aosp/android-mainline: update series (rebase onto v6.5-9100-ge7e9423db4594)

up to ea2c5c741ff8e ("Merge e7e9423db459 ("Merge tag 'v6.6-vfs.super.fixes.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs") into android-mainline")

Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I1f70db51e1cea4b04a00141b01b3a962db0639a5

20 files changed, 68 insertions, 966 deletions

diff --git a/android-mainline/ANDROID-Allow-DRM_IOCTL_MODE_-_DUMB-for-render-clients.patch b/android-mainline/ANDROID-Allow-DRM_IOCTL_MODE_-_DUMB-for-render-clients.patch
index 371898ef..9480ad91 100644
--- a/android-mainline/ANDROID-Allow-DRM_IOCTL_MODE_-_DUMB-for-render-clients.patch
+++ b/android-mainline/ANDROID-Allow-DRM_IOCTL_MODE_-_DUMB-for-render-clients.patch
@@ -22,7 +22,7 @@ Signed-off-by: Lee Jones <joneslee@google.com>
 diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
 --- a/drivers/gpu/drm/drm_ioctl.c
 +++ b/drivers/gpu/drm/drm_ioctl.c
-@@ -678,9 +678,9 @@ static const struct drm_ioctl_desc drm_ioctls[] = {
+@@ -677,9 +677,9 @@ static const struct drm_ioctl_desc drm_ioctls[] = {
  	DRM_IOCTL_DEF(DRM_IOCTL_MODE_RMFB, drm_mode_rmfb_ioctl, 0),
  	DRM_IOCTL_DEF(DRM_IOCTL_MODE_PAGE_FLIP, drm_mode_page_flip_ioctl, DRM_MASTER),
  	DRM_IOCTL_DEF(DRM_IOCTL_MODE_DIRTYFB, drm_mode_dirtyfb_ioctl, DRM_MASTER),
diff --git a/android-mainline/ANDROID-Initial-commit-of-Incremental-FS.patch b/android-mainline/ANDROID-Initial-commit-of-Incremental-FS.patch
index 2ea50549..4a394614 100644
--- a/android-mainline/ANDROID-Initial-commit-of-Incremental-FS.patch
+++ b/android-mainline/ANDROID-Initial-commit-of-Incremental-FS.patch
@@ -230,7 +230,7 @@ new file mode 100644
 diff --git a/MAINTAINERS b/MAINTAINERS
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -10202,6 +10202,13 @@ F:	Documentation/hwmon/ina2xx.rst
+@@ -10222,6 +10222,13 @@ F:	Documentation/hwmon/ina2xx.rst
  F:	drivers/hwmon/ina2xx.c
  F:	include/linux/platform_data/ina2xx.h
  
diff --git a/android-mainline/ANDROID-SoC-core-Introduce-macro-SOC_SINGLE_MULTI_EXT.patch b/android-mainline/ANDROID-SoC-core-Introduce-macro-SOC_SINGLE_MULTI_EXT.patch
index ae0f0324..8305103f 100644
--- a/android-mainline/ANDROID-SoC-core-Introduce-macro-SOC_SINGLE_MULTI_EXT.patch
+++ b/android-mainline/ANDROID-SoC-core-Introduce-macro-SOC_SINGLE_MULTI_EXT.patch
@@ -46,7 +46,7 @@ diff --git a/include/sound/soc.h b/include/sound/soc.h
  
  enum snd_soc_trigger_order {
  						/* start			stop		     */
-@@ -1191,6 +1201,11 @@ struct soc_mreg_control {
+@@ -1192,6 +1202,11 @@ struct soc_mreg_control {
  	unsigned int regbase, regcount, nbits, invert;
  };
  
@@ -61,7 +61,7 @@ diff --git a/include/sound/soc.h b/include/sound/soc.h
 diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
 --- a/sound/soc/soc-core.c
 +++ b/sound/soc/soc-core.c
-@@ -3259,6 +3259,39 @@ int snd_soc_get_dai_id(struct device_node *ep)
+@@ -3356,6 +3356,39 @@ int snd_soc_get_dai_id(struct device_node *ep)
  }
  EXPORT_SYMBOL_GPL(snd_soc_get_dai_id);
  
diff --git a/android-mainline/ANDROID-add-dma-buf-namespace-to-system_heap.c-cma_heap.c.patch b/android-mainline/ANDROID-add-dma-buf-namespace-to-system_heap.c-cma_heap.c.patch
index a318af96..1be2c181 100644
--- a/android-mainline/ANDROID-add-dma-buf-namespace-to-system_heap.c-cma_heap.c.patch
+++ b/android-mainline/ANDROID-add-dma-buf-namespace-to-system_heap.c-cma_heap.c.patch
@@ -21,7 +21,7 @@ Signed-off-by: Lee Jones <joneslee@google.com>
 diff --git a/drivers/dma-buf/heaps/cma_heap.c b/drivers/dma-buf/heaps/cma_heap.c
 --- a/drivers/dma-buf/heaps/cma_heap.c
 +++ b/drivers/dma-buf/heaps/cma_heap.c
-@@ -409,3 +409,4 @@ static int add_default_cma_heap(void)
+@@ -406,3 +406,4 @@ static int add_default_cma_heap(void)
  }
  module_init(add_default_cma_heap);
  MODULE_DESCRIPTION("DMA-BUF CMA Heap");
@@ -29,7 +29,7 @@ diff --git a/drivers/dma-buf/heaps/cma_heap.c b/drivers/dma-buf/heaps/cma_heap.c
 diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c
 --- a/drivers/dma-buf/heaps/system_heap.c
 +++ b/drivers/dma-buf/heaps/system_heap.c
-@@ -518,3 +518,4 @@ static int system_heap_create(void)
+@@ -515,3 +515,4 @@ static int system_heap_create(void)
  	return 0;
  }
  module_init(system_heap_create);
diff --git a/android-mainline/ANDROID-dma-buf-Add-support-for-partial-cache-maintenance.patch b/android-mainline/ANDROID-dma-buf-Add-support-for-partial-cache-maintenance.patch
index 513f8e4a..64451bb4 100644
--- a/android-mainline/ANDROID-dma-buf-Add-support-for-partial-cache-maintenance.patch
+++ b/android-mainline/ANDROID-dma-buf-Add-support-for-partial-cache-maintenance.patch
@@ -30,7 +30,7 @@ Signed-off-by: Lee Jones <joneslee@google.com>
 diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
 --- a/drivers/dma-buf/dma-buf.c
 +++ b/drivers/dma-buf/dma-buf.c
-@@ -1417,6 +1417,30 @@ int dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
+@@ -1412,6 +1412,30 @@ int dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
  }
  EXPORT_SYMBOL_NS_GPL(dma_buf_begin_cpu_access, DMA_BUF);
  
@@ -61,7 +61,7 @@ diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
  /**
   * dma_buf_end_cpu_access - Must be called after accessing a dma_buf from the
   * cpu in the kernel context. Calls end_cpu_access to allow exporter-specific
-@@ -1445,6 +1469,21 @@ int dma_buf_end_cpu_access(struct dma_buf *dmabuf,
+@@ -1440,6 +1464,21 @@ int dma_buf_end_cpu_access(struct dma_buf *dmabuf,
  }
  EXPORT_SYMBOL_NS_GPL(dma_buf_end_cpu_access, DMA_BUF);
  
diff --git a/android-mainline/ANDROID-dma-buf-Add-support-to-get-flags-associated-with-a-buffer.patch b/android-mainline/ANDROID-dma-buf-Add-support-to-get-flags-associated-with-a-buffer.patch
index aa0ba968..3514e67f 100644
--- a/android-mainline/ANDROID-dma-buf-Add-support-to-get-flags-associated-with-a-buffer.patch
+++ b/android-mainline/ANDROID-dma-buf-Add-support-to-get-flags-associated-with-a-buffer.patch
@@ -24,7 +24,7 @@ Signed-off-by: Lee Jones <joneslee@google.com>
 diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
 --- a/drivers/dma-buf/dma-buf.c
 +++ b/drivers/dma-buf/dma-buf.c
-@@ -1652,6 +1652,20 @@ void dma_buf_vunmap_unlocked(struct dma_buf *dmabuf, struct iosys_map *map)
+@@ -1641,6 +1641,20 @@ void dma_buf_vunmap_unlocked(struct dma_buf *dmabuf, struct iosys_map *map)
  }
  EXPORT_SYMBOL_NS_GPL(dma_buf_vunmap_unlocked, DMA_BUF);
  
