI_3WIRE;

@@ -545,10 +537,6 @@ static int spi_engine_probe(struct platform_device *pdev)
 	return 0;
 err_free_irq:
 	free_irq(irq, host);
-err_ref_clk_disable:
-	clk_disable_unprepare(spi_engine->ref_clk);
-err_clk_disable:
-	clk_disable_unprepare(spi_engine->clk);
 err_put_host:
 	spi_controller_put(host);
 	return ret;

@@ -569,9 +557,6 @@ static void spi_engine_remove(struct platform_device *pdev)
 	writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING);
 	writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE);
 	writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET);
-
-	clk_disable_unprepare(spi_engine->ref_clk);
-	clk_disable_unprepare(spi_engine->clk);
 }
 
 static const struct of_device_id spi_engine_match_table[] = {

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Lechner <[email protected]>

[ Upstream commit 9e4ce5220eedea2cc440f3961dec1b5122e815b2 ]

This simplifies the private data allocation in the AXI SPI Engine driver by making use of the feature built into the spi_alloc_host() function instead of doing it manually.

Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")

---
 drivers/spi/spi-axi-spi-engine.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

index b96e55f59d1a9..bdf0aa4ceb1df 100644
@@ -473,15 +473,11 @@ static int spi_engine_probe(struct platform_device *pdev)
 	if (irq < 0)
 		return irq;
 
-	spi_engine = devm_kzalloc(&pdev->dev, sizeof(*spi_engine), GFP_KERNEL);
-	if (!spi_engine)
-		return -ENOMEM;
-
-	host = spi_alloc_host(&pdev->dev, 0);
+	host = spi_alloc_host(&pdev->dev, sizeof(*spi_engine));
 	if (!host)
 		return -ENOMEM;
 
-	spi_controller_set_devdata(host, spi_engine);
+	spi_engine = spi_controller_get_devdata(host);
 
 	spin_lock_init(&spi_engine->lock);
 

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Lechner <[email protected]>

[ Upstream commit e12cd96e8e93044646fdf4b2c9a1de62cfa01e7c ]

This modifies the AXI SPI Engine driver to use devm_spi_alloc_host() instead of spi_alloc_host() to simplify the code a bit.

In addition to simplifying the error paths in the probe function, we can also remove spi_controller_get/put() calls in the remove function since devm_spi_alloc_host() sets a flag to no longer decrement the controller reference count in the spi_unregister_controller() function.

Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")

---
 drivers/spi/spi-axi-spi-engine.c | 31 ++++++++++---------------------
 1 file changed, 10 insertions(+), 21 deletions(-)

index bdf0aa4ceb1df..77c1c115448d6 100644
@@ -473,7 +473,7 @@ static int spi_engine_probe(struct platform_device *pdev)
 	if (irq < 0)
 		return irq;
 
-	host = spi_alloc_host(&pdev->dev, sizeof(*spi_engine));
+	host = devm_spi_alloc_host(&pdev->dev, sizeof(*spi_engine));
 	if (!host)
 		return -ENOMEM;
 

@@ -482,22 +482,16 @@ static int spi_engine_probe(struct platform_device *pdev)
 	spin_lock_init(&spi_engine->lock);
 
 	spi_engine->clk = devm_clk_get_enabled(&pdev->dev, "s_axi_aclk");
-	if (IS_ERR(spi_engine->clk)) {
-		ret = PTR_ERR(spi_engine->clk);
-		goto err_put_host;
-	}
+	if (IS_ERR(spi_engine->clk))
+		return PTR_ERR(spi_engine->clk);
 
 	spi_engine->ref_clk = devm_clk_get_enabled(&pdev->dev, "spi_clk");
-	if (IS_ERR(spi_engine->ref_clk)) {
-		ret = PTR_ERR(spi_engine->ref_clk);
-		goto err_put_host;
-	}
+	if (IS_ERR(spi_engine->ref_clk))
+		return PTR_ERR(spi_engine->ref_clk);
 
 	spi_engine->base = devm_platform_ioremap_resource(pdev, 0);
-	if (IS_ERR(spi_engine->base)) {
-		ret = PTR_ERR(spi_engine->base);
-		goto err_put_host;
-	}
+	if (IS_ERR(spi_engine->base))
+		return PTR_ERR(spi_engine->base);
 
 	version = readl(spi_engine->base + SPI_ENGINE_REG_VERSION);
 	if (SPI_ENGINE_VERSION_MAJOR(version) != 1) {

