Fixes for 6.1

Signed-off-by: Sasha Levin <sashal@kernel.org>

16 files changed, 1171 insertions, 0 deletions

diff --git a/queue-6.1/dma-xilinx_dpdma-fix-locking.patch b/queue-6.1/dma-xilinx_dpdma-fix-locking.patch
new file mode 100644
index 0000000000..4fa9f93423
--- /dev/null
+++ b/queue-6.1/dma-xilinx_dpdma-fix-locking.patch
@@ -0,0 +1,149 @@
+From 6405fd7178de6567b20af7be1042098e99d871ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 16:00:32 -0500
+Subject: dma: xilinx_dpdma: Fix locking
+
+From: Sean Anderson <sean.anderson@linux.dev>
+
+[ Upstream commit 244296cc3a155199a8b080d19e645d7d49081a38 ]
+
+There are several places where either chan->lock or chan->vchan.lock was
+not held. Add appropriate locking. This fixes lockdep warnings like
+
+[   31.077578] ------------[ cut here ]------------
+[   31.077831] WARNING: CPU: 2 PID: 40 at drivers/dma/xilinx/xilinx_dpdma.c:834 xilinx_dpdma_chan_queue_transfer+0x274/0x5e0
+[   31.077953] Modules linked in:
+[   31.078019] CPU: 2 PID: 40 Comm: kworker/u12:1 Not tainted 6.6.20+ #98
+[   31.078102] Hardware name: xlnx,zynqmp (DT)
+[   31.078169] Workqueue: events_unbound deferred_probe_work_func
+[   31.078272] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[   31.078377] pc : xilinx_dpdma_chan_queue_transfer+0x274/0x5e0
+[   31.078473] lr : xilinx_dpdma_chan_queue_transfer+0x270/0x5e0
+[   31.078550] sp : ffffffc083bb2e10
+[   31.078590] x29: ffffffc083bb2e10 x28: 0000000000000000 x27: ffffff880165a168
+[   31.078754] x26: ffffff880164e920 x25: ffffff880164eab8 x24: ffffff880164d480
+[   31.078920] x23: ffffff880165a148 x22: ffffff880164e988 x21: 0000000000000000
+[   31.079132] x20: ffffffc082aa3000 x19: ffffff880164e880 x18: 0000000000000000
+[   31.079295] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
+[   31.079453] x14: 0000000000000000 x13: ffffff8802263dc0 x12: 0000000000000001
+[   31.079613] x11: 0001ffc083bb2e34 x10: 0001ff880164e98f x9 : 0001ffc082aa3def
+[   31.079824] x8 : 0001ffc082aa3dec x7 : 0000000000000000 x6 : 0000000000000516
+[   31.079982] x5 : ffffffc7f8d43000 x4 : ffffff88003c9c40 x3 : ffffffffffffffff
+[   31.080147] x2 : ffffffc7f8d43000 x1 : 00000000000000c0 x0 : 0000000000000000
+[   31.080307] Call trace:
+[   31.080340]  xilinx_dpdma_chan_queue_transfer+0x274/0x5e0
+[   31.080518]  xilinx_dpdma_issue_pending+0x11c/0x120
+[   31.080595]  zynqmp_disp_layer_update+0x180/0x3ac
+[   31.080712]  zynqmp_dpsub_plane_atomic_update+0x11c/0x21c
+[   31.080825]  drm_atomic_helper_commit_planes+0x20c/0x684
+[   31.080951]  drm_atomic_helper_commit_tail+0x5c/0xb0
+[   31.081139]  commit_tail+0x234/0x294
+[   31.081246]  drm_atomic_helper_commit+0x1f8/0x210
+[   31.081363]  drm_atomic_commit+0x100/0x140
+[   31.081477]  drm_client_modeset_commit_atomic+0x318/0x384
+[   31.081634]  drm_client_modeset_commit_locked+0x8c/0x24c
+[   31.081725]  drm_client_modeset_commit+0x34/0x5c
+[   31.081812]  __drm_fb_helper_restore_fbdev_mode_unlocked+0x104/0x168
+[   31.081899]  drm_fb_helper_set_par+0x50/0x70
+[   31.081971]  fbcon_init+0x538/0xc48
+[   31.082047]  visual_init+0x16c/0x23c
+[   31.082207]  do_bind_con_driver.isra.0+0x2d0/0x634
+[   31.082320]  do_take_over_console+0x24c/0x33c
+[   31.082429]  do_fbcon_takeover+0xbc/0x1b0
+[   31.082503]  fbcon_fb_registered+0x2d0/0x34c
+[   31.082663]  register_framebuffer+0x27c/0x38c
+[   31.082767]  __drm_fb_helper_initial_config_and_unlock+0x5c0/0x91c
+[   31.082939]  drm_fb_helper_initial_config+0x50/0x74
+[   31.083012]  drm_fbdev_dma_client_hotplug+0xb8/0x108
+[   31.083115]  drm_client_register+0xa0/0xf4
+[   31.083195]  drm_fbdev_dma_setup+0xb0/0x1cc
+[   31.083293]  zynqmp_dpsub_drm_init+0x45c/0x4e0
+[   31.083431]  zynqmp_dpsub_probe+0x444/0x5e0
+[   31.083616]  platform_probe+0x8c/0x13c
+[   31.083713]  really_probe+0x258/0x59c
+[   31.083793]  __driver_probe_device+0xc4/0x224
+[   31.083878]  driver_probe_device+0x70/0x1c0
+[   31.083961]  __device_attach_driver+0x108/0x1e0
+[   31.084052]  bus_for_each_drv+0x9c/0x100
+[   31.084125]  __device_attach+0x100/0x298
+[   31.084207]  device_initial_probe+0x14/0x20
+[   31.084292]  bus_probe_device+0xd8/0xdc
+[   31.084368]  deferred_probe_work_func+0x11c/0x180
+[   31.084451]  process_one_work+0x3ac/0x988
+[   31.084643]  worker_thread+0x398/0x694
+[   31.084752]  kthread+0x1bc/0x1c0
+[   31.084848]  ret_from_fork+0x10/0x20
+[   31.084932] irq event stamp: 64549
+[   31.084970] hardirqs last  enabled at (64548): [<ffffffc081adf35c>] _raw_spin_unlock_irqrestore+0x80/0x90
+[   31.085157] hardirqs last disabled at (64549): [<ffffffc081adf010>] _raw_spin_lock_irqsave+0xc0/0xdc
+[   31.085277] softirqs last  enabled at (64503): [<ffffffc08001071c>] __do_softirq+0x47c/0x500
+[   31.085390] softirqs last disabled at (64498): [<ffffffc080017134>] ____do_softirq+0x10/0x1c
+[   31.085501] ---[ end trace 0000000000000000 ]---
+
+Fixes: 7cbb0c63de3f ("dmaengine: xilinx: dpdma: Add the Xilinx DisplayPort DMA engine driver")
+Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://lore.kernel.org/r/20240308210034.3634938-2-sean.anderson@linux.dev
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dpdma.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dpdma.c b/drivers/dma/xilinx/xilinx_dpdma.c
+index 84dc5240a8074..93938ed80fc83 100644
+--- a/drivers/dma/xilinx/xilinx_dpdma.c
++++ b/drivers/dma/xilinx/xilinx_dpdma.c
+@@ -214,7 +214,8 @@ struct xilinx_dpdma_tx_desc {
+  * @running: true if the channel is running
+  * @first_frame: flag for the first frame of stream
+  * @video_group: flag if multi-channel operation is needed for video channels
+- * @lock: lock to access struct xilinx_dpdma_chan
++ * @lock: lock to access struct xilinx_dpdma_chan. Must be taken before
++ *        @vchan.lock, if both are to be held.