diff --git a/android-mainline/ANDROID-dma-heap-Let-dma-heap-use-dma_map_attrs-to-map-unmap-iova.patch b/android-mainline/ANDROID-dma-heap-Let-dma-heap-use-dma_map_attrs-to-map-unmap-iova.patch
index 9f60a9fe..50cf6418 100644
--- a/android-mainline/ANDROID-dma-heap-Let-dma-heap-use-dma_map_attrs-to-map-unmap-iova.patch
+++ b/android-mainline/ANDROID-dma-heap-Let-dma-heap-use-dma_map_attrs-to-map-unmap-iova.patch
@@ -26,7 +26,7 @@ Change-Id: Idbd96c8486ad752d88d93b204daaefc605261845
 diff --git a/drivers/dma-buf/heaps/cma_heap.c b/drivers/dma-buf/heaps/cma_heap.c
 --- a/drivers/dma-buf/heaps/cma_heap.c
 +++ b/drivers/dma-buf/heaps/cma_heap.c
-@@ -100,9 +100,10 @@ static struct sg_table *cma_heap_map_dma_buf(struct dma_buf_attachment *attachme
+@@ -99,9 +99,10 @@ static struct sg_table *cma_heap_map_dma_buf(struct dma_buf_attachment *attachme
  {
  	struct dma_heap_attachment *a = attachment->priv;
  	struct sg_table *table = &a->table;
@@ -38,7 +38,7 @@ diff --git a/drivers/dma-buf/heaps/cma_heap.c b/drivers/dma-buf/heaps/cma_heap.c
  	if (ret)
  		return ERR_PTR(-ENOMEM);
  	a->mapped = true;
-@@ -114,9 +115,10 @@ static void cma_heap_unmap_dma_buf(struct dma_buf_attachment *attachment,
+@@ -113,9 +114,10 @@ static void cma_heap_unmap_dma_buf(struct dma_buf_attachment *attachment,
  				   enum dma_data_direction direction)
  {
  	struct dma_heap_attachment *a = attachment->priv;
@@ -53,7 +53,7 @@ diff --git a/drivers/dma-buf/heaps/cma_heap.c b/drivers/dma-buf/heaps/cma_heap.c
 diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c
 --- a/drivers/dma-buf/heaps/system_heap.c
 +++ b/drivers/dma-buf/heaps/system_heap.c
-@@ -136,11 +136,11 @@ static struct sg_table *system_heap_map_dma_buf(struct dma_buf_attachment *attac
+@@ -135,11 +135,11 @@ static struct sg_table *system_heap_map_dma_buf(struct dma_buf_attachment *attac
  {
  	struct dma_heap_attachment *a = attachment->priv;
  	struct sg_table *table = a->table;
@@ -67,7 +67,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  
  	ret = dma_map_sgtable(attachment->dev, table, direction, attr);
  	if (ret)
-@@ -155,10 +155,10 @@ static void system_heap_unmap_dma_buf(struct dma_buf_attachment *attachment,
+@@ -154,10 +154,10 @@ static void system_heap_unmap_dma_buf(struct dma_buf_attachment *attachment,
  				      enum dma_data_direction direction)
  {
  	struct dma_heap_attachment *a = attachment->priv;
diff --git a/android-mainline/ANDROID-overlayfs-override_creds-off-option-bypass-creator_cred.patch b/android-mainline/ANDROID-overlayfs-override_creds-off-option-bypass-creator_cred.patch
index 85ca5c5e..36ebec71 100644
--- a/android-mainline/ANDROID-overlayfs-override_creds-off-option-bypass-creator_cred.patch
+++ b/android-mainline/ANDROID-overlayfs-override_creds-off-option-bypass-creator_cred.patch
@@ -43,7 +43,7 @@ Signed-off-by: Mark Salyzyn <salyzyn@android.com>
 Signed-off-by: Daniel Rosenberg <drosen@google.com>
 Test: adb-remount-test.sh
 ---
- Documentation/filesystems/overlayfs.rst | 26 ++++++++++++++++++++++-
+ Documentation/filesystems/overlayfs.rst | 24 +++++++++++++++++++++
  fs/overlayfs/copy_up.c                  |  2 +-
  fs/overlayfs/dir.c                      | 17 ++++++++-------
  fs/overlayfs/file.c                     | 27 ++++++++++++------------
@@ -54,20 +54,11 @@ Test: adb-remount-test.sh
  fs/overlayfs/params.c                   | 10 +++++++++
  fs/overlayfs/readdir.c                  |  8 +++----
  fs/overlayfs/util.c                     | 13 ++++++++++--
- 11 files changed, 95 insertions(+), 46 deletions(-)
+ 11 files changed, 94 insertions(+), 45 deletions(-)
 
 diff --git a/Documentation/filesystems/overlayfs.rst b/Documentation/filesystems/overlayfs.rst
 --- a/Documentation/filesystems/overlayfs.rst
 +++ b/Documentation/filesystems/overlayfs.rst
-@@ -195,7 +195,7 @@ handle it in two different ways:
- 
- 1. return EXDEV error: this error is returned by rename(2) when trying to
-    move a file or directory across filesystem boundaries.  Hence
--   applications are usually prepared to hande this error (mv(1) for example
-+   applications are usually prepared to handle this error (mv(1) for example
-    recursively copies the directory tree).  This is the default behavior.
- 
- 2. If the "redirect_dir" feature is enabled, then the directory will be
 @@ -323,6 +323,30 @@ and
  The resulting access permissions should be the same.  The difference is in
  the time of copy (on-demand vs. up-front).
@@ -102,7 +93,7 @@ diff --git a/Documentation/filesystems/overlayfs.rst b/Documentation/filesystems
 diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
 --- a/fs/overlayfs/copy_up.c
 +++ b/fs/overlayfs/copy_up.c
-@@ -1107,7 +1107,7 @@ static int ovl_copy_up_flags(struct dentry *dentry, int flags)
+@@ -1147,7 +1147,7 @@ static int ovl_copy_up_flags(struct dentry *dentry, int flags)
  		dput(parent);
  		dput(next);
  	}
@@ -429,7 +420,7 @@ diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
 diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
 --- a/fs/overlayfs/namei.c
 +++ b/fs/overlayfs/namei.c
-@@ -915,7 +915,7 @@ int ovl_maybe_lookup_lowerdata(struct dentry *dentry)
+@@ -966,7 +966,7 @@ static int ovl_maybe_lookup_lowerdata(struct dentry *dentry)
  
  	old_cred = ovl_override_creds(dentry->d_sb);
  	err = ovl_lookup_data_layers(dentry, redirect, &datapath);
@@ -438,7 +429,7 @@ diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
  	if (err)
  		goto out_err;
  
-@@ -1240,7 +1240,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
+@@ -1311,7 +1311,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
  
  	ovl_dentry_init_reval(dentry, upperdentry, OVL_I_E(inode));
  
@@ -447,7 +438,7 @@ diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
  	if (origin_path) {
  		dput(origin_path->dentry);
  		kfree(origin_path);
-@@ -1264,7 +1264,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
+@@ -1335,7 +1335,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
  	kfree(upperredirect);
  out:
  	kfree(d.redirect);
@@ -456,7 +447,7 @@ diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
  	return ERR_PTR(err);
  }
  
-@@ -1317,7 +1317,7 @@ bool ovl_lower_positive(struct dentry *dentry)
+@@ -1388,7 +1388,7 @@ bool ovl_lower_positive(struct dentry *dentry)
  			dput(this);
  		}
  	}
@@ -468,7 +459,7 @@ diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
 diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
 --- a/fs/overlayfs/overlayfs.h
 +++ b/fs/overlayfs/overlayfs.h
-@@ -365,6 +365,7 @@ int ovl_want_write(struct dentry *dentry);
+@@ -402,6 +402,7 @@ int ovl_want_write(struct dentry *dentry);
  void ovl_drop_write(struct dentry *dentry);
  struct dentry *ovl_workdir(struct dentry *dentry);
  const struct cred *ovl_override_creds(struct super_block *sb);
@@ -479,7 +470,7 @@ diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
 diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
 --- a/fs/overlayfs/ovl_entry.h
 +++ b/fs/overlayfs/ovl_entry.h
-@@ -17,6 +17,7 @@ struct ovl_config {
+@@ -18,6 +18,7 @@ struct ovl_config {
  	bool metacopy;
  	bool userxattr;
  	bool ovl_volatile;
@@ -502,23 +493,23 @@ diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
  enum {
  	Opt_lowerdir,
  	Opt_upperdir,
-@@ -56,6 +61,7 @@ enum {
- 	Opt_xino,
+@@ -57,6 +62,7 @@ enum {
  	Opt_metacopy,
+ 	Opt_verity,
  	Opt_volatile,
 +	Opt_override_creds,
  };
  
  static const struct constant_table ovl_parameter_bool[] = {
-@@ -117,6 +123,7 @@ const struct fs_parameter_spec ovl_parameter_spec[] = {
- 	fsparam_enum("xino",                Opt_xino, ovl_parameter_xino),
+@@ -154,6 +160,7 @@ const struct fs_parameter_spec ovl_parameter_spec[] = {
  	fsparam_enum("metacopy",            Opt_metacopy, ovl_parameter_bool),
+ 	fsparam_enum("verity",              Opt_verity, ovl_parameter_verity),
  	fsparam_flag("volatile",            Opt_volatile),
 +	fsparam_enum("override_creds",      Opt_override_creds, ovl_parameter_bool),
  	{}
  };
  
-@@ -578,6 +585,9 @@ static int ovl_parse_param(struct fs_context *fc, struct fs_parameter *param)
+@@ -618,6 +625,9 @@ static int ovl_parse_param(struct fs_context *fc, struct fs_parameter *param)
  	case Opt_userxattr:
  		config->userxattr = true;
  		break;
@@ -570,9 +561,9 @@ diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
 diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
 --- a/fs/overlayfs/util.c
 +++ b/fs/overlayfs/util.c
-@@ -38,9 +38,18 @@ const struct cred *ovl_override_creds(struct super_block *sb)
+@@ -39,9 +39,18 @@ const struct cred *ovl_override_creds(struct super_block *sb)
  {
- 	struct ovl_fs *ofs = sb->s_fs_info;
+ 	struct ovl_fs *ofs = OVL_FS(sb);
  