@@ -505,8 +499,7 @@ static int spi_engine_probe(struct platform_device *pdev)
 			SPI_ENGINE_VERSION_MAJOR(version),
 			SPI_ENGINE_VERSION_MINOR(version),
 			SPI_ENGINE_VERSION_PATCH(version));
-		ret = -ENODEV;
-		goto err_put_host;
+		return -ENODEV;
 	}
 
 	writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_RESET);

@@ -515,7 +508,7 @@ static int spi_engine_probe(struct platform_device *pdev)
 
 	ret = request_irq(irq, spi_engine_irq, 0, pdev->name, host);
 	if (ret)
-		goto err_put_host;
+		return ret;
 
 	host->dev.of_node = pdev->dev.of_node;
 	host->mode_bits = SPI_CPOL | SPI_CPHA | SPI_3WIRE;

@@ -533,14 +526,12 @@ static int spi_engine_probe(struct platform_device *pdev)
 	return 0;
 err_free_irq:
 	free_irq(irq, host);
-err_put_host:
-	spi_controller_put(host);
 	return ret;
 }
 
 static void spi_engine_remove(struct platform_device *pdev)
 {
-	struct spi_controller *host = spi_controller_get(platform_get_drvdata(pdev));
+	struct spi_controller *host = platform_get_drvdata(pdev);
 	struct spi_engine *spi_engine = spi_controller_get_devdata(host);
 	int irq = platform_get_irq(pdev, 0);
 

@@ -548,8 +539,6 @@ static void spi_engine_remove(struct platform_device *pdev)
 
 	free_irq(irq, host);
 
-	spi_controller_put(host);
-
 	writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING);
 	writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE);
 	writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET);

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Lechner <[email protected]>

[ Upstream commit 7f970ecb77b6759d37ee743fc36fc0daba960e75 ]

This moves the message state in the AXI SPI Engine driver to a new struct spi_engine_msg_state.

Previously, the driver state contained various pointers that pointed to memory owned by a struct spi_message. However, it did not set any of these pointers to NULL when a message was completed. This could lead to use after free bugs.

Example of how this could happen:
1. SPI core calls into spi_engine_transfer_one_message() with msg1.
2. Assume something was misconfigured and spi_engine_tx_next() is not called enough times in interrupt callbacks for msg1 such that spi_engine->tx_xfer is never set to NULL before the msg1 completes.
3. SYNC interrupt is received and spi_finalize_current_message() is called for msg1. spi_engine->msg is set to NULL but no other message-specific state is reset.
4. Caller that sent msg1 is notified of the completion and frees msg1 and the associated xfers and tx/rx buffers.
4. SPI core calls into spi_engine_transfer_one_message() with msg2.
5. When spi_engine_tx_next() is called for msg2, spi_engine->tx_xfer is still be pointing to an xfer from msg1, which was already freed. spi_engine_xfer_next() tries to access xfer->transfer_list of one of the freed xfers and we get a segfault or undefined behavior.

To avoid issues like this, instead of putting per-message state in the driver state struct, we can make use of the struct spi_message::state field to store a pointer to a new struct spi_engine_msg_state. This way, all of the state that belongs to specific message stays with that message and we don't have to remember to manually reset all aspects of the message state when a message is completed. Rather, a new state is allocated for each message.

Most of the changes are just renames where the state is accessed. One place where this wasn't straightforward was the sync_id member. This has been changed to use ida_alloc_range() since we needed to separate the per-message sync_id from the per-controller next available sync_id.

Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")

---
 drivers/spi/spi-axi-spi-engine.c | 150 ++++++++++++++++++++-----------
 1 file changed, 96 insertions(+), 54 deletions(-)

index 77c1c115448d6..9ca5b45c4b4cc 100644
@@ -6,6 +6,7 @@
  */
 
 #include <linux/clk.h>
+#include <linux/idr.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/of.h>

@@ -78,28 +79,42 @@ struct spi_engine_program {
 	uint16_t instructions[];
 };
 
-struct spi_engine {
-	struct clk *clk;
-	struct clk *ref_clk;
-
-	spinlock_t lock;
-
-	void __iomem *base;
-
-	struct spi_message *msg;
+/**
+ * struct spi_engine_message_state - SPI engine per-message state
+ */
+struct spi_engine_message_state {
+	/** Instructions for executing this message. */
 	struct spi_engine_program *p;
+	/** Number of elements in cmd_buf array. */
 	unsigned cmd_length;
+	/** Array of commands not yet written to CMD FIFO. */
 	const uint16_t *cmd_buf;
-
+	/** Next xfer with tx_buf not yet fully written to TX FIFO. */
 	struct spi_transfer *tx_xfer;
+	/** Size of tx_buf in bytes. */
 	unsigned int tx_length;
+	/** Bytes not yet written to TX FIFO. */
 	const uint8_t *tx_buf;
-
+	/** Next xfer with rx_buf not yet fully written to RX FIFO. */
 	struct spi_transfer *rx_xfer;
+	/** Size of tx_buf in bytes. */
 	unsigned int rx_length;
+	/** Bytes not yet written to the RX FIFO. */
 	uint8_t *rx_buf;
+	/** ID to correlate SYNC interrupts with this message. */
+	u8 sync_id;
+};
+
+struct spi_engine {
+	struct clk *clk;
+	struct clk *ref_clk;
 
-	unsigned int sync_id;
+	spinlock_t lock;
+
+	void __iomem *base;
+
+	struct spi_message *msg;
+	struct ida sync_ida;
 	unsigned int completed_id;
 
 	unsigned int int_enable;

@@ -258,100 +273,105 @@ static void spi_engine_xfer_next(struct spi_engine *spi_engine,
 
 static void spi_engine_tx_next(struct spi_engine *spi_engine)
 {
-	struct spi_transfer *xfer = spi_engine->tx_xfer;
+	struct spi_engine_message_state *st = spi_engine->msg->state;
+	struct spi_transfer *xfer = st->tx_xfer;
 
 	do {
 		spi_engine_xfer_next(spi_engine, &xfer);
 	} while (xfer && !xfer->tx_buf);
 
-	spi_engine->tx_xfer = xfer;
+	st->tx_xfer = xfer;
 	if (xfer) {
-		spi_engine->tx_length = xfer->len;
-		spi_engine->tx_buf = xfer->tx_buf;
+		st->tx_length = xfer->len;
+		st->tx_buf = xfer->tx_buf;
 	} else {
-		spi_engine->tx_buf = NULL;
+		st->tx_buf = NULL;
 	}
 }
 
 static void spi_engine_rx_next(struct spi_engine *spi_engine)
 {
-	struct spi_transfer *xfer = spi_engine->rx_xfer;
+	struct spi_engine_message_state *st = spi_engine->msg->state;
+	struct spi_transfer *xfer = st->rx_xfer;
 
 	do {
 		spi_engine_xfer_next(spi_engine, &xfer);
 	} while (xfer && !xfer->rx_buf);
 
-	spi_engine->rx_xfer = xfer;
+	st->rx_xfer = xfer;
 	if (xfer) {
-		spi_engine->rx_length = xfer->len;
-		spi_engine->rx_buf = xfer->rx_buf;
+		st->rx_length = xfer->len;
+		st->rx_buf = xfer->rx_buf;
 	} else {
-		spi_engine->rx_buf = NULL;
+		st->rx_buf = NULL;
 	}
 }
 
 static bool spi_engine_write_cmd_fifo(struct spi_engine *spi_engine)
 {
 	void __iomem *addr = spi_engine->base + SPI_ENGINE_REG_CMD_FIFO;
+	struct spi_engine_message_state *st = spi_engine->msg->state;
 	unsigned int n, m, i;
 	const uint16_t *buf;
 