+  * @desc_pool: descriptor allocation pool
+  * @err_task: error IRQ bottom half handler
+  * @desc: References to descriptors being processed
+@@ -1097,12 +1098,14 @@ static void xilinx_dpdma_chan_vsync_irq(struct  xilinx_dpdma_chan *chan)
+ 	 * Complete the active descriptor, if any, promote the pending
+ 	 * descriptor to active, and queue the next transfer, if any.
+ 	 */
++	spin_lock(&chan->vchan.lock);
+ 	if (chan->desc.active)
+ 		vchan_cookie_complete(&chan->desc.active->vdesc);
+ 	chan->desc.active = pending;
+ 	chan->desc.pending = NULL;
+ 
+ 	xilinx_dpdma_chan_queue_transfer(chan);
++	spin_unlock(&chan->vchan.lock);
+ 
+ out:
+ 	spin_unlock_irqrestore(&chan->lock, flags);
+@@ -1264,10 +1267,12 @@ static void xilinx_dpdma_issue_pending(struct dma_chan *dchan)
+ 	struct xilinx_dpdma_chan *chan = to_xilinx_chan(dchan);
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&chan->vchan.lock, flags);
++	spin_lock_irqsave(&chan->lock, flags);
++	spin_lock(&chan->vchan.lock);
+ 	if (vchan_issue_pending(&chan->vchan))
+ 		xilinx_dpdma_chan_queue_transfer(chan);
+-	spin_unlock_irqrestore(&chan->vchan.lock, flags);
++	spin_unlock(&chan->vchan.lock);
++	spin_unlock_irqrestore(&chan->lock, flags);
+ }
+ 
+ static int xilinx_dpdma_config(struct dma_chan *dchan,
+@@ -1495,7 +1500,9 @@ static void xilinx_dpdma_chan_err_task(struct tasklet_struct *t)
+ 		    XILINX_DPDMA_EINTR_CHAN_ERR_MASK << chan->id);
+ 
+ 	spin_lock_irqsave(&chan->lock, flags);
++	spin_lock(&chan->vchan.lock);
+ 	xilinx_dpdma_chan_queue_transfer(chan);
++	spin_unlock(&chan->vchan.lock);
+ 	spin_unlock_irqrestore(&chan->lock, flags);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/dmaengine-idxd-fix-oops-during-rmmod-on-single-cpu-p.patch b/queue-6.1/dmaengine-idxd-fix-oops-during-rmmod-on-single-cpu-p.patch
new file mode 100644
index 0000000000..117ea29250
--- /dev/null
+++ b/queue-6.1/dmaengine-idxd-fix-oops-during-rmmod-on-single-cpu-p.patch
@@ -0,0 +1,87 @@
+From 6890cce0de1e3462cfee630bdef9c59fa8522237 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2024 14:40:31 -0700
+Subject: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
+
+From: Fenghua Yu <fenghua.yu@intel.com>
+
+[ Upstream commit f221033f5c24659dc6ad7e5cf18fb1b075f4a8be ]
+
+During the removal of the idxd driver, registered offline callback is
+invoked as part of the clean up process. However, on systems with only
+one CPU online, no valid target is available to migrate the
+perf context, resulting in a kernel oops:
+
+    BUG: unable to handle page fault for address: 000000000002a2b8
+    #PF: supervisor write access in kernel mode
+    #PF: error_code(0x0002) - not-present page
+    PGD 1470e1067 P4D 0
+    Oops: 0002 [#1] PREEMPT SMP NOPTI
+    CPU: 0 PID: 20 Comm: cpuhp/0 Not tainted 6.8.0-rc6-dsa+ #57
+    Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023
+    RIP: 0010:mutex_lock+0x2e/0x50
+    ...
+    Call Trace:
+    <TASK>
+    __die+0x24/0x70
+    page_fault_oops+0x82/0x160
+    do_user_addr_fault+0x65/0x6b0
+    __pfx___rdmsr_safe_on_cpu+0x10/0x10
+    exc_page_fault+0x7d/0x170
+    asm_exc_page_fault+0x26/0x30
+    mutex_lock+0x2e/0x50
+    mutex_lock+0x1e/0x50
+    perf_pmu_migrate_context+0x87/0x1f0
+    perf_event_cpu_offline+0x76/0x90 [idxd]
+    cpuhp_invoke_callback+0xa2/0x4f0
+    __pfx_perf_event_cpu_offline+0x10/0x10 [idxd]
+    cpuhp_thread_fun+0x98/0x150
+    smpboot_thread_fn+0x27/0x260
+    smpboot_thread_fn+0x1af/0x260
+    __pfx_smpboot_thread_fn+0x10/0x10
+    kthread+0x103/0x140
+    __pfx_kthread+0x10/0x10
+    ret_from_fork+0x31/0x50
+    __pfx_kthread+0x10/0x10
+    ret_from_fork_asm+0x1b/0x30
+    <TASK>
+
+Fix the issue by preventing the migration of the perf context to an
+invalid target.
+
+Fixes: 81dd4d4d6178 ("dmaengine: idxd: Add IDXD performance monitor support")
+Reported-by: Terrence Xu <terrence.xu@intel.com>
+Tested-by: Terrence Xu <terrence.xu@intel.com>
+Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
+Link: https://lore.kernel.org/r/20240313214031.1658045-1-fenghua.yu@intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/perfmon.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/dma/idxd/perfmon.c b/drivers/dma/idxd/perfmon.c
+index d73004f47cf4b..612ef13b71603 100644
+--- a/drivers/dma/idxd/perfmon.c
++++ b/drivers/dma/idxd/perfmon.c
+@@ -529,14 +529,11 @@ static int perf_event_cpu_offline(unsigned int cpu, struct hlist_node *node)
+ 		return 0;
+ 
+ 	target = cpumask_any_but(cpu_online_mask, cpu);
+-
+ 	/* migrate events if there is a valid target */
+-	if (target < nr_cpu_ids)
++	if (target < nr_cpu_ids) {
+ 		cpumask_set_cpu(target, &perfmon_dsa_cpu_mask);
+-	else
+-		target = -1;
+-
+-	perf_pmu_migrate_context(&idxd_pmu->pmu, cpu, target);
++		perf_pmu_migrate_context(&idxd_pmu->pmu, cpu, target);
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/dmaengine-owl-fix-register-access-functions.patch b/queue-6.1/dmaengine-owl-fix-register-access-functions.patch
new file mode 100644
index 0000000000..eef7aafc43
--- /dev/null
+++ b/queue-6.1/dmaengine-owl-fix-register-access-functions.patch
@@ -0,0 +1,58 @@
+From 3999ef150d7ec4873b49f39066dd51e1d93972df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2024 14:21:07 +0100
+Subject: dmaengine: owl: fix register access functions
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 43c633ef93a5d293c96ebcedb40130df13128428 ]
+
+When building with 'make W=1', clang notices that the computed register
+values are never actually written back but instead the wrong variable
+is set:
+
+drivers/dma/owl-dma.c:244:6: error: variable 'regval' set but not used [-Werror,-Wunused-but-set-variable]
+  244 |         u32 regval;
+      |             ^
+drivers/dma/owl-dma.c:268:6: error: variable 'regval' set but not used [-Werror,-Wunused-but-set-variable]
+  268 |         u32 regval;
+      |             ^
+
+Change these to what was most likely intended.