 +	if (!ofs->config.override_creds)
 +		return NULL;
@@ -589,7 +580,7 @@ diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
  /*
   * Check if underlying fs supports file handles and try to determine encoding
   * type, in order to deduce maximum inode number used by fs.
-@@ -1011,7 +1020,7 @@ int ovl_nlink_start(struct dentry *dentry)
+@@ -1073,7 +1082,7 @@ int ovl_nlink_start(struct dentry *dentry)
  	 * value relative to the upper inode nlink in an upper inode xattr.
  	 */
  	err = ovl_set_nlink_upper(dentry);
@@ -598,7 +589,7 @@ diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
  
  out:
  	if (err)
-@@ -1029,7 +1038,7 @@ void ovl_nlink_end(struct dentry *dentry)
+@@ -1091,7 +1100,7 @@ void ovl_nlink_end(struct dentry *dentry)
  
  		old_cred = ovl_override_creds(dentry->d_sb);
  		ovl_cleanup_index(dentry);
diff --git a/android-mainline/ANDROID-security-selinux-Add-restricted-vendor-hook-in-avc.patch b/android-mainline/ANDROID-security-selinux-Add-restricted-vendor-hook-in-avc.patch
index ad37d41e..7bd1696f 100644
--- a/android-mainline/ANDROID-security-selinux-Add-restricted-vendor-hook-in-avc.patch
+++ b/android-mainline/ANDROID-security-selinux-Add-restricted-vendor-hook-in-avc.patch
@@ -174,7 +174,7 @@ diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
  struct selinux_policy_convert_data {
  	struct convert_context_args args;
  	struct sidtab_convert_params sidtab_params;
-@@ -2219,6 +2221,7 @@ void selinux_policy_commit(struct selinux_load_state *load_state)
+@@ -2218,6 +2220,7 @@ void selinux_policy_commit(struct selinux_load_state *load_state)
  		 */
  		selinux_mark_initialized();
  		selinux_complete_init();
diff --git a/android-mainline/ANDROID-selinux-modify-RTM_GETLINK-permission.patch b/android-mainline/ANDROID-selinux-modify-RTM_GETLINK-permission.patch
index f438a5ba..9a3a6107 100644
--- a/android-mainline/ANDROID-selinux-modify-RTM_GETLINK-permission.patch
+++ b/android-mainline/ANDROID-selinux-modify-RTM_GETLINK-permission.patch
@@ -73,8 +73,8 @@ diff --git a/security/selinux/include/security.h b/security/selinux/include/secu
  
  	struct page *status_page;
  	struct mutex status_lock;
-@@ -202,6 +204,20 @@ static inline bool selinux_policycap_ioctl_skip_cloexec(void)
- 	return READ_ONCE(state->policycap[POLICYDB_CAP_IOCTL_SKIP_CLOEXEC]);
+@@ -189,6 +191,20 @@ static inline bool selinux_policycap_ioctl_skip_cloexec(void)
+ 		selinux_state.policycap[POLICYDB_CAP_IOCTL_SKIP_CLOEXEC]);
  }
  
 +static inline bool selinux_android_nlroute_getlink(void)
@@ -94,7 +94,7 @@ diff --git a/security/selinux/include/security.h b/security/selinux/include/secu
  struct selinux_policy_convert_data;
  
  struct selinux_load_state {
-@@ -394,5 +410,6 @@ extern void avtab_cache_init(void);
+@@ -381,5 +397,6 @@ extern void avtab_cache_init(void);
  extern void ebitmap_cache_init(void);
  extern void hashtab_cache_init(void);
  extern int security_sidtab_hash_stats(char *page);
@@ -113,7 +113,7 @@ diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
  	{ RTM_NEWLINK,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  	{ RTM_DELLINK,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  	{ RTM_GETLINK,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
-@@ -216,3 +216,43 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
+@@ -217,3 +217,43 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
  
  	return err;
  }
@@ -160,7 +160,7 @@ diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
 diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
 --- a/security/selinux/ss/policydb.c
 +++ b/security/selinux/ss/policydb.c
-@@ -2489,6 +2489,14 @@ int policydb_read(struct policydb *p, void *fp)
+@@ -2494,6 +2494,14 @@ int policydb_read(struct policydb *p, void *fp)
  	p->reject_unknown = !!(le32_to_cpu(buf[1]) & REJECT_UNKNOWN);
  	p->allow_unknown = !!(le32_to_cpu(buf[1]) & ALLOW_UNKNOWN);
  
@@ -199,7 +199,7 @@ diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
 diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
 --- a/security/selinux/ss/services.c
 +++ b/security/selinux/ss/services.c
-@@ -2123,6 +2123,10 @@ static void security_load_policycaps(struct selinux_policy *policy)
+@@ -2122,6 +2122,10 @@ static void security_load_policycaps(struct selinux_policy *policy)
  			pr_info("SELinux:  unknown policy capability %u\n",
  				i);
  	}
diff --git a/android-mainline/FIXME-dma-buf-Revert-this-diff-from-android-mainline.patch b/android-mainline/FIXME-dma-buf-Revert-this-diff-from-android-mainline.patch
index 2bd0e1b1..de7c29a9 100644
--- a/android-mainline/FIXME-dma-buf-Revert-this-diff-from-android-mainline.patch
+++ b/android-mainline/FIXME-dma-buf-Revert-this-diff-from-android-mainline.patch
@@ -24,7 +24,7 @@ Change-Id: I69ba0e2316f2671029dd6b9b98421e8ce694635c
 diff --git a/drivers/dma-buf/heaps/cma_heap.c b/drivers/dma-buf/heaps/cma_heap.c
 --- a/drivers/dma-buf/heaps/cma_heap.c
 +++ b/drivers/dma-buf/heaps/cma_heap.c
-@@ -409,4 +409,5 @@ static int add_default_cma_heap(void)
+@@ -406,4 +406,5 @@ static int add_default_cma_heap(void)
  }
  module_init(add_default_cma_heap);
  MODULE_DESCRIPTION("DMA-BUF CMA Heap");
@@ -33,7 +33,7 @@ diff --git a/drivers/dma-buf/heaps/cma_heap.c b/drivers/dma-buf/heaps/cma_heap.c
 diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c
 --- a/drivers/dma-buf/heaps/system_heap.c
 +++ b/drivers/dma-buf/heaps/system_heap.c
-@@ -518,4 +518,5 @@ static int system_heap_create(void)
+@@ -515,4 +515,5 @@ static int system_heap_create(void)
  	return 0;
  }
  module_init(system_heap_create);
diff --git a/android-mainline/FROMLIST-fs-Generic-function-to-convert-iocb-to-rw-flags.patch b/android-mainline/FROMLIST-fs-Generic-function-to-convert-iocb-to-rw-flags.patch
index 78fd3e85..bb521acc 100644
--- a/android-mainline/FROMLIST-fs-Generic-function-to-convert-iocb-to-rw-flags.patch
+++ b/android-mainline/FROMLIST-fs-Generic-function-to-convert-iocb-to-rw-flags.patch
@@ -82,7 +82,7 @@ diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
 diff --git a/include/linux/fs.h b/include/linux/fs.h
 --- a/include/linux/fs.h
 +++ b/include/linux/fs.h
-@@ -3242,6 +3242,11 @@ static inline int kiocb_set_rw_flags(struct kiocb *ki, rwf_t flags)
+@@ -3243,6 +3243,11 @@ static inline int kiocb_set_rw_flags(struct kiocb *ki, rwf_t flags)
  	return 0;
  }
  
diff --git a/android-mainline/NOUPSTREAM-ANDROID-clk-qcom-Add-sync_state-clk_sync_state-for-db845c-clock-providers.patch b/android-mainline/NOUPSTREAM-ANDROID-clk-qcom-Add-sync_state-clk_sync_state-for-db845c-clock-providers.patch
index 8cb36ea3..1929b653 100644
--- a/android-mainline/NOUPSTREAM-ANDROID-clk-qcom-Add-sync_state-clk_sync_state-for-db845c-clock-providers.patch
+++ b/android-mainline/NOUPSTREAM-ANDROID-clk-qcom-Add-sync_state-clk_sync_state-for-db845c-clock-providers.patch
@@ -47,7 +47,7 @@ diff --git a/drivers/clk/qcom/dispcc-sdm845.c b/drivers/clk/qcom/dispcc-sdm845.c
 diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
 --- a/drivers/clk/qcom/gcc-msm8998.c
 +++ b/drivers/clk/qcom/gcc-msm8998.c
-@@ -3249,6 +3249,7 @@ static struct platform_driver gcc_msm8998_driver = {
+@@ -3306,6 +3306,7 @@ static struct platform_driver gcc_msm8998_driver = {
  	.driver		= {
  		.name	= "gcc-msm8998",
  		.of_match_table = gcc_msm8998_match_table,
@@ -58,7 +58,7 @@ diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
 diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
 --- a/drivers/clk/qcom/gcc-sdm845.c
 +++ b/drivers/clk/qcom/gcc-sdm845.c
-@@ -4020,6 +4020,7 @@ static struct platform_driver gcc_sdm845_driver = {
+@@ -4019,6 +4019,7 @@ static struct platform_driver gcc_sdm845_driver = {
  	.driver		= {
  		.name	= "gcc-sdm845",
  		.of_match_table = gcc_sdm845_match_table,
diff --git a/android-mainline/NOUPSTREAM-ANDROID-kernel-Core-Kernel-Exports.patch b/android-mainline/NOUPSTREAM-ANDROID-kernel-Core-Kernel-Exports.patch
index 676539ad..65a58970 100644
--- a/android-mainline/NOUPSTREAM-ANDROID-kernel-Core-Kernel-Exports.patch
+++ b/android-mainline/NOUPSTREAM-ANDROID-kernel-Core-Kernel-Exports.patch
@@ -501,14 +501,14 @@ diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
 diff --git a/kernel/time/time.c b/kernel/time/time.c
 --- a/kernel/time/time.c
 +++ b/kernel/time/time.c
-@@ -686,6 +686,7 @@ u64 nsec_to_clock_t(u64 x)
+@@ -745,6 +745,7 @@ u64 nsec_to_clock_t(u64 x)
  	return div_u64(x * 9, (9ull * NSEC_PER_SEC + (USER_HZ / 2)) / USER_HZ);
  #endif
  }
 +EXPORT_SYMBOL_GPL(nsec_to_clock_t);
  