 	n = readl_relaxed(spi_engine->base + SPI_ENGINE_REG_CMD_FIFO_ROOM);
-	while (n && spi_engine->cmd_length) {
-		m = min(n, spi_engine->cmd_length);
-		buf = spi_engine->cmd_buf;
+	while (n && st->cmd_length) {
+		m = min(n, st->cmd_length);
+		buf = st->cmd_buf;
 		for (i = 0; i < m; i++)
 			writel_relaxed(buf[i], addr);
-		spi_engine->cmd_buf += m;
-		spi_engine->cmd_length -= m;
+		st->cmd_buf += m;
+		st->cmd_length -= m;
 		n -= m;
 	}
 
-	return spi_engine->cmd_length != 0;
+	return st->cmd_length != 0;
 }
 
 static bool spi_engine_write_tx_fifo(struct spi_engine *spi_engine)
 {
 	void __iomem *addr = spi_engine->base + SPI_ENGINE_REG_SDO_DATA_FIFO;
+	struct spi_engine_message_state *st = spi_engine->msg->state;
 	unsigned int n, m, i;
 	const uint8_t *buf;
 
 	n = readl_relaxed(spi_engine->base + SPI_ENGINE_REG_SDO_FIFO_ROOM);
-	while (n && spi_engine->tx_length) {
-		m = min(n, spi_engine->tx_length);
-		buf = spi_engine->tx_buf;
+	while (n && st->tx_length) {
+		m = min(n, st->tx_length);
+		buf = st->tx_buf;
 		for (i = 0; i < m; i++)
 			writel_relaxed(buf[i], addr);
-		spi_engine->tx_buf += m;
-		spi_engine->tx_length -= m;
+		st->tx_buf += m;
+		st->tx_length -= m;
 		n -= m;
-		if (spi_engine->tx_length == 0)
+		if (st->tx_length == 0)
 			spi_engine_tx_next(spi_engine);
 	}
 
-	return spi_engine->tx_length != 0;
+	return st->tx_length != 0;
 }
 
 static bool spi_engine_read_rx_fifo(struct spi_engine *spi_engine)
 {
 	void __iomem *addr = spi_engine->base + SPI_ENGINE_REG_SDI_DATA_FIFO;
+	struct spi_engine_message_state *st = spi_engine->msg->state;
 	unsigned int n, m, i;
 	uint8_t *buf;
 
 	n = readl_relaxed(spi_engine->base + SPI_ENGINE_REG_SDI_FIFO_LEVEL);
-	while (n && spi_engine->rx_length) {
-		m = min(n, spi_engine->rx_length);
-		buf = spi_engine->rx_buf;
+	while (n && st->rx_length) {
+		m = min(n, st->rx_length);
+		buf = st->rx_buf;
 		for (i = 0; i < m; i++)
 			buf[i] = readl_relaxed(addr);
-		spi_engine->rx_buf += m;
-		spi_engine->rx_length -= m;
+		st->rx_buf += m;
+		st->rx_length -= m;
 		n -= m;
-		if (spi_engine->rx_length == 0)
+		if (st->rx_length == 0)
 			spi_engine_rx_next(spi_engine);
 	}
 
-	return spi_engine->rx_length != 0;
+	return st->rx_length != 0;
 }
 
 static irqreturn_t spi_engine_irq(int irq, void *devid)

@@ -387,12 +407,16 @@ static irqreturn_t spi_engine_irq(int irq, void *devid)
 			disable_int |= SPI_ENGINE_INT_SDI_ALMOST_FULL;
 	}
 
-	if (pending & SPI_ENGINE_INT_SYNC) {
-		if (spi_engine->msg &&
-		    spi_engine->completed_id == spi_engine->sync_id) {
+	if (pending & SPI_ENGINE_INT_SYNC && spi_engine->msg) {
+		struct spi_engine_message_state *st = spi_engine->msg->state;
+
+		if (spi_engine->completed_id == st->sync_id) {
 			struct spi_message *msg = spi_engine->msg;
+			struct spi_engine_message_state *st = msg->state;
 