+
+Fixes: 47e20577c24d ("dmaengine: Add Actions Semi Owl family S900 DMA driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Peter Korsgaard <peter@korsgaard.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240322132116.906475-1-arnd@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/owl-dma.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/owl-dma.c b/drivers/dma/owl-dma.c
+index b6e0ac8314e5c..0819f19c87cc5 100644
+--- a/drivers/dma/owl-dma.c
++++ b/drivers/dma/owl-dma.c
+@@ -249,7 +249,7 @@ static void pchan_update(struct owl_dma_pchan *pchan, u32 reg,
+ 	else
+ 		regval &= ~val;
+ 
+-	writel(val, pchan->base + reg);
++	writel(regval, pchan->base + reg);
+ }
+ 
+ static void pchan_writel(struct owl_dma_pchan *pchan, u32 reg, u32 data)
+@@ -273,7 +273,7 @@ static void dma_update(struct owl_dma *od, u32 reg, u32 val, bool state)
+ 	else
+ 		regval &= ~val;
+ 
+-	writel(val, od->base + reg);
++	writel(regval, od->base + reg);
+ }
+ 
+ static void dma_writel(struct owl_dma *od, u32 reg, u32 data)
+-- 
+2.43.0
+
diff --git a/queue-6.1/dmaengine-tegra186-fix-residual-calculation.patch b/queue-6.1/dmaengine-tegra186-fix-residual-calculation.patch
new file mode 100644
index 0000000000..10910e8f6c
--- /dev/null
+++ b/queue-6.1/dmaengine-tegra186-fix-residual-calculation.patch
@@ -0,0 +1,45 @@
+From 74a91b3bcead9b8e34c038fa4c391d62cfc9a1c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 18:14:11 +0530
+Subject: dmaengine: tegra186: Fix residual calculation
+
+From: Akhil R <akhilrajeev@nvidia.com>
+
+[ Upstream commit 30f0ced9971b2d8c8c24ae75786f9079489a012d ]
+
+The existing residual calculation returns an incorrect value when
+bytes_xfer == bytes_req. This scenario occurs particularly with drivers
+like UART where DMA is scheduled for maximum number of bytes and is
+terminated when the bytes inflow stops. At higher baud rates, it could
+request the tx_status while there is no bytes left to transfer. This will
+lead to incorrect residual being set. Hence return residual as '0' when
+bytes transferred equals to the bytes requested.
+
+Fixes: ee17028009d4 ("dmaengine: tegra: Add tegra gpcdma driver")
+Signed-off-by: Akhil R <akhilrajeev@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20240315124411.17582-1-akhilrajeev@nvidia.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/tegra186-gpc-dma.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/dma/tegra186-gpc-dma.c b/drivers/dma/tegra186-gpc-dma.c
+index 75af3488a3baf..e70b7c41dcab7 100644
+--- a/drivers/dma/tegra186-gpc-dma.c
++++ b/drivers/dma/tegra186-gpc-dma.c
+@@ -742,6 +742,9 @@ static int tegra_dma_get_residual(struct tegra_dma_channel *tdc)
+ 	bytes_xfer = dma_desc->bytes_xfer +
+ 		     sg_req[dma_desc->sg_idx].len - (wcount * 4);
+ 
++	if (dma_desc->bytes_req == bytes_xfer)
++		return 0;
++
+ 	residual = dma_desc->bytes_req - (bytes_xfer % dma_desc->bytes_req);
+ 
+ 	return residual;
+-- 
+2.43.0
+
diff --git a/queue-6.1/i2c-smbus-fix-null-function-pointer-dereference.patch b/queue-6.1/i2c-smbus-fix-null-function-pointer-dereference.patch
new file mode 100644
index 0000000000..c9b6c82332
--- /dev/null
+++ b/queue-6.1/i2c-smbus-fix-null-function-pointer-dereference.patch
@@ -0,0 +1,64 @@
+From 8c45c04b22f140878ceefdf12a8e745b7d829bca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Apr 2024 08:44:08 +0200
+Subject: i2c: smbus: fix NULL function pointer dereference
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f ]
+
+Baruch reported an OOPS when using the designware controller as target
+only. Target-only modes break the assumption of one transfer function
+always being available. Fix this by always checking the pointer in
+__i2c_transfer.
+
+Reported-by: Baruch Siach <baruch@tkos.co.il>
+Closes: https://lore.kernel.org/r/4269631780e5ba789cf1ae391eec1b959def7d99.1712761976.git.baruch@tkos.co.il
+Fixes: 4b1acc43331d ("i2c: core changes for slave support")
+[wsa: dropped the simplification in core-smbus to avoid theoretical regressions]
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Tested-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-core-base.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 5e3976ba52650..1ebc953799149 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -2075,13 +2075,18 @@ static int i2c_check_for_quirks(struct i2c_adapter *adap, struct i2c_msg *msgs,
+  * Returns negative errno, else the number of messages executed.
+  *
+  * Adapter lock must be held when calling this function. No debug logging
+- * takes place. adap->algo->master_xfer existence isn't checked.
++ * takes place.
+  */
+ int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ {
+ 	unsigned long orig_jiffies;
+ 	int ret, try;
+ 
++	if (!adap->algo->master_xfer) {
++		dev_dbg(&adap->dev, "I2C level transfers not supported\n");
++		return -EOPNOTSUPP;
++	}
++
+ 	if (WARN_ON(!msgs || num < 1))
+ 		return -EINVAL;
+ 
+@@ -2148,11 +2153,6 @@ int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ {
+ 	int ret;
+ 
+-	if (!adap->algo->master_xfer) {
+-		dev_dbg(&adap->dev, "I2C level transfers not supported\n");
+-		return -EOPNOTSUPP;
+-	}
+-
+ 	/* REVISIT the fault reporting model here is weak:
+ 	 *
+ 	 *  - When we get an error after receiving N bytes from a slave,
+-- 
+2.43.0
+
diff --git a/queue-6.1/idma64-don-t-try-to-serve-interrupts-when-device-is-.patch b/queue-6.1/idma64-don-t-try-to-serve-interrupts-when-device-is-.patch
new file mode 100644
index 0000000000..f5635a2cde
--- /dev/null
+++ b/queue-6.1/idma64-don-t-try-to-serve-interrupts-when-device-is-.patch
@@ -0,0 +1,44 @@
+From 041c702dcc6370a2f640a61d9e15f353ac38b4b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2024 14:04:21 +0200
+Subject: idma64: Don't try to serve interrupts when device is powered off
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 9140ce47872bfd89fca888c2f992faa51d20c2bc ]
+
+When iDMA 64-bit device is powered off, the IRQ status register
+is all 1:s. This is never happen in real case and signalling that
+the device is simply powered off. Don't try to serve interrupts
+that are not ours.