- u64 jiffies64_to_nsecs(u64 j)
- {
+ /**
+  * jiffies64_to_nsecs - Convert jiffies64 to nanoseconds
 diff --git a/kernel/trace/power-traces.c b/kernel/trace/power-traces.c
 --- a/kernel/trace/power-traces.c
 +++ b/kernel/trace/power-traces.c
diff --git a/android-mainline/NOUPSTREAM-ANDROID-pcie-dwc-driver-export-dw_handle_msi_irq.patch b/android-mainline/NOUPSTREAM-ANDROID-pcie-dwc-driver-export-dw_handle_msi_irq.patch
index 212f6509..e1403737 100644
--- a/android-mainline/NOUPSTREAM-ANDROID-pcie-dwc-driver-export-dw_handle_msi_irq.patch
+++ b/android-mainline/NOUPSTREAM-ANDROID-pcie-dwc-driver-export-dw_handle_msi_irq.patch
@@ -20,7 +20,7 @@ Signed-off-by: Lee Jones <joneslee@google.com>
 diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
 --- a/drivers/pci/controller/dwc/pcie-designware-host.c
 +++ b/drivers/pci/controller/dwc/pcie-designware-host.c
-@@ -82,6 +82,7 @@ irqreturn_t dw_handle_msi_irq(struct dw_pcie_rp *pp)
+@@ -84,6 +84,7 @@ irqreturn_t dw_handle_msi_irq(struct dw_pcie_rp *pp)
  
  	return ret;
  }
diff --git a/android-mainline/ONHOLD-FROMLIST-dma-buf-system_heap-Add-a-system-uncached-heap-re-using-the-system-heap.patch b/android-mainline/ONHOLD-FROMLIST-dma-buf-system_heap-Add-a-system-uncached-heap-re-using-the-system-heap.patch
index 59f4035a..ad292ccb 100644
--- a/android-mainline/ONHOLD-FROMLIST-dma-buf-system_heap-Add-a-system-uncached-heap-re-using-the-system-heap.patch
+++ b/android-mainline/ONHOLD-FROMLIST-dma-buf-system_heap-Add-a-system-uncached-heap-re-using-the-system-heap.patch
@@ -61,7 +61,7 @@ Signed-off-by: Lee Jones <joneslee@google.com>
 diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c
 --- a/drivers/dma-buf/heaps/system_heap.c
 +++ b/drivers/dma-buf/heaps/system_heap.c
-@@ -23,6 +23,7 @@
+@@ -22,6 +22,7 @@
  #include <linux/vmalloc.h>
  
  static struct dma_heap *sys_heap;
@@ -69,7 +69,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  
  struct system_heap_buffer {
  	struct dma_heap *heap;
-@@ -32,6 +33,8 @@ struct system_heap_buffer {
+@@ -31,6 +32,8 @@ struct system_heap_buffer {
  	struct sg_table sg_table;
  	int vmap_cnt;
  	void *vaddr;
@@ -78,7 +78,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  };
  
  struct dma_heap_attachment {
-@@ -39,6 +42,8 @@ struct dma_heap_attachment {
+@@ -38,6 +41,8 @@ struct dma_heap_attachment {
  	struct sg_table *table;
  	struct list_head list;
  	bool mapped;
@@ -87,7 +87,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  };
  
  #define LOW_ORDER_GFP (GFP_HIGHUSER | __GFP_ZERO)
-@@ -101,7 +106,7 @@ static int system_heap_attach(struct dma_buf *dmabuf,
+@@ -100,7 +105,7 @@ static int system_heap_attach(struct dma_buf *dmabuf,
  	a->dev = attachment->dev;
  	INIT_LIST_HEAD(&a->list);
  	a->mapped = false;
@@ -96,7 +96,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  	attachment->priv = a;
  
  	mutex_lock(&buffer->lock);
-@@ -131,9 +136,13 @@ static struct sg_table *system_heap_map_dma_buf(struct dma_buf_attachment *attac
+@@ -130,9 +135,13 @@ static struct sg_table *system_heap_map_dma_buf(struct dma_buf_attachment *attac
  {
  	struct dma_heap_attachment *a = attachment->priv;
  	struct sg_table *table = a->table;
@@ -111,7 +111,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  	if (ret)
  		return ERR_PTR(ret);
  
-@@ -146,9 +155,12 @@ static void system_heap_unmap_dma_buf(struct dma_buf_attachment *attachment,
+@@ -145,9 +154,12 @@ static void system_heap_unmap_dma_buf(struct dma_buf_attachment *attachment,
  				      enum dma_data_direction direction)
  {
  	struct dma_heap_attachment *a = attachment->priv;
@@ -125,7 +125,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  }
  
  static int system_heap_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
-@@ -162,10 +174,12 @@ static int system_heap_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
+@@ -161,10 +173,12 @@ static int system_heap_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
  	if (buffer->vmap_cnt)
  		invalidate_kernel_vmap_range(buffer->vaddr, buffer->len);
  
@@ -142,7 +142,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  	}
  	mutex_unlock(&buffer->lock);
  
-@@ -183,10 +197,12 @@ static int system_heap_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
+@@ -182,10 +196,12 @@ static int system_heap_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
  	if (buffer->vmap_cnt)
  		flush_kernel_vmap_range(buffer->vaddr, buffer->len);
  
@@ -159,9 +159,9 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  	}
  	mutex_unlock(&buffer->lock);
  
-@@ -203,6 +219,9 @@ static int system_heap_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
- 
- 	dma_resv_assert_held(dmabuf->resv);
+@@ -200,6 +216,9 @@ static int system_heap_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
+ 	struct sg_page_iter piter;
+ 	int ret;
  
 +	if (buffer->uncached)
 +		vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
@@ -169,7 +169,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  	for_each_sgtable_page(table, &piter, vma->vm_pgoff) {
  		struct page *page = sg_page_iter_page(&piter);
  
-@@ -224,17 +243,21 @@ static void *system_heap_do_vmap(struct system_heap_buffer *buffer)
+@@ -221,17 +240,21 @@ static void *system_heap_do_vmap(struct system_heap_buffer *buffer)
  	struct page **pages = vmalloc(sizeof(struct page *) * npages);
  	struct page **tmp = pages;
  	struct sg_page_iter piter;
@@ -192,7 +192,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  	vfree(pages);
  
  	if (!vaddr)
-@@ -334,10 +357,11 @@ static struct page *alloc_largest_available(unsigned long size,
+@@ -331,10 +354,11 @@ static struct page *alloc_largest_available(unsigned long size,
  	return NULL;
  }
  
@@ -208,7 +208,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  {
  	struct system_heap_buffer *buffer;
  	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
-@@ -358,6 +382,7 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,
+@@ -355,6 +379,7 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,
  	mutex_init(&buffer->lock);
  	buffer->heap = heap;
  	buffer->len = len;
@@ -216,7 +216,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  
  	INIT_LIST_HEAD(&pages);
  	i = 0;
-@@ -403,6 +428,18 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,
+@@ -400,6 +425,18 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,
  		ret = PTR_ERR(dmabuf);
  		goto free_pages;
  	}
@@ -235,7 +235,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  	return dmabuf;
  
  free_pages:
-@@ -420,10 +457,40 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,
+@@ -417,10 +454,40 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,
  	return ERR_PTR(ret);
  }
  
@@ -276,7 +276,7 @@ diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_
  static int system_heap_create(void)
  {
  	struct dma_heap_export_info exp_info;
-@@ -436,6 +503,18 @@ static int system_heap_create(void)
+@@ -433,6 +500,18 @@ static int system_heap_create(void)
  	if (IS_ERR(sys_heap))
  		return PTR_ERR(sys_heap);
  
diff --git a/android-mainline/Revert-of-unittest-Disable-new-dtc-node_name_vs_property_name-and-interrupt_map-warnings.patch b/android-mainline/Revert-of-unittest-Disable-new-dtc-node_name_vs_property_name-and-interrupt_map-warnings.patch
index dabbd7d9..3f8a8661 100644
--- a/android-mainline/Revert-of-unittest-Disable-new-dtc-node_name_vs_property_name-and-interrupt_map-warnings.patch
+++ b/android-mainline/Revert-of-unittest-Disable-new-dtc-node_name_vs_property_name-and-interrupt_map-warnings.patch
@@ -21,7 +21,7 @@ Signed-off-by: Lee Jones <joneslee@google.com>
 diff --git a/drivers/of/unittest-data/Makefile b/drivers/of/unittest-data/Makefile
 --- a/drivers/of/unittest-data/Makefile
 +++ b/drivers/of/unittest-data/Makefile
-@@ -42,9 +42,7 @@ DTC_FLAGS_overlay_base += -@
+@@ -44,9 +44,7 @@ DTC_FLAGS_overlay_base += -@
  DTC_FLAGS_testcases += -@
  
  # suppress warnings about intentional errors
@@ -32,7 +32,7 @@ diff --git a/drivers/of/unittest-data/Makefile b/drivers/of/unittest-data/Makefi
  