-			kfree(spi_engine->p);
+			ida_free(&spi_engine->sync_ida, st->sync_id);
+			kfree(st->p);
+			kfree(st);
 			msg->status = 0;
 			msg->actual_length = msg->frame_length;
 			spi_engine->msg = NULL;

@@ -417,29 +441,46 @@ static int spi_engine_transfer_one_message(struct spi_controller *host,
 {
 	struct spi_engine_program p_dry, *p;
 	struct spi_engine *spi_engine = spi_controller_get_devdata(host);
+	struct spi_engine_message_state *st;
 	unsigned int int_enable = 0;
 	unsigned long flags;
 	size_t size;
+	int ret;
+
+	st = kzalloc(sizeof(*st), GFP_KERNEL);
+	if (!st)
+		return -ENOMEM;
 
 	p_dry.length = 0;
 	spi_engine_compile_message(spi_engine, msg, true, &p_dry);
 
 	size = sizeof(*p->instructions) * (p_dry.length + 1);
 	p = kzalloc(sizeof(*p) + size, GFP_KERNEL);
-	if (!p)
+	if (!p) {
+		kfree(st);
 		return -ENOMEM;
+	}
+
+	ret = ida_alloc_range(&spi_engine->sync_ida, 0, U8_MAX, GFP_KERNEL);
+	if (ret < 0) {
+		kfree(p);
+		kfree(st);
+		return ret;
+	}
+
+	st->sync_id = ret;
+
 	spi_engine_compile_message(spi_engine, msg, false, p);
 
 	spin_lock_irqsave(&spi_engine->lock, flags);
-	spi_engine->sync_id = (spi_engine->sync_id + 1) & 0xff;
-	spi_engine_program_add_cmd(p, false,
-		SPI_ENGINE_CMD_SYNC(spi_engine->sync_id));
+	spi_engine_program_add_cmd(p, false, SPI_ENGINE_CMD_SYNC(st->sync_id));
 
+	msg->state = st;
 	spi_engine->msg = msg;
-	spi_engine->p = p;
+	st->p = p;
 
-	spi_engine->cmd_buf = p->instructions;
-	spi_engine->cmd_length = p->length;
+	st->cmd_buf = p->instructions;
+	st->cmd_length = p->length;
 	if (spi_engine_write_cmd_fifo(spi_engine))
 		int_enable |= SPI_ENGINE_INT_CMD_ALMOST_EMPTY;
 

@@ -448,7 +489,7 @@ static int spi_engine_transfer_one_message(struct spi_controller *host,
 		int_enable |= SPI_ENGINE_INT_SDO_ALMOST_EMPTY;
 
 	spi_engine_rx_next(spi_engine);
-	if (spi_engine->rx_length != 0)
+	if (st->rx_length != 0)
 		int_enable |= SPI_ENGINE_INT_SDI_ALMOST_FULL;
 
 	int_enable |= SPI_ENGINE_INT_SYNC;

@@ -480,6 +521,7 @@ static int spi_engine_probe(struct platform_device *pdev)
 	spi_engine = spi_controller_get_devdata(host);
 
 	spin_lock_init(&spi_engine->lock);
+	ida_init(&spi_engine->sync_ida);
 
 	spi_engine->clk = devm_clk_get_enabled(&pdev->dev, "s_axi_aclk");
 	if (IS_ERR(spi_engine->clk))

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Lechner <[email protected]>

[ Upstream commit 88c2b56c2690061121cad03f0f551db465287575 ]

This avoid duplicating the same macros in multiple drivers by reusing the common AXI macros for the version register.

Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")

---
 drivers/spi/spi-axi-spi-engine.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

index 9ca5b45c4b4cc..9c7b6a92417ce 100644
@@ -6,6 +6,7 @@
  */
 
 #include <linux/clk.h>
+#include <linux/fpga/adi-axi-common.h>
 #include <linux/idr.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>

@@ -14,12 +15,6 @@
 #include <linux/platform_device.h>
 #include <linux/spi/spi.h>
 
-#define SPI_ENGINE_VERSION_MAJOR(x)	((x >> 16) & 0xff)
-#define SPI_ENGINE_VERSION_MINOR(x)	((x >> 8) & 0xff)
-#define SPI_ENGINE_VERSION_PATCH(x)	(x & 0xff)
-
-#define SPI_ENGINE_REG_VERSION			0x00
-
 #define SPI_ENGINE_REG_RESET			0x40
 
 #define SPI_ENGINE_REG_INT_ENABLE		0x80

@@ -535,12 +530,12 @@ static int spi_engine_probe(struct platform_device *pdev)
 	if (IS_ERR(spi_engine->base))
 		return PTR_ERR(spi_engine->base);
 
-	version = readl(spi_engine->base + SPI_ENGINE_REG_VERSION);
-	if (SPI_ENGINE_VERSION_MAJOR(version) != 1) {
+	version = readl(spi_engine->base + ADI_AXI_REG_VERSION);
+	if (ADI_AXI_PCORE_VER_MAJOR(version) != 1) {
 		dev_err(&pdev->dev, "Unsupported peripheral version %u.%u.%c\n",
-			SPI_ENGINE_VERSION_MAJOR(version),
-			SPI_ENGINE_VERSION_MINOR(version),
-			SPI_ENGINE_VERSION_PATCH(version));
+			ADI_AXI_PCORE_VER_MAJOR(version),
+			ADI_AXI_PCORE_VER_MINOR(version),
+			ADI_AXI_PCORE_VER_PATCH(version));
 		return -ENODEV;
 	}
 

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Lechner <[email protected]>

[ Upstream commit 0064db9ce4aa7cc794e6f4aed60dee0f94fc9bcf ]

The version format string in the AXI SPI Engine driver was probably intended to print the version number in the same format as the DT compatible string (e.g. 1.00.a). However, the version just uses semantic versioning so formatting the patch number as a character is not correct and would result in printing control characters for patch numbers less than 32.

---
 drivers/spi/spi-axi-spi-engine.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 9c7b6a92417ce..9faee4fcc049a 100644
@@ -532,7 +532,7 @@ static int spi_engine_probe(struct platform_device *pdev)
 
 	version = readl(spi_engine->base + ADI_AXI_REG_VERSION);
 	if (ADI_AXI_PCORE_VER_MAJOR(version) != 1) {
-		dev_err(&pdev->dev, "Unsupported peripheral version %u.%u.%c\n",
+		dev_err(&pdev->dev, "Unsupported peripheral version %u.%u.%u\n",
 			ADI_AXI_PCORE_VER_MAJOR(version),
 			ADI_AXI_PCORE_VER_MINOR(version),
 			ADI_AXI_PCORE_VER_PATCH(version));

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Devyn Liu <[email protected]>

[ Upstream commit 7430764f5a85d30314aeef2d5438dff1fb0b1d68 ]

Due to the reading of FIFO during the dump of data registers in debugfs, if SPI transmission is in progress, it will be affected and may result in transmission failure. Therefore, the dump interface of data registers in debugfs is removed.

---
 drivers/spi/spi-hisi-kunpeng.c | 2 --
 1 file changed, 2 deletions(-)

index 35ef5e8e2ffd2..77e9738e42f60 100644
@@ -151,8 +151,6 @@ static const struct debugfs_reg32 hisi_spi_regs[] = {
 	HISI_SPI_DBGFS_REG("ENR", HISI_SPI_ENR),
 	HISI_SPI_DBGFS_REG("FIFOC", HISI_SPI_FIFOC),
 	HISI_SPI_DBGFS_REG("IMR", HISI_SPI_IMR),
-	HISI_SPI_DBGFS_REG("DIN", HISI_SPI_DIN),
-	HISI_SPI_DBGFS_REG("DOUT", HISI_SPI_DOUT),
 	HISI_SPI_DBGFS_REG("SR", HISI_SPI_SR),
 	HISI_SPI_DBGFS_REG("RISR", HISI_SPI_RISR),
 	HISI_SPI_DBGFS_REG("ISR", HISI_SPI_ISR),

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xu Kuohai <[email protected]>

[ Upstream commit dc7d7447b56bcc9cf79a9c22e4edad200a298e4c ]

When __bpf_prog_enter() returns zero, the arm64 register x20 that stores prog start time is not assigned to zero, causing incorrect runtime stats.