+
+Fixes: 667dfed98615 ("dmaengine: add a driver for Intel integrated DMA 64-bit")
+Reported-by: Heiner Kallweit <hkallweit1@gmail.com>
+Closes: https://lore.kernel.org/r/700bbb84-90e1-4505-8ff0-3f17ea8bc631@gmail.com
+Tested-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20240321120453.1360138-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idma64.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/dma/idma64.c b/drivers/dma/idma64.c
+index f4c07ad3be15b..af8777a1ec2e3 100644
+--- a/drivers/dma/idma64.c
++++ b/drivers/dma/idma64.c
+@@ -167,6 +167,10 @@ static irqreturn_t idma64_irq(int irq, void *dev)
+ 	u32 status_err;
+ 	unsigned short i;
+ 
++	/* Since IRQ may be shared, check if DMA controller is powered on */
++	if (status == GENMASK(31, 0))
++		return IRQ_NONE;
++
+ 	dev_vdbg(idma64->dma.dev, "%s: status=%#x\n", __func__, status);
+ 
+ 	/* Check if we have any interrupt from the DMA controller */
+-- 
+2.43.0
+
diff --git a/queue-6.1/phy-freescale-imx8m-pcie-fix-pcie-link-up-instabilit.patch b/queue-6.1/phy-freescale-imx8m-pcie-fix-pcie-link-up-instabilit.patch
new file mode 100644
index 0000000000..28b1219ef4
--- /dev/null
+++ b/queue-6.1/phy-freescale-imx8m-pcie-fix-pcie-link-up-instabilit.patch
@@ -0,0 +1,43 @@
+From 80d015d65c342af28cb0b258577e5be94519677c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2024 14:06:32 +0100
+Subject: phy: freescale: imx8m-pcie: fix pcie link-up instability
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 3a161017f1de55cc48be81f6156004c151f32677 ]
+
+Leaving AUX_PLL_REFCLK_SEL at its reset default of AUX_IN (PLL clock)
+proves to be more stable on the i.MX 8M Mini.
+
+Fixes: 1aa97b002258 ("phy: freescale: pcie: Initialize the imx8 pcie standalone phy driver")
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
+Link: https://lore.kernel.org/r/20240322130646.1016630-2-marcel@ziswiler.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
+index f1476936b8d9a..211ce84d980f9 100644
+--- a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
++++ b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
+@@ -108,8 +108,10 @@ static int imx8_pcie_phy_power_on(struct phy *phy)
+ 		/* Source clock from SoC internal PLL */
+ 		writel(ANA_PLL_CLK_OUT_TO_EXT_IO_SEL,
+ 		       imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG062);
+-		writel(AUX_PLL_REFCLK_SEL_SYS_PLL,
+-		       imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG063);
++		if (imx8_phy->drvdata->variant != IMX8MM) {
++			writel(AUX_PLL_REFCLK_SEL_SYS_PLL,
++			       imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG063);
++		}
+ 		val = ANA_AUX_RX_TX_SEL_TX | ANA_AUX_TX_TERM;
+ 		writel(val | ANA_AUX_RX_TERM_GND_EN,
+ 		       imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG064);
+-- 
+2.43.0
+
diff --git a/queue-6.1/phy-freescale-imx8m-pcie-refine-i.mx8mm-pcie-phy-dri.patch b/queue-6.1/phy-freescale-imx8m-pcie-refine-i.mx8mm-pcie-phy-dri.patch
new file mode 100644
index 0000000000..e75994e79c
--- /dev/null
+++ b/queue-6.1/phy-freescale-imx8m-pcie-refine-i.mx8mm-pcie-phy-dri.patch
@@ -0,0 +1,209 @@
+From e7f2fd1ecbbfd286389e6c10f8dbc3b4d476c3ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Oct 2022 09:47:01 +0800
+Subject: phy: freescale: imx8m-pcie: Refine i.MX8MM PCIe PHY driver
+
+From: Richard Zhu <hongxing.zhu@nxp.com>
+
+[ Upstream commit ca679c49c4463595499a053ba94328acb574fffa ]
+
+To make it more flexible and easy to expand. Refine i.MX8MM PCIe PHY
+driver.
+- Use gpr compatible string to avoid the codes duplications when add
+  another platform PCIe PHY support.
+- Re-arrange the codes to let it more flexible and easy to expand.
+No functional change. Re-arrange the TX tuning, since internal registers
+can be wrote through APB interface before assertion of CMN_RST.
+
+Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Tested-by: Marek Vasut <marex@denx.de>
+Tested-by: Richard Leitner <richard.leitner@skidata.com>
+Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Link: https://lore.kernel.org/r/1665625622-20551-4-git-send-email-hongxing.zhu@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Stable-dep-of: 3a161017f1de ("phy: freescale: imx8m-pcie: fix pcie link-up instability")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 106 +++++++++++++--------
+ 1 file changed, 66 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
+index c93286483b425..f1476936b8d9a 100644
+--- a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
++++ b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
+@@ -11,6 +11,7 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/mfd/syscon/imx7-iomuxc-gpr.h>
+ #include <linux/module.h>
++#include <linux/of_device.h>
+ #include <linux/phy/phy.h>
+ #include <linux/platform_device.h>
+ #include <linux/regmap.h>
+@@ -47,6 +48,15 @@
+ #define IMX8MM_GPR_PCIE_SSC_EN		BIT(16)
+ #define IMX8MM_GPR_PCIE_AUX_EN_OVERRIDE	BIT(9)
+ 
++enum imx8_pcie_phy_type {
++	IMX8MM,
++};
++
++struct imx8_pcie_phy_drvdata {
++	const	char			*gpr;
++	enum	imx8_pcie_phy_type	variant;
++};
++
+ struct imx8_pcie_phy {
+ 	void __iomem		*base;
+ 	struct clk		*clk;
+@@ -57,6 +67,7 @@ struct imx8_pcie_phy {
+ 	u32			tx_deemph_gen1;
+ 	u32			tx_deemph_gen2;
+ 	bool			clkreq_unused;
++	const struct imx8_pcie_phy_drvdata	*drvdata;
+ };
+ 
+ static int imx8_pcie_phy_power_on(struct phy *phy)
+@@ -68,31 +79,17 @@ static int imx8_pcie_phy_power_on(struct phy *phy)
+ 	reset_control_assert(imx8_phy->reset);
+ 
+ 	pad_mode = imx8_phy->refclk_pad_mode;
+-	/* Set AUX_EN_OVERRIDE 1'b0, when the CLKREQ# isn't hooked */
+-	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
+-			   IMX8MM_GPR_PCIE_AUX_EN_OVERRIDE,
+-			   imx8_phy->clkreq_unused ?