  # Apply overlays statically with fdtoverlay.  This is a build time test that
  # the overlays can be applied successfully by fdtoverlay.  This does not
-@@ -94,10 +92,6 @@ apply_static_overlay_1 := overlay_0.dtbo \
+@@ -96,10 +94,6 @@ apply_static_overlay_1 := overlay_0.dtbo \
  
  apply_static_overlay_2 := overlay.dtbo
  
diff --git a/android-mainline/UPSTREAM-firmware-arm_scmi-Add-v3.2-perf-level-indexing-mode-support.patch b/android-mainline/UPSTREAM-firmware-arm_scmi-Add-v3.2-perf-level-indexing-mode-support.patch
deleted file mode 100644
index adc67bf7..00000000
--- a/android-mainline/UPSTREAM-firmware-arm_scmi-Add-v3.2-perf-level-indexing-mode-support.patch
+++ /dev/null
@@ -1,677 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Cristian Marussi <cristian.marussi@arm.com>
-Date: Mon, 17 Jul 2023 17:12:46 +0100
-Subject: UPSTREAM: firmware: arm_scmi: Add v3.2 perf level indexing mode
- support
-
-SCMI v3.2 adds PERF protocol support to optionally define performance
-domains that cannot be represented on a linear scale; the platform firmware
-can declare the performance levels of a domain as being 'level indexed' and
-provide an indicative frequency associated to each of those levels, with
-such indexes not required anymore to be contiguous nor to satisfy any
-linear-scaling constraint: when level-indexing is available for a domain,
-the platform will expect to deal with SCMI requests using indexes instead
-of performance levels for that domain.
-
-Add level-indexing mode support to the PERF protocol implementation while
-maintaining unchanged the protocol operations interface exposed by PERF;
-all the required mapping from performamce levels/frequencies to the
-corresponding level indexes is carried out transparently by the core PERF
-protocol support: as a consequence no change is either required in any
-SCMI driver using the PERF protocol, even when using level indexing.
-
-Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
-Link: https://lore.kernel.org/r/20230717161246.1761777-3-cristian.marussi@arm.com
-Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
-
-Bug: 303839905
-Change-Id: I502e4751b314b7e42e11138cacec7f483a7425bf
-(cherry picked from commit 31c7c1397a33d4c7ad1e06aa6ea9fc6148554b29)
-Signed-off-by: Vivek Aknurwar <quic_viveka@quicinc.com>
----
- drivers/firmware/arm_scmi/perf.c | 367 +++++++++++++++++++++++++------
- 1 file changed, 297 insertions(+), 70 deletions(-)
-
-diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c
---- a/drivers/firmware/arm_scmi/perf.c
-+++ b/drivers/firmware/arm_scmi/perf.c
-@@ -2,19 +2,22 @@
- /*
-  * System Control and Management Interface (SCMI) Performance Protocol
-  *
-- * Copyright (C) 2018-2022 ARM Ltd.
-+ * Copyright (C) 2018-2023 ARM Ltd.
-  */
- 
- #define pr_fmt(fmt) "SCMI Notifications PERF - " fmt
- 
- #include <linux/bits.h>
--#include <linux/of.h>
-+#include <linux/hashtable.h>
- #include <linux/io.h>
-+#include <linux/log2.h>
- #include <linux/module.h>
-+#include <linux/of.h>
- #include <linux/platform_device.h>
- #include <linux/pm_opp.h>
- #include <linux/scmi_protocol.h>
- #include <linux/sort.h>
-+#include <linux/xarray.h>
- 
- #include <trace/events/scmi.h>
- 
-@@ -46,6 +49,9 @@ struct scmi_opp {
- 	u32 perf;
- 	u32 power;
- 	u32 trans_latency_us;
-+	u32 indicative_freq;
-+	u32 level_index;
-+	struct hlist_node hash;
- };
- 
- struct scmi_msg_resp_perf_attributes {
-@@ -66,6 +72,7 @@ struct scmi_msg_resp_perf_domain_attributes {
- #define SUPPORTS_PERF_LEVEL_NOTIFY(x)	((x) & BIT(28))
- #define SUPPORTS_PERF_FASTCHANNELS(x)	((x) & BIT(27))
- #define SUPPORTS_EXTENDED_NAMES(x)	((x) & BIT(26))
-+#define SUPPORTS_LEVEL_INDEXING(x)	((x) & BIT(25))
- 	__le32 rate_limit_us;
- 	__le32 sustained_freq_khz;
- 	__le32 sustained_perf_level;
-@@ -122,12 +129,27 @@ struct scmi_msg_resp_perf_describe_levels {
- 	} opp[];
- };
- 
-+struct scmi_msg_resp_perf_describe_levels_v4 {
-+	__le16 num_returned;
-+	__le16 num_remaining;
-+	struct {
-+		__le32 perf_val;
-+		__le32 power;
-+		__le16 transition_latency_us;
-+		__le16 reserved;
-+		__le32 indicative_freq;
-+		__le32 level_index;
-+	} opp[];
-+};
-+
- struct perf_dom_info {
-+	u32 id;
- 	bool set_limits;
- 	bool set_perf;
- 	bool perf_limit_notify;
- 	bool perf_level_notify;
- 	bool perf_fastchannels;
-+	bool level_indexing_mode;
- 	u32 opp_count;
- 	u32 sustained_freq_khz;
- 	u32 sustained_perf_level;
-@@ -135,8 +157,23 @@ struct perf_dom_info {
- 	char name[SCMI_MAX_STR_SIZE];
- 	struct scmi_opp opp[MAX_OPPS];
- 	struct scmi_fc_info *fc_info;
-+	struct xarray opps_by_idx;
-+	struct xarray opps_by_lvl;
-+	DECLARE_HASHTABLE(opps_by_freq, ilog2(MAX_OPPS));
- };
- 
-+#define LOOKUP_BY_FREQ(__htp, __freq)					\
-+({									\
-+		/* u32 cast is needed to pick right hash func */	\
-+		u32 f_ = (u32)(__freq);					\
-+		struct scmi_opp *_opp;					\
-+									\
-+		hash_for_each_possible((__htp), _opp, hash, f_)		\
-+			if (_opp->indicative_freq == f_)		\
-+				break;					\
-+		_opp;							\
-+})
-+
- struct scmi_perf_info {
- 	u32 version;
- 	u16 num_domains;
-@@ -186,9 +223,20 @@ static int scmi_perf_attributes_get(const struct scmi_protocol_handle *ph,
- 	return ret;
- }
- 
-+static void scmi_perf_xa_destroy(void *data)
-+{
-+	int domain;
-+	struct scmi_perf_info *pinfo = data;
-+
-+	for (domain = 0; domain < pinfo->num_domains; domain++) {
-+		xa_destroy(&((pinfo->dom_info + domain)->opps_by_idx));
-+		xa_destroy(&((pinfo->dom_info + domain)->opps_by_lvl));
-+	}
-+}
-+
- static int
- scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph,
--				u32 domain, struct perf_dom_info *dom_info,
-+				struct perf_dom_info *dom_info,
- 				u32 version)
- {
- 	int ret;
-@@ -197,11 +245,11 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph,
- 	struct scmi_msg_resp_perf_domain_attributes *attr;
- 
- 	ret = ph->xops->xfer_get_init(ph, PERF_DOMAIN_ATTRIBUTES,
--				     sizeof(domain), sizeof(*attr), &t);
-+				      sizeof(dom_info->id), sizeof(*attr), &t);
- 	if (ret)
- 		return ret;
- 
--	put_unaligned_le32(domain, t->tx.buf);
-+	put_unaligned_le32(dom_info->id, t->tx.buf);
- 	attr = t->rx.buf;
- 
- 	ret = ph->xops->do_xfer(ph, t);
-@@ -213,6 +261,9 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph,
- 		dom_info->perf_limit_notify = SUPPORTS_PERF_LIMIT_NOTIFY(flags);
- 		dom_info->perf_level_notify = SUPPORTS_PERF_LEVEL_NOTIFY(flags);
- 		dom_info->perf_fastchannels = SUPPORTS_PERF_FASTCHANNELS(flags);
-+		if (PROTOCOL_REV_MAJOR(version) >= 0x4)
-+			dom_info->level_indexing_mode =
-+				SUPPORTS_LEVEL_INDEXING(flags);
- 		dom_info->sustained_freq_khz =
- 					le32_to_cpu(attr->sustained_freq_khz);
- 		dom_info->sustained_perf_level =
-@@ -236,8 +287,15 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph,
- 	 */
- 	if (!ret && PROTOCOL_REV_MAJOR(version) >= 0x3 &&
- 	    SUPPORTS_EXTENDED_NAMES(flags))
--		ph->hops->extended_name_get(ph, PERF_DOMAIN_NAME_GET, domain,
--					    dom_info->name, SCMI_MAX_STR_SIZE);
-+		ph->hops->extended_name_get(ph, PERF_DOMAIN_NAME_GET,
-+					    dom_info->id, dom_info->name,
-+					    SCMI_MAX_STR_SIZE);
-+
-+	if (dom_info->level_indexing_mode) {
-+		xa_init(&dom_info->opps_by_idx);
-+		xa_init(&dom_info->opps_by_lvl);
-+		hash_init(dom_info->opps_by_freq);
-+	}
- 
- 	return ret;
- }