To fix it, assign the return value of bpf_prog_enter() to x20 register immediately upon its return.

---
 arch/arm64/net/bpf_jit_comp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index 29196dce9b91d..166619348b98e 100644
@@ -1738,15 +1738,15 @@ static void invoke_bpf_prog(struct jit_ctx *ctx, struct bpf_tramp_link *l,
 
 	emit_call(enter_prog, ctx);
 
+	/* save return value to callee saved register x20 */
+	emit(A64_MOV(1, A64_R(20), A64_R(0)), ctx);
+
 	/* if (__bpf_prog_enter(prog) == 0)
 	 *         goto skip_exec_of_prog;
 	 */
 	branch = ctx->image + ctx->idx;
 	emit(A64_NOP, ctx);
 
-	/* save return value to callee saved register x20 */
-	emit(A64_MOV(1, A64_R(20), A64_R(0)), ctx);
-
 	emit(A64_ADD_I(1, A64_R(0), A64_SP, args_off), ctx);
 	if (!p->jited)
 		emit_addr_mov_i64(A64_R(1), (const u64)p->insnsi, ctx);

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xu Kuohai <[email protected]>

[ Upstream commit 10541b374aa05c8118cc6a529a615882e53f261b ]

When __bpf_prog_enter() returns zero, the s1 register is not set to zero, resulting in incorrect runtime stats. Fix it by setting s1 immediately upon the return of __bpf_prog_enter().

---
 arch/riscv/net/bpf_jit_comp64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index 8581693e62d39..b3990874e4818 100644
@@ -740,6 +740,9 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_of
 	if (ret)
 		return ret;
 
+	/* store prog start time */
+	emit_mv(RV_REG_S1, RV_REG_A0, ctx);
+
 	/* if (__bpf_prog_enter(prog) == 0)
 	 *	goto skip_exec_of_prog;
 	 */

@@ -747,9 +750,6 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_of
 	/* nop reserved for conditional jump */
 	emit(rv_nop(), ctx);
 
-	/* store prog start time */
-	emit_mv(RV_REG_S1, RV_REG_A0, ctx);
-
 	/* arg1: &args_off */
 	emit_addi(RV_REG_A0, RV_REG_FP, -args_off, ctx);
 	if (!p->jited)

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Matti Vaittinen <[email protected]>

[ Upstream commit 96e20adc43c4f81e9163a5188cee75a6dd393e09 ]

The devm_regulator_get_enable() should be a 'call and forget' API, meaning, when it is used to enable the regulators, the API does not provide a handle to do any further control of the regulators. It gives no real benefit to return an error from the stub if CONFIG_REGULATOR is not set.

On the contrary, returning and error is causing problems to drivers when hardware is such it works out just fine with no regulator control. Returning an error forces drivers to specifically handle the case where CONFIG_REGULATOR is not set, making the mere existence of the stub questionalble. Furthermore, the stub of the regulator_enable() seems to be returning Ok.

Change the stub implementation for the devm_regulator_get_enable() to return Ok so drivers do not separately handle the case where the CONFIG_REGULATOR is not set.

---
 include/linux/regulator/consumer.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 39b666b40ea61..e3e58d5a84e2a 100644
@@ -365,7 +365,7 @@ devm_regulator_get_exclusive(struct device *dev, const char *id)
 
 static inline int devm_regulator_get_enable(struct device *dev, const char *id)
 {
-	return -ENODEV;
+	return 0;
 }
 
 static inline int devm_regulator_get_enable_optional(struct device *dev,

2.43.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Amadeusz Sławiński <[email protected]>