+-			   0 : IMX8MM_GPR_PCIE_AUX_EN_OVERRIDE);
+-	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
+-			   IMX8MM_GPR_PCIE_AUX_EN,
+-			   IMX8MM_GPR_PCIE_AUX_EN);
+-	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
+-			   IMX8MM_GPR_PCIE_POWER_OFF, 0);
+-	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
+-			   IMX8MM_GPR_PCIE_SSC_EN, 0);
+-
+-	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
+-			   IMX8MM_GPR_PCIE_REF_CLK_SEL,
+-			   pad_mode == IMX8_PCIE_REFCLK_PAD_INPUT ?
+-			   IMX8MM_GPR_PCIE_REF_CLK_EXT :
+-			   IMX8MM_GPR_PCIE_REF_CLK_PLL);
+-	usleep_range(100, 200);
+-
+-	/* Do the PHY common block reset */
+-	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
+-			   IMX8MM_GPR_PCIE_CMN_RST,
+-			   IMX8MM_GPR_PCIE_CMN_RST);
+-	usleep_range(200, 500);
++	switch (imx8_phy->drvdata->variant) {
++	case IMX8MM:
++		/* Tune PHY de-emphasis setting to pass PCIe compliance. */
++		if (imx8_phy->tx_deemph_gen1)
++			writel(imx8_phy->tx_deemph_gen1,
++			       imx8_phy->base + PCIE_PHY_TRSV_REG5);
++		if (imx8_phy->tx_deemph_gen2)
++			writel(imx8_phy->tx_deemph_gen2,
++			       imx8_phy->base + PCIE_PHY_TRSV_REG6);
++		break;
++	}
+ 
+ 	if (pad_mode == IMX8_PCIE_REFCLK_PAD_INPUT ||
+ 	    pad_mode == IMX8_PCIE_REFCLK_PAD_UNUSED) {
+@@ -120,15 +117,37 @@ static int imx8_pcie_phy_power_on(struct phy *phy)
+ 		       imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG065);
+ 	}
+ 
+-	/* Tune PHY de-emphasis setting to pass PCIe compliance. */
+-	if (imx8_phy->tx_deemph_gen1)
+-		writel(imx8_phy->tx_deemph_gen1,
+-		       imx8_phy->base + PCIE_PHY_TRSV_REG5);
+-	if (imx8_phy->tx_deemph_gen2)
+-		writel(imx8_phy->tx_deemph_gen2,
+-		       imx8_phy->base + PCIE_PHY_TRSV_REG6);
++	/* Set AUX_EN_OVERRIDE 1'b0, when the CLKREQ# isn't hooked */
++	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
++			   IMX8MM_GPR_PCIE_AUX_EN_OVERRIDE,
++			   imx8_phy->clkreq_unused ?
++			   0 : IMX8MM_GPR_PCIE_AUX_EN_OVERRIDE);
++	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
++			   IMX8MM_GPR_PCIE_AUX_EN,
++			   IMX8MM_GPR_PCIE_AUX_EN);
++	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
++			   IMX8MM_GPR_PCIE_POWER_OFF, 0);
++	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
++			   IMX8MM_GPR_PCIE_SSC_EN, 0);
+ 
+-	reset_control_deassert(imx8_phy->reset);
++	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
++			   IMX8MM_GPR_PCIE_REF_CLK_SEL,
++			   pad_mode == IMX8_PCIE_REFCLK_PAD_INPUT ?
++			   IMX8MM_GPR_PCIE_REF_CLK_EXT :
++			   IMX8MM_GPR_PCIE_REF_CLK_PLL);
++	usleep_range(100, 200);
++
++	/* Do the PHY common block reset */
++	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
++			   IMX8MM_GPR_PCIE_CMN_RST,
++			   IMX8MM_GPR_PCIE_CMN_RST);
++
++	switch (imx8_phy->drvdata->variant) {
++	case IMX8MM:
++		reset_control_deassert(imx8_phy->reset);
++		usleep_range(200, 500);
++		break;
++	}
+ 
+ 	/* Polling to check the phy is ready or not. */
+ 	ret = readl_poll_timeout(imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG75,
+@@ -160,6 +179,17 @@ static const struct phy_ops imx8_pcie_phy_ops = {
+ 	.owner		= THIS_MODULE,
+ };
+ 
++static const struct imx8_pcie_phy_drvdata imx8mm_drvdata = {
++	.gpr = "fsl,imx8mm-iomuxc-gpr",
++	.variant = IMX8MM,
++};
++
++static const struct of_device_id imx8_pcie_phy_of_match[] = {
++	{.compatible = "fsl,imx8mm-pcie-phy", .data = &imx8mm_drvdata, },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, imx8_pcie_phy_of_match);
++
+ static int imx8_pcie_phy_probe(struct platform_device *pdev)
+ {
+ 	struct phy_provider *phy_provider;
+@@ -172,6 +202,8 @@ static int imx8_pcie_phy_probe(struct platform_device *pdev)
+ 	if (!imx8_phy)
+ 		return -ENOMEM;
+ 
++	imx8_phy->drvdata = of_device_get_match_data(dev);
++
+ 	/* get PHY refclk pad mode */
+ 	of_property_read_u32(np, "fsl,refclk-pad-mode",
+ 			     &imx8_phy->refclk_pad_mode);
+@@ -197,7 +229,7 @@ static int imx8_pcie_phy_probe(struct platform_device *pdev)
+ 
+ 	/* Grab GPR config register range */
+ 	imx8_phy->iomuxc_gpr =
+-		 syscon_regmap_lookup_by_compatible("fsl,imx6q-iomuxc-gpr");
++		 syscon_regmap_lookup_by_compatible(imx8_phy->drvdata->gpr);
+ 	if (IS_ERR(imx8_phy->iomuxc_gpr)) {
+ 		dev_err(dev, "unable to find iomuxc registers\n");
+ 		return PTR_ERR(imx8_phy->iomuxc_gpr);
+@@ -225,12 +257,6 @@ static int imx8_pcie_phy_probe(struct platform_device *pdev)
+ 	return PTR_ERR_OR_ZERO(phy_provider);
+ }
+ 
+-static const struct of_device_id imx8_pcie_phy_of_match[] = {
+-	{.compatible = "fsl,imx8mm-pcie-phy",},
+-	{ },
+-};
+-MODULE_DEVICE_TABLE(of, imx8_pcie_phy_of_match);
+-
+ static struct platform_driver imx8_pcie_phy_driver = {
+ 	.probe	= imx8_pcie_phy_probe,
+ 	.driver = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/phy-marvell-a3700-comphy-fix-hardcoded-array-size.patch b/queue-6.1/phy-marvell-a3700-comphy-fix-hardcoded-array-size.patch
new file mode 100644
index 0000000000..ccc893fb9d
--- /dev/null
+++ b/queue-6.1/phy-marvell-a3700-comphy-fix-hardcoded-array-size.patch
@@ -0,0 +1,36 @@
+From e3bb191047e4142a59161e54f8c7b5c7b33b9a69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2024 19:47:31 +0300
+Subject: phy: marvell: a3700-comphy: Fix hardcoded array size
+
+From: Mikhail Kobuk <m.kobuk@ispras.ru>
+
+[ Upstream commit 627207703b73615653eea5ab7a841d5b478d961e ]
+
+Replace hardcoded 'gbe_phy_init' array size by explicit one.