-@@ -250,7 +308,7 @@ static int opp_cmp_func(const void *opp1, const void *opp2)
- }
- 
- struct scmi_perf_ipriv {
--	u32 domain;
-+	u32 version;
- 	struct perf_dom_info *perf_dom;
- };
- 
-@@ -261,7 +319,7 @@ static void iter_perf_levels_prepare_message(void *message,
- 	struct scmi_msg_perf_describe_levels *msg = message;
- 	const struct scmi_perf_ipriv *p = priv;
- 
--	msg->domain = cpu_to_le32(p->domain);
-+	msg->domain = cpu_to_le32(p->perf_dom->id);
- 	/* Set the number of OPPs to be skipped/already read */
- 	msg->level_index = cpu_to_le32(desc_index);
- }
-@@ -277,31 +335,63 @@ static int iter_perf_levels_update_state(struct scmi_iterator_state *st,
- 	return 0;
- }
- 
-+static inline void
-+process_response_opp(struct scmi_opp *opp, unsigned int loop_idx,
-+		     const struct scmi_msg_resp_perf_describe_levels *r)
-+{
-+	opp->perf = le32_to_cpu(r->opp[loop_idx].perf_val);
-+	opp->power = le32_to_cpu(r->opp[loop_idx].power);
-+	opp->trans_latency_us =
-+		le16_to_cpu(r->opp[loop_idx].transition_latency_us);
-+}
-+
-+static inline void
-+process_response_opp_v4(struct perf_dom_info *dom, struct scmi_opp *opp,
-+			unsigned int loop_idx,
-+			const struct scmi_msg_resp_perf_describe_levels_v4 *r)
-+{
-+	opp->perf = le32_to_cpu(r->opp[loop_idx].perf_val);
-+	opp->power = le32_to_cpu(r->opp[loop_idx].power);
-+	opp->trans_latency_us =
-+		le16_to_cpu(r->opp[loop_idx].transition_latency_us);
-+
-+	/* Note that PERF v4 reports always five 32-bit words */
-+	opp->indicative_freq = le32_to_cpu(r->opp[loop_idx].indicative_freq);
-+	if (dom->level_indexing_mode) {
-+		opp->level_index = le32_to_cpu(r->opp[loop_idx].level_index);
-+
-+		xa_store(&dom->opps_by_idx, opp->level_index, opp, GFP_KERNEL);
-+		xa_store(&dom->opps_by_lvl, opp->perf, opp, GFP_KERNEL);
-+		hash_add(dom->opps_by_freq, &opp->hash, opp->indicative_freq);
-+	}
-+}
-+
- static int
- iter_perf_levels_process_response(const struct scmi_protocol_handle *ph,
- 				  const void *response,
- 				  struct scmi_iterator_state *st, void *priv)
- {
- 	struct scmi_opp *opp;
--	const struct scmi_msg_resp_perf_describe_levels *r = response;
- 	struct scmi_perf_ipriv *p = priv;
- 
- 	opp = &p->perf_dom->opp[st->desc_index + st->loop_idx];
--	opp->perf = le32_to_cpu(r->opp[st->loop_idx].perf_val);
--	opp->power = le32_to_cpu(r->opp[st->loop_idx].power);
--	opp->trans_latency_us =
--		le16_to_cpu(r->opp[st->loop_idx].transition_latency_us);
-+	if (PROTOCOL_REV_MAJOR(p->version) <= 0x3)
-+		process_response_opp(opp, st->loop_idx, response);
-+	else
-+		process_response_opp_v4(p->perf_dom, opp, st->loop_idx,
-+					response);
- 	p->perf_dom->opp_count++;
- 
--	dev_dbg(ph->dev, "Level %d Power %d Latency %dus\n",
--		opp->perf, opp->power, opp->trans_latency_us);
-+	dev_dbg(ph->dev, "Level %d Power %d Latency %dus Ifreq %d Index %d\n",
-+		opp->perf, opp->power, opp->trans_latency_us,
-+		opp->indicative_freq, opp->level_index);
- 
- 	return 0;
- }
- 
- static int
--scmi_perf_describe_levels_get(const struct scmi_protocol_handle *ph, u32 domain,
--			      struct perf_dom_info *perf_dom)
-+scmi_perf_describe_levels_get(const struct scmi_protocol_handle *ph,
-+			      struct perf_dom_info *perf_dom, u32 version)
- {
- 	int ret;
- 	void *iter;
-@@ -311,7 +401,7 @@ scmi_perf_describe_levels_get(const struct scmi_protocol_handle *ph, u32 domain,
- 		.process_response = iter_perf_levels_process_response,
- 	};
- 	struct scmi_perf_ipriv ppriv = {
--		.domain = domain,
-+		.version = version,
- 		.perf_dom = perf_dom,
- 	};
- 
-@@ -333,8 +423,8 @@ scmi_perf_describe_levels_get(const struct scmi_protocol_handle *ph, u32 domain,
- 	return ret;
- }
- 
--static int scmi_perf_mb_limits_set(const struct scmi_protocol_handle *ph,
--				   u32 domain, u32 max_perf, u32 min_perf)
-+static int scmi_perf_msg_limits_set(const struct scmi_protocol_handle *ph,
-+				    u32 domain, u32 max_perf, u32 min_perf)
- {
- 	int ret;
- 	struct scmi_xfer *t;
-@@ -367,6 +457,24 @@ scmi_perf_domain_lookup(const struct scmi_protocol_handle *ph, u32 domain)
- 	return pi->dom_info + domain;
- }
- 
-+static int __scmi_perf_limits_set(const struct scmi_protocol_handle *ph,
-+				  struct perf_dom_info *dom, u32 max_perf,
-+				  u32 min_perf)
-+{
-+	if (dom->fc_info && dom->fc_info[PERF_FC_LIMIT].set_addr) {
-+		struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LIMIT];
-+
-+		trace_scmi_fc_call(SCMI_PROTOCOL_PERF, PERF_LIMITS_SET,
-+				   dom->id, min_perf, max_perf);
-+		iowrite32(max_perf, fci->set_addr);
-+		iowrite32(min_perf, fci->set_addr + 4);
-+		ph->hops->fastchannel_db_ring(fci->set_db);
-+		return 0;
-+	}
-+
-+	return scmi_perf_msg_limits_set(ph, dom->id, max_perf, min_perf);
-+}
-+
- static int scmi_perf_limits_set(const struct scmi_protocol_handle *ph,
- 				u32 domain, u32 max_perf, u32 min_perf)
- {
-@@ -380,22 +488,31 @@ static int scmi_perf_limits_set(const struct scmi_protocol_handle *ph,
- 	if (PROTOCOL_REV_MAJOR(pi->version) >= 0x3 && !max_perf && !min_perf)
- 		return -EINVAL;
- 
--	if (dom->fc_info && dom->fc_info[PERF_FC_LIMIT].set_addr) {
--		struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LIMIT];
-+	if (dom->level_indexing_mode) {
-+		struct scmi_opp *opp;
- 
--		trace_scmi_fc_call(SCMI_PROTOCOL_PERF, PERF_LIMITS_SET,
--				   domain, min_perf, max_perf);
--		iowrite32(max_perf, fci->set_addr);
--		iowrite32(min_perf, fci->set_addr + 4);
--		ph->hops->fastchannel_db_ring(fci->set_db);
--		return 0;
-+		if (min_perf) {
-+			opp = xa_load(&dom->opps_by_lvl, min_perf);
-+			if (!opp)
-+				return -EIO;
-+
-+			min_perf = opp->level_index;
-+		}
-+
-+		if (max_perf) {
-+			opp = xa_load(&dom->opps_by_lvl, max_perf);
-+			if (!opp)
-+				return -EIO;
-+
-+			max_perf = opp->level_index;
-+		}
- 	}
- 
--	return scmi_perf_mb_limits_set(ph, domain, max_perf, min_perf);
-+	return __scmi_perf_limits_set(ph, dom, max_perf, min_perf);
- }
- 
--static int scmi_perf_mb_limits_get(const struct scmi_protocol_handle *ph,
--				   u32 domain, u32 *max_perf, u32 *min_perf)
-+static int scmi_perf_msg_limits_get(const struct scmi_protocol_handle *ph,
-+				    u32 domain, u32 *max_perf, u32 *min_perf)
- {
- 	int ret;
- 	struct scmi_xfer *t;
-@@ -420,30 +537,58 @@ static int scmi_perf_mb_limits_get(const struct scmi_protocol_handle *ph,
- 	return ret;
- }
- 
-+static int __scmi_perf_limits_get(const struct scmi_protocol_handle *ph,
-+				  struct perf_dom_info *dom, u32 *max_perf,
-+				  u32 *min_perf)
-+{
-+	if (dom->fc_info && dom->fc_info[PERF_FC_LIMIT].get_addr) {
-+		struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LIMIT];
-+
-+		*max_perf = ioread32(fci->get_addr);
-+		*min_perf = ioread32(fci->get_addr + 4);
-+		trace_scmi_fc_call(SCMI_PROTOCOL_PERF, PERF_LIMITS_GET,
-+				   dom->id, *min_perf, *max_perf);
-+		return 0;
-+	}
-+
-+	return scmi_perf_msg_limits_get(ph, dom->id, max_perf, min_perf);
-+}
-+
- static int scmi_perf_limits_get(const struct scmi_protocol_handle *ph,
- 				u32 domain, u32 *max_perf, u32 *min_perf)
- {
-+	int ret;
- 	struct perf_dom_info *dom;
- 
- 	dom = scmi_perf_domain_lookup(ph, domain);
- 	if (IS_ERR(dom))
- 		return PTR_ERR(dom);
- 
--	if (dom->fc_info && dom->fc_info[PERF_FC_LIMIT].get_addr) {
--		struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LIMIT];
-+	ret = __scmi_perf_limits_get(ph, dom, max_perf, min_perf);