+
+Fixes: 934337080c6c ("phy: marvell: phy-mvebu-a3700-comphy: Add native kernel implementation")
+Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru>
+Link: https://lore.kernel.org/r/20240321164734.49273-2-m.kobuk@ispras.ru
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-a3700-comphy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
+index 392a8ae1bc667..251e1aedd4a6e 100644
+--- a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
++++ b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
+@@ -602,7 +602,7 @@ static void comphy_gbe_phy_init(struct mvebu_a3700_comphy_lane *lane,
+ 	u16 val;
+ 
+ 	fix_idx = 0;
+-	for (addr = 0; addr < 512; addr++) {
++	for (addr = 0; addr < ARRAY_SIZE(gbe_phy_init); addr++) {
+ 		/*
+ 		 * All PHY register values are defined in full for 3.125Gbps
+ 		 * SERDES speed. The values required for 1.25 Gbps are almost
+-- 
+2.43.0
+
diff --git a/queue-6.1/phy-marvell-a3700-comphy-fix-out-of-bounds-read.patch b/queue-6.1/phy-marvell-a3700-comphy-fix-out-of-bounds-read.patch
new file mode 100644
index 0000000000..858c69b961
--- /dev/null
+++ b/queue-6.1/phy-marvell-a3700-comphy-fix-out-of-bounds-read.patch
@@ -0,0 +1,50 @@
+From 52cd01edf91c436ea0455b1d5349bbab92c9b240 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2024 19:47:30 +0300
+Subject: phy: marvell: a3700-comphy: Fix out of bounds read
+
+From: Mikhail Kobuk <m.kobuk@ispras.ru>
+
+[ Upstream commit e4308bc22b9d46cf33165c9dfaeebcf29cd56f04 ]
+
+There is an out of bounds read access of 'gbe_phy_init_fix[fix_idx].addr'
+every iteration after 'fix_idx' reaches 'ARRAY_SIZE(gbe_phy_init_fix)'.
+
+Make sure 'gbe_phy_init[addr]' is used when all elements of
+'gbe_phy_init_fix' array are handled.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 934337080c6c ("phy: marvell: phy-mvebu-a3700-comphy: Add native kernel implementation")
+Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/r/20240321164734.49273-1-m.kobuk@ispras.ru
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-a3700-comphy.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
+index d641b345afa35..392a8ae1bc667 100644
+--- a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
++++ b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
+@@ -610,11 +610,12 @@ static void comphy_gbe_phy_init(struct mvebu_a3700_comphy_lane *lane,
+ 		 * comparison to 3.125 Gbps values. These register values are
+ 		 * stored in "gbe_phy_init_fix" array.
+ 		 */
+-		if (!is_1gbps && gbe_phy_init_fix[fix_idx].addr == addr) {
++		if (!is_1gbps &&
++		    fix_idx < ARRAY_SIZE(gbe_phy_init_fix) &&
++		    gbe_phy_init_fix[fix_idx].addr == addr) {
+ 			/* Use new value */
+ 			val = gbe_phy_init_fix[fix_idx].value;
+-			if (fix_idx < ARRAY_SIZE(gbe_phy_init_fix))
+-				fix_idx++;
++			fix_idx++;
+ 		} else {
+ 			val = gbe_phy_init[addr];
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/phy-rockchip-snps-pcie3-fix-bifurcation-on-rk3588.patch b/queue-6.1/phy-rockchip-snps-pcie3-fix-bifurcation-on-rk3588.patch
new file mode 100644
index 0000000000..e19ee0bc0d
--- /dev/null
+++ b/queue-6.1/phy-rockchip-snps-pcie3-fix-bifurcation-on-rk3588.patch
@@ -0,0 +1,105 @@
+From 2198429056e36d41e7e000215dbaef8e2459fdb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Apr 2024 19:11:26 +0200
+Subject: phy: rockchip-snps-pcie3: fix bifurcation on rk3588
+
+From: Michal Tomek <mtdev79b@gmail.com>
+
+[ Upstream commit f8020dfb311d2b6cf657668792aaa5fa8863a7dd ]
+
+So far all RK3588 boards use fully aggregated PCIe. CM3588 is one
+of the few boards using this feature and apparently it is broken.
+
+The PHY offers the following mapping options:
+
+  port 0 lane 0 - always mapped to controller 0 (4L)
+  port 0 lane 1 - to controller 0 or 2 (1L0)
+  port 1 lane 0 - to controller 0 or 1 (2L)
+  port 1 lane 1 - to controller 0, 1 or 3 (1L1)
+
+The data-lanes DT property maps these as follows:
+
+  0 = no controller (unsupported by the HW)
+  1 = 4L
+  2 = 2L
+  3 = 1L0
+  4 = 1L1
+
+That allows the following configurations with first column being the
+mainline data-lane mapping, second column being the downstream name,
+third column being PCIE3PHY_GRF_CMN_CON0 and PHP_GRF_PCIESEL register
+values and final column being the user visible lane setup:
+
+  <1 1 1 1> = AGGREG = [4 0] = x4 (aggregation)
+  <1 1 2 2> = NANBNB = [0 0] = x2 x2 (no bif.)
+  <1 3 2 2> = NANBBI = [1 1] = x2 x1x1 (bif. of port 0)
+  <1 1 2 4> = NABINB = [2 2] = x1x1 x2 (bif. of port 1)
+  <1 3 2 4> = NABIBI = [3 3] = x1x1 x1x1 (bif. of both ports)
+
+The driver currently does not program PHP_GRF_PCIESEL correctly, which
+is fixed by this patch. As a side-effect the new logic is much simpler
+than the old logic.
+
+Fixes: 2e9bffc4f713 ("phy: rockchip: Support PCIe v3")
+Signed-off-by: Michal Tomek <mtdev79b@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Acked-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20240404-rk3588-pcie-bifurcation-fixes-v1-1-9907136eeafd@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../phy/rockchip/phy-rockchip-snps-pcie3.c    | 24 +++++++------------
+ 1 file changed, 8 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c b/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c
+index 1d355b32ba559..4f32a2dc24580 100644
+--- a/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c
++++ b/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c
+@@ -131,7 +131,7 @@ static const struct rockchip_p3phy_ops rk3568_ops = {
+ static int rockchip_p3phy_rk3588_init(struct rockchip_p3phy_priv *priv)
+ {
+ 	u32 reg = 0;
+-	u8 mode = 0;
++	u8 mode = RK3588_LANE_AGGREGATION; /* default */
+ 	int ret;
+ 
+ 	/* Deassert PCIe PMA output clamp mode */
+@@ -139,28 +139,20 @@ static int rockchip_p3phy_rk3588_init(struct rockchip_p3phy_priv *priv)
+ 
+ 	/* Set bifurcation if needed */
+ 	for (int i = 0; i < priv->num_lanes; i++) {
+-		if (!priv->lanes[i])
+-			mode |= (BIT(i) << 3);
+-
+ 		if (priv->lanes[i] > 1)
+-			mode |= (BIT(i) >> 1);
+-	}
+-
+-	if (!mode)
+-		reg = RK3588_LANE_AGGREGATION;
+-	else {
+-		if (mode & (BIT(0) | BIT(1)))
+-			reg |= RK3588_BIFURCATION_LANE_0_1;
+-
+-		if (mode & (BIT(2) | BIT(3)))
+-			reg |= RK3588_BIFURCATION_LANE_2_3;
++			mode &= ~RK3588_LANE_AGGREGATION;
++		if (priv->lanes[i] == 3)
++			mode |= RK3588_BIFURCATION_LANE_0_1;
++		if (priv->lanes[i] == 4)
++			mode |= RK3588_BIFURCATION_LANE_2_3;
+ 	}
+ 
++	reg = mode;
+ 	regmap_write(priv->phy_grf, RK3588_PCIE3PHY_GRF_CMN_CON0, (0x7<<16) | reg);
+ 
+ 	/* Set pcie1ln_sel in PHP_GRF_PCIESEL_CON */
+ 	if (!IS_ERR(priv->pipe_grf)) {
+-		reg = (mode & (BIT(6) | BIT(7))) >> 6;
++		reg = mode & 3;
+ 		if (reg)
+ 			regmap_write(priv->pipe_grf, PHP_GRF_PCIESEL_CON,
+ 				     (reg << 16) | reg);
+-- 
+2.43.0
+
diff --git a/queue-6.1/phy-rockchip-snps-pcie3-fix-clearing-php_grf_pciesel.patch b/queue-6.1/phy-rockchip-snps-pcie3-fix-clearing-php_grf_pciesel.patch
new file mode 100644
index 0000000000..ff8ca3db28
--- /dev/null
+++ b/queue-6.1/phy-rockchip-snps-pcie3-fix-clearing-php_grf_pciesel.patch
@@ -0,0 +1,61 @@
+From b3e12d60581fe07a95eb1ac381f4d542c9cc8412 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Apr 2024 19:11:27 +0200
+Subject: phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit 55491a5fa163bf15158f34f3650b3985f25622b9 ]
+
+Currently the PCIe v3 PHY driver only sets the pcie1ln_sel bits, but
+does not clear them because of an incorrect write mask. This fixes up
+the issue by using a newly introduced constant for the write mask.
+
+While at it also introduces a proper GENMASK based constant for the
+PCIE30_PHY_MODE.
+
+Fixes: 2e9bffc4f713 ("phy: rockchip: Support PCIe v3")
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20240404-rk3588-pcie-bifurcation-fixes-v1-2-9907136eeafd@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-snps-pcie3.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c b/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c
+index 4f32a2dc24580..c6aa6bc69e900 100644
+--- a/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c
++++ b/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c
+@@ -39,6 +39,8 @@
+ #define RK3588_BIFURCATION_LANE_0_1		BIT(0)
+ #define RK3588_BIFURCATION_LANE_2_3		BIT(1)
+ #define RK3588_LANE_AGGREGATION		BIT(2)
++#define RK3588_PCIE1LN_SEL_EN			(GENMASK(1, 0) << 16)
++#define RK3588_PCIE30_PHY_MODE_EN		(GENMASK(2, 0) << 16)
+ 
+ struct rockchip_p3phy_ops;
+ 
+@@ -148,14 +150,15 @@ static int rockchip_p3phy_rk3588_init(struct rockchip_p3phy_priv *priv)
+ 	}
+ 
+ 	reg = mode;
+-	regmap_write(priv->phy_grf, RK3588_PCIE3PHY_GRF_CMN_CON0, (0x7<<16) | reg);
++	regmap_write(priv->phy_grf, RK3588_PCIE3PHY_GRF_CMN_CON0,
++		     RK3588_PCIE30_PHY_MODE_EN | reg);
+ 
+ 	/* Set pcie1ln_sel in PHP_GRF_PCIESEL_CON */
+ 	if (!IS_ERR(priv->pipe_grf)) {
+-		reg = mode & 3;
++		reg = mode & (RK3588_BIFURCATION_LANE_0_1 | RK3588_BIFURCATION_LANE_2_3);
+ 		if (reg)
+ 			regmap_write(priv->pipe_grf, PHP_GRF_PCIESEL_CON,
+-				     (reg << 16) | reg);
++				     RK3588_PCIE1LN_SEL_EN | reg);
+ 	}
+ 
+ 	reset_control_deassert(priv->p30phy);
+-- 
+2.43.0
+
diff --git a/queue-6.1/phy-ti-tusb1210-resolve-charger-det-crash-if-charger.patch b/queue-6.1/phy-ti-tusb1210-resolve-charger-det-crash-if-charger.patch
new file mode 100644
index 0000000000..1ca1ef9d51
--- /dev/null
+++ b/queue-6.1/phy-ti-tusb1210-resolve-charger-det-crash-if-charger.patch
@@ -0,0 +1,94 @@
+From a90dccc40f00620bb9b7ad5458cde68f52f84f22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Apr 2024 16:08:21 +0200
+Subject: phy: ti: tusb1210: Resolve charger-det crash if charger psy is
+ unregistered
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052 ]
+
+The power_supply frame-work is not really designed for there to be
+long living in kernel references to power_supply devices.
+
+Specifically unregistering a power_supply while some other code has
+a reference to it triggers a WARN in power_supply_unregister():
+
+	WARN_ON(atomic_dec_return(&psy->use_cnt));
+
+Folllowed by the power_supply still getting removed and the
+backing data freed anyway, leaving the tusb1210 charger-detect code
+with a dangling reference, resulting in a crash the next time
+tusb1210_get_online() is called.
+
+Fix this by only holding the reference in tusb1210_get_online()
+freeing it at the end of the function. Note this still leaves
+a theoretical race window, but it avoids the issue when manually
+rmmod-ing the charger chip driver during development.
+
+Fixes: 48969a5623ed ("phy: ti: tusb1210: Add charger detection")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240406140821.18624-1-hdegoede@redhat.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-tusb1210.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/phy/ti/phy-tusb1210.c b/drivers/phy/ti/phy-tusb1210.c
+index 669c13d6e402f..bdd44ec3e8098 100644
+--- a/drivers/phy/ti/phy-tusb1210.c
++++ b/drivers/phy/ti/phy-tusb1210.c
+@@ -64,7 +64,6 @@ struct tusb1210 {
+ 	struct delayed_work chg_det_work;
+ 	struct notifier_block psy_nb;
+ 	struct power_supply *psy;
+-	struct power_supply *charger;
+ #endif
+ };
+ 
+@@ -230,19 +229,24 @@ static const char * const tusb1210_chargers[] = {
+ 
+ static bool tusb1210_get_online(struct tusb1210 *tusb)
+ {
++	struct power_supply *charger = NULL;
+ 	union power_supply_propval val;
+-	int i;
++	bool online = false;
++	int i, ret;
+ 
+-	for (i = 0; i < ARRAY_SIZE(tusb1210_chargers) && !tusb->charger; i++)
+-		tusb->charger = power_supply_get_by_name(tusb1210_chargers[i]);
++	for (i = 0; i < ARRAY_SIZE(tusb1210_chargers) && !charger; i++)
++		charger = power_supply_get_by_name(tusb1210_chargers[i]);
+ 
+-	if (!tusb->charger)
++	if (!charger)
+ 		return false;
+ 
+-	if (power_supply_get_property(tusb->charger, POWER_SUPPLY_PROP_ONLINE, &val))
+-		return false;
++	ret = power_supply_get_property(charger, POWER_SUPPLY_PROP_ONLINE, &val);
++	if (ret == 0)
++		online = val.intval;
++
++	power_supply_put(charger);
+ 
+-	return val.intval;
++	return online;
+ }
+ 
+ static void tusb1210_chg_det_work(struct work_struct *work)
+@@ -466,9 +470,6 @@ static void tusb1210_remove_charger_detect(struct tusb1210 *tusb)
+ 		cancel_delayed_work_sync(&tusb->chg_det_work);
+ 		power_supply_unregister(tusb->psy);
+ 	}
+-
+-	if (tusb->charger)
+-		power_supply_put(tusb->charger);
+ }
+ #else
+ static void tusb1210_probe_charger_detect(struct tusb1210 *tusb) { }
+-- 
+2.43.0
+
diff --git a/queue-6.1/riscv-fix-task_size-on-64-bit-nommu.patch b/queue-6.1/riscv-fix-task_size-on-64-bit-nommu.patch
new file mode 100644
index 0000000000..c4e22892eb
--- /dev/null
+++ b/queue-6.1/riscv-fix-task_size-on-64-bit-nommu.patch
@@ -0,0 +1,41 @@
+From 9bb2f6a562f4970b0c432325f368f52d0af7669b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 16:34:46 -0800
+Subject: riscv: Fix TASK_SIZE on 64-bit NOMMU
+
+From: Samuel Holland <samuel.holland@sifive.com>
+
+[ Upstream commit 6065e736f82c817c9a597a31ee67f0ce4628e948 ]
+
+On NOMMU, userspace memory can come from anywhere in physical RAM. The
+current definition of TASK_SIZE is wrong if any RAM exists above 4G,
+causing spurious failures in the userspace access routines.