-+	if (ret)
-+		return ret;
- 
--		*max_perf = ioread32(fci->get_addr);
--		*min_perf = ioread32(fci->get_addr + 4);
--		trace_scmi_fc_call(SCMI_PROTOCOL_PERF, PERF_LIMITS_GET,
--				   domain, *min_perf, *max_perf);
--		return 0;
-+	if (dom->level_indexing_mode) {
-+		struct scmi_opp *opp;
-+
-+		opp = xa_load(&dom->opps_by_idx, *min_perf);
-+		if (!opp)
-+			return -EIO;
-+
-+		*min_perf = opp->perf;
-+
-+		opp = xa_load(&dom->opps_by_idx, *max_perf);
-+		if (!opp)
-+			return -EIO;
-+
-+		*max_perf = opp->perf;
- 	}
- 
--	return scmi_perf_mb_limits_get(ph, domain, max_perf, min_perf);
-+	return 0;
- }
- 
--static int scmi_perf_mb_level_set(const struct scmi_protocol_handle *ph,
--				  u32 domain, u32 level, bool poll)
-+static int scmi_perf_msg_level_set(const struct scmi_protocol_handle *ph,
-+				   u32 domain, u32 level, bool poll)
- {
- 	int ret;
- 	struct scmi_xfer *t;
-@@ -464,6 +609,23 @@ static int scmi_perf_mb_level_set(const struct scmi_protocol_handle *ph,
- 	return ret;
- }
- 
-+static int __scmi_perf_level_set(const struct scmi_protocol_handle *ph,
-+				 struct perf_dom_info *dom, u32 level,
-+				 bool poll)
-+{
-+	if (dom->fc_info && dom->fc_info[PERF_FC_LEVEL].set_addr) {
-+		struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LEVEL];
-+
-+		trace_scmi_fc_call(SCMI_PROTOCOL_PERF, PERF_LEVEL_SET,
-+				   dom->id, level, 0);
-+		iowrite32(level, fci->set_addr);
-+		ph->hops->fastchannel_db_ring(fci->set_db);
-+		return 0;
-+	}
-+
-+	return scmi_perf_msg_level_set(ph, dom->id, level, poll);
-+}
-+
- static int scmi_perf_level_set(const struct scmi_protocol_handle *ph,
- 			       u32 domain, u32 level, bool poll)
- {
-@@ -473,21 +635,21 @@ static int scmi_perf_level_set(const struct scmi_protocol_handle *ph,
- 	if (IS_ERR(dom))
- 		return PTR_ERR(dom);
- 
--	if (dom->fc_info && dom->fc_info[PERF_FC_LEVEL].set_addr) {
--		struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LEVEL];
-+	if (dom->level_indexing_mode) {
-+		struct scmi_opp *opp;
- 
--		trace_scmi_fc_call(SCMI_PROTOCOL_PERF, PERF_LEVEL_SET,
--				   domain, level, 0);
--		iowrite32(level, fci->set_addr);
--		ph->hops->fastchannel_db_ring(fci->set_db);
--		return 0;
-+		opp = xa_load(&dom->opps_by_lvl, level);
-+		if (!opp)
-+			return -EIO;
-+
-+		level = opp->level_index;
- 	}
- 
--	return scmi_perf_mb_level_set(ph, domain, level, poll);
-+	return __scmi_perf_level_set(ph, dom, level, poll);
- }
- 
--static int scmi_perf_mb_level_get(const struct scmi_protocol_handle *ph,
--				  u32 domain, u32 *level, bool poll)
-+static int scmi_perf_msg_level_get(const struct scmi_protocol_handle *ph,
-+				   u32 domain, u32 *level, bool poll)
- {
- 	int ret;
- 	struct scmi_xfer *t;
-@@ -508,23 +670,45 @@ static int scmi_perf_mb_level_get(const struct scmi_protocol_handle *ph,
- 	return ret;
- }
- 
-+static int __scmi_perf_level_get(const struct scmi_protocol_handle *ph,
-+				 struct perf_dom_info *dom, u32 *level,
-+				 bool poll)
-+{
-+	if (dom->fc_info && dom->fc_info[PERF_FC_LEVEL].get_addr) {
-+		*level = ioread32(dom->fc_info[PERF_FC_LEVEL].get_addr);
-+		trace_scmi_fc_call(SCMI_PROTOCOL_PERF, PERF_LEVEL_GET,
-+				   dom->id, *level, 0);
-+		return 0;
-+	}
-+
-+	return scmi_perf_msg_level_get(ph, dom->id, level, poll);
-+}
-+
- static int scmi_perf_level_get(const struct scmi_protocol_handle *ph,
- 			       u32 domain, u32 *level, bool poll)
- {
-+	int ret;
- 	struct perf_dom_info *dom;
- 
- 	dom = scmi_perf_domain_lookup(ph, domain);
- 	if (IS_ERR(dom))
- 		return PTR_ERR(dom);
- 
--	if (dom->fc_info && dom->fc_info[PERF_FC_LEVEL].get_addr) {
--		*level = ioread32(dom->fc_info[PERF_FC_LEVEL].get_addr);
--		trace_scmi_fc_call(SCMI_PROTOCOL_PERF, PERF_LEVEL_GET,
--				   domain, *level, 0);
--		return 0;
-+	ret = __scmi_perf_level_get(ph, dom, level, poll);
-+	if (ret)
-+		return ret;
-+
-+	if (dom->level_indexing_mode) {
-+		struct scmi_opp *opp;
-+
-+		opp = xa_load(&dom->opps_by_idx, *level);
-+		if (!opp)
-+			return -EIO;
-+
-+		*level = opp->perf;
- 	}
- 
--	return scmi_perf_mb_level_get(ph, domain, level, poll);
-+	return 0;
- }
- 
- static int scmi_perf_level_limits_notify(const struct scmi_protocol_handle *ph,
-@@ -608,18 +792,27 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph,
- 		return PTR_ERR(dom);
- 
- 	for (opp = dom->opp, idx = 0; idx < dom->opp_count; idx++, opp++) {
--		freq = opp->perf * dom->mult_factor;
-+		if (!dom->level_indexing_mode)
-+			freq = opp->perf * dom->mult_factor;
-+		else
-+			freq = opp->indicative_freq * 1000;
- 
- 		ret = dev_pm_opp_add(dev, freq, 0);
- 		if (ret) {
- 			dev_warn(dev, "failed to add opp %luHz\n", freq);
- 
- 			while (idx-- > 0) {
--				freq = (--opp)->perf * dom->mult_factor;
-+				if (!dom->level_indexing_mode)
-+					freq = (--opp)->perf * dom->mult_factor;
-+				else
-+					freq = (--opp)->indicative_freq * 1000;
- 				dev_pm_opp_remove(dev, freq);
- 			}
- 			return ret;
- 		}
-+
-+		dev_dbg(dev, "[%d][%s]:: Registered OPP[%d] %lu\n",
-+			domain, dom->name, idx, freq);
- 	}
- 	return 0;
- }
-@@ -646,13 +839,26 @@ scmi_dvfs_transition_latency_get(const struct scmi_protocol_handle *ph,
- static int scmi_dvfs_freq_set(const struct scmi_protocol_handle *ph, u32 domain,
- 			      unsigned long freq, bool poll)
- {
-+	unsigned int level;
- 	struct perf_dom_info *dom;
- 
- 	dom = scmi_perf_domain_lookup(ph, domain);
- 	if (IS_ERR(dom))
- 		return PTR_ERR(dom);
- 
--	return scmi_perf_level_set(ph, domain, freq / dom->mult_factor, poll);
-+	if (!dom->level_indexing_mode) {
-+		level = freq / dom->mult_factor;
-+	} else {
-+		struct scmi_opp *opp;
-+
-+		opp = LOOKUP_BY_FREQ(dom->opps_by_freq, freq / 1000);
-+		if (!opp)
-+			return -EIO;
-+
-+		level = opp->level_index;
-+	}
-+
-+	return __scmi_perf_level_set(ph, dom, level, poll);
- }
- 
- static int scmi_dvfs_freq_get(const struct scmi_protocol_handle *ph, u32 domain,
-@@ -660,14 +866,26 @@ static int scmi_dvfs_freq_get(const struct scmi_protocol_handle *ph, u32 domain,
- {
- 	int ret;
- 	u32 level;
--	struct scmi_perf_info *pi = ph->get_priv(ph);
-+	struct perf_dom_info *dom;
- 
--	ret = scmi_perf_level_get(ph, domain, &level, poll);
--	if (!ret) {
--		struct perf_dom_info *dom = pi->dom_info + domain;
-+	dom = scmi_perf_domain_lookup(ph, domain);
-+	if (IS_ERR(dom))
-+		return PTR_ERR(dom);
-+
-+	ret = __scmi_perf_level_get(ph, dom, &level, poll);
-+	if (ret)
-+		return ret;
- 
--		/* Note domain is validated implicitly by scmi_perf_level_get */
-+	if (!dom->level_indexing_mode) {
- 		*freq = level * dom->mult_factor;
-+	} else {
-+		struct scmi_opp *opp;
-+
-+		opp = xa_load(&dom->opps_by_idx, level);
-+		if (!opp)
-+			return -EIO;
-+
-+		*freq = opp->indicative_freq * 1000;
- 	}
- 
- 	return ret;
-@@ -687,7 +905,11 @@ static int scmi_dvfs_est_power_get(const struct scmi_protocol_handle *ph,
- 		return PTR_ERR(dom);
- 
- 	for (opp = dom->opp, idx = 0; idx < dom->opp_count; idx++, opp++) {
--		opp_freq = opp->perf * dom->mult_factor;
-+		if (!dom->level_indexing_mode)
-+			opp_freq = opp->perf * dom->mult_factor;
-+		else
-+			opp_freq = opp->indicative_freq * 1000;
-+
- 		if (opp_freq < *freq)
- 			continue;
- 
-@@ -870,13 +1092,18 @@ static int scmi_perf_protocol_init(const struct scmi_protocol_handle *ph)
- 	for (domain = 0; domain < pinfo->num_domains; domain++) {
- 		struct perf_dom_info *dom = pinfo->dom_info + domain;
- 
--		scmi_perf_domain_attributes_get(ph, domain, dom, version);
--		scmi_perf_describe_levels_get(ph, domain, dom);
-+		dom->id = domain;
-+		scmi_perf_domain_attributes_get(ph, dom, version);
-+		scmi_perf_describe_levels_get(ph, dom, version);
- 
- 		if (dom->perf_fastchannels)
--			scmi_perf_domain_init_fc(ph, domain, &dom->fc_info);
-+			scmi_perf_domain_init_fc(ph, dom->id, &dom->fc_info);
- 	}
- 
-+	ret = devm_add_action_or_reset(ph->dev, scmi_perf_xa_destroy, pinfo);
-+	if (ret)
-+		return ret;
-+
- 	pinfo->version = version;
- 
- 	return ph->set_priv(ph, pinfo);
diff --git a/android-mainline/UPSTREAM-firmware-arm_scmi-Harden-perf-domain-info-access.patch b/android-mainline/UPSTREAM-firmware-arm_scmi-Harden-perf-domain-info-access.patch
deleted file mode 100644
index b6e4e672..00000000
--- a/android-mainline/UPSTREAM-firmware-arm_scmi-Harden-perf-domain-info-access.patch
+++ /dev/null
@@ -1,210 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Cristian Marussi <cristian.marussi@arm.com>
-Date: Mon, 17 Jul 2023 17:12:45 +0100
-Subject: UPSTREAM: firmware: arm_scmi: Harden perf domain info access
-
-Harden internal accesses to domain info in the SCMI perf protocol.
-
-Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
-Link: https://lore.kernel.org/r/20230717161246.1761777-2-cristian.marussi@arm.com
-Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
-
-Bug: 303839905
-(cherry picked from commit 3da82112355bba263597fcbb24d275fc57e69e7e)
-Change-Id: I7d8d815a752d1823bb3c0c34e5338be14a9866c9
-Signed-off-by: Vivek Aknurwar <quic_viveka@quicinc.com>
----
- drivers/firmware/arm_scmi/perf.c | 89 +++++++++++++++++++++++---------
- 1 file changed, 64 insertions(+), 25 deletions(-)
-
-diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c
---- a/drivers/firmware/arm_scmi/perf.c
-+++ b/drivers/firmware/arm_scmi/perf.c
-@@ -139,7 +139,7 @@ struct perf_dom_info {
- 
- struct scmi_perf_info {
- 	u32 version;
--	int num_domains;
-+	u16 num_domains;
- 	enum scmi_power_scale power_scale;
- 	u64 stats_addr;
- 	u32 stats_size;
-@@ -356,11 +356,26 @@ static int scmi_perf_mb_limits_set(const struct scmi_protocol_handle *ph,
- 	return ret;
- }
- 
-+static inline struct perf_dom_info *
-+scmi_perf_domain_lookup(const struct scmi_protocol_handle *ph, u32 domain)
-+{
-+	struct scmi_perf_info *pi = ph->get_priv(ph);
-+
-+	if (domain >= pi->num_domains)
-+		return ERR_PTR(-EINVAL);
-+
-+	return pi->dom_info + domain;
-+}
-+
- static int scmi_perf_limits_set(const struct scmi_protocol_handle *ph,
- 				u32 domain, u32 max_perf, u32 min_perf)
- {
- 	struct scmi_perf_info *pi = ph->get_priv(ph);
--	struct perf_dom_info *dom = pi->dom_info + domain;
-+	struct perf_dom_info *dom;
-+
-+	dom = scmi_perf_domain_lookup(ph, domain);
-+	if (IS_ERR(dom))
-+		return PTR_ERR(dom);
- 
- 	if (PROTOCOL_REV_MAJOR(pi->version) >= 0x3 && !max_perf && !min_perf)
- 		return -EINVAL;
-@@ -408,8 +423,11 @@ static int scmi_perf_mb_limits_get(const struct scmi_protocol_handle *ph,
- static int scmi_perf_limits_get(const struct scmi_protocol_handle *ph,
- 				u32 domain, u32 *max_perf, u32 *min_perf)
- {
--	struct scmi_perf_info *pi = ph->get_priv(ph);
--	struct perf_dom_info *dom = pi->dom_info + domain;
-+	struct perf_dom_info *dom;
-+
-+	dom = scmi_perf_domain_lookup(ph, domain);
-+	if (IS_ERR(dom))
-+		return PTR_ERR(dom);
- 
- 	if (dom->fc_info && dom->fc_info[PERF_FC_LIMIT].get_addr) {
- 		struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LIMIT];
-@@ -449,8 +467,11 @@ static int scmi_perf_mb_level_set(const struct scmi_protocol_handle *ph,
- static int scmi_perf_level_set(const struct scmi_protocol_handle *ph,
- 			       u32 domain, u32 level, bool poll)
- {
--	struct scmi_perf_info *pi = ph->get_priv(ph);
--	struct perf_dom_info *dom = pi->dom_info + domain;
-+	struct perf_dom_info *dom;
-+
-+	dom = scmi_perf_domain_lookup(ph, domain);
-+	if (IS_ERR(dom))
-+		return PTR_ERR(dom);
- 
- 	if (dom->fc_info && dom->fc_info[PERF_FC_LEVEL].set_addr) {
- 		struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LEVEL];
-@@ -490,8 +511,11 @@ static int scmi_perf_mb_level_get(const struct scmi_protocol_handle *ph,
- static int scmi_perf_level_get(const struct scmi_protocol_handle *ph,
- 			       u32 domain, u32 *level, bool poll)
- {
--	struct scmi_perf_info *pi = ph->get_priv(ph);
--	struct perf_dom_info *dom = pi->dom_info + domain;
-+	struct perf_dom_info *dom;
-+
-+	dom = scmi_perf_domain_lookup(ph, domain);
-+	if (IS_ERR(dom))
-+		return PTR_ERR(dom);
- 
- 	if (dom->fc_info && dom->fc_info[PERF_FC_LEVEL].get_addr) {
- 		*level = ioread32(dom->fc_info[PERF_FC_LEVEL].get_addr);
-@@ -574,13 +598,14 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph,
- 	unsigned long freq;
- 	struct scmi_opp *opp;
- 	struct perf_dom_info *dom;
--	struct scmi_perf_info *pi = ph->get_priv(ph);
- 
- 	domain = scmi_dev_domain_id(dev);
- 	if (domain < 0)
--		return domain;
-+		return -EINVAL;
- 
--	dom = pi->dom_info + domain;
-+	dom = scmi_perf_domain_lookup(ph, domain);
-+	if (IS_ERR(dom))
-+		return PTR_ERR(dom);
- 
- 	for (opp = dom->opp, idx = 0; idx < dom->opp_count; idx++, opp++) {
- 		freq = opp->perf * dom->mult_factor;
-@@ -603,14 +628,17 @@ static int
- scmi_dvfs_transition_latency_get(const struct scmi_protocol_handle *ph,
- 				 struct device *dev)
- {
-+	int domain;
- 	struct perf_dom_info *dom;
--	struct scmi_perf_info *pi = ph->get_priv(ph);
--	int domain = scmi_dev_domain_id(dev);
- 
-+	domain = scmi_dev_domain_id(dev);
- 	if (domain < 0)
--		return domain;
-+		return -EINVAL;
-+
-+	dom = scmi_perf_domain_lookup(ph, domain);
-+	if (IS_ERR(dom))
-+		return PTR_ERR(dom);
- 
--	dom = pi->dom_info + domain;
- 	/* uS to nS */
- 	return dom->opp[dom->opp_count - 1].trans_latency_us * 1000;
- }
-@@ -618,8 +646,11 @@ scmi_dvfs_transition_latency_get(const struct scmi_protocol_handle *ph,
- static int scmi_dvfs_freq_set(const struct scmi_protocol_handle *ph, u32 domain,
- 			      unsigned long freq, bool poll)
- {
--	struct scmi_perf_info *pi = ph->get_priv(ph);
--	struct perf_dom_info *dom = pi->dom_info + domain;
-+	struct perf_dom_info *dom;
-+
-+	dom = scmi_perf_domain_lookup(ph, domain);
-+	if (IS_ERR(dom))
-+		return PTR_ERR(dom);
- 
- 	return scmi_perf_level_set(ph, domain, freq / dom->mult_factor, poll);
- }
-@@ -630,11 +661,14 @@ static int scmi_dvfs_freq_get(const struct scmi_protocol_handle *ph, u32 domain,
- 	int ret;
- 	u32 level;
- 	struct scmi_perf_info *pi = ph->get_priv(ph);
--	struct perf_dom_info *dom = pi->dom_info + domain;
- 
- 	ret = scmi_perf_level_get(ph, domain, &level, poll);
--	if (!ret)
-+	if (!ret) {
-+		struct perf_dom_info *dom = pi->dom_info + domain;
-+
-+		/* Note domain is validated implicitly by scmi_perf_level_get */
- 		*freq = level * dom->mult_factor;
-+	}
- 
- 	return ret;
- }
-@@ -643,15 +677,14 @@ static int scmi_dvfs_est_power_get(const struct scmi_protocol_handle *ph,
- 				   u32 domain, unsigned long *freq,
- 				   unsigned long *power)
- {
--	struct scmi_perf_info *pi = ph->get_priv(ph);
- 	struct perf_dom_info *dom;
- 	unsigned long opp_freq;
- 	int idx, ret = -EINVAL;
- 	struct scmi_opp *opp;
- 
--	dom = pi->dom_info + domain;
--	if (!dom)
--		return -EIO;
-+	dom = scmi_