+
+Fixes: 6bd33e1ece52 ("riscv: add nommu support")
+Fixes: c3f896dcf1e4 ("mm: switch the test_vmalloc module to use __vmalloc_node")
+Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
+Reviewed-by: Jisheng Zhang <jszhang@kernel.org>
+Reviewed-by: Bo Gan <ganboing@gmail.com>
+Link: https://lore.kernel.org/r/20240227003630.3634533-2-samuel.holland@sifive.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/pgtable.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
+index 73fe12c93cad1..2d9416a6a070e 100644
+--- a/arch/riscv/include/asm/pgtable.h
++++ b/arch/riscv/include/asm/pgtable.h
+@@ -799,7 +799,7 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
+ #define PAGE_SHARED		__pgprot(0)
+ #define PAGE_KERNEL		__pgprot(0)
+ #define swapper_pg_dir		NULL
+-#define TASK_SIZE		0xffffffffUL
++#define TASK_SIZE		_AC(-1, UL)
+ #define VMALLOC_START		_AC(0, UL)
+ #define VMALLOC_END		TASK_SIZE
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/riscv-fix-vmalloc_start-definition.patch b/queue-6.1/riscv-fix-vmalloc_start-definition.patch
new file mode 100644
index 0000000000..82c53d88c0
--- /dev/null
+++ b/queue-6.1/riscv-fix-vmalloc_start-definition.patch
@@ -0,0 +1,70 @@
+From 3f55d34d1417ce68e64a12aea5d368aa6e47e2f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 11:02:55 +0800
+Subject: riscv: fix VMALLOC_START definition
+
+From: Baoquan He <bhe@redhat.com>
+
+[ Upstream commit ac88ff6b9d7dea9f0907c86bdae204dde7d5c0e6 ]
+
+When below config items are set, compiler complained:
+
+--------------------
+CONFIG_CRASH_CORE=y
+CONFIG_KEXEC_CORE=y
+CONFIG_CRASH_DUMP=y
+......
+-----------------------
+
+-------------------------------------------------------------------
+arch/riscv/kernel/crash_core.c: In function 'arch_crash_save_vmcoreinfo':
+arch/riscv/kernel/crash_core.c:11:58: warning: format '%lx' expects argument of type 'long unsigned int', but argument 2 has type 'int' [-Wformat=]
+11 |         vmcoreinfo_append_str("NUMBER(VMALLOC_START)=0x%lx\n", VMALLOC_START);
+   |                                                        ~~^
+   |                                                          |
+   |                                                          long unsigned int
+   |                                                        %x
+----------------------------------------------------------------------
+
+This is because on riscv macro VMALLOC_START has different type when
+CONFIG_MMU is set or unset.
+
+arch/riscv/include/asm/pgtable.h:
+--------------------------------------------------
+
+Changing it to _AC(0, UL) in case CONFIG_MMU=n can fix the warning.
+
+Link: https://lkml.kernel.org/r/ZW7OsX4zQRA3mO4+@MiWiFi-R3L-srv
+Signed-off-by: Baoquan He <bhe@redhat.com>
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org>	# build-tested
+Cc: Eric DeVolder <eric_devolder@yahoo.com>
+Cc: Ignat Korchagin <ignat@cloudflare.com>
+Cc: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: 6065e736f82c ("riscv: Fix TASK_SIZE on 64-bit NOMMU")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/pgtable.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
+index 63055c6ad2c25..73fe12c93cad1 100644
+--- a/arch/riscv/include/asm/pgtable.h
++++ b/arch/riscv/include/asm/pgtable.h
+@@ -800,7 +800,7 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
+ #define PAGE_KERNEL		__pgprot(0)
+ #define swapper_pg_dir		NULL
+ #define TASK_SIZE		0xffffffffUL
+-#define VMALLOC_START		0
++#define VMALLOC_START		_AC(0, UL)
+ #define VMALLOC_END		TASK_SIZE
+ 
+ #endif /* !CONFIG_MMU */
+-- 
+2.43.0
+
diff --git a/queue-6.1/series b/queue-6.1/series
index b82eedd9d1..762910d9c9 100644
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -89,3 +89,18 @@ udp-preserve-the-connected-status-if-only-udp-cmsg.patch
 mtd-diskonchip-work-around-ubsan-link-failure.patch
 rust-remove-params-from-module-macro-example.patch
 x86-tdx-preserve-shared-bit-on-mprotect.patch
+dmaengine-owl-fix-register-access-functions.patch
+dmaengine-tegra186-fix-residual-calculation.patch
+idma64-don-t-try-to-serve-interrupts-when-device-is-.patch
+phy-marvell-a3700-comphy-fix-out-of-bounds-read.patch
+phy-marvell-a3700-comphy-fix-hardcoded-array-size.patch
+phy-freescale-imx8m-pcie-refine-i.mx8mm-pcie-phy-dri.patch
+phy-freescale-imx8m-pcie-fix-pcie-link-up-instabilit.patch
+phy-rockchip-snps-pcie3-fix-bifurcation-on-rk3588.patch
+phy-rockchip-snps-pcie3-fix-clearing-php_grf_pciesel.patch
+dma-xilinx_dpdma-fix-locking.patch
+dmaengine-idxd-fix-oops-during-rmmod-on-single-cpu-p.patch
+riscv-fix-vmalloc_start-definition.patch
+riscv-fix-task_size-on-64-bit-nommu.patch
+phy-ti-tusb1210-resolve-charger-det-crash-if-charger.patch
+i2c-smbus-fix-null-function-pointer-dereference.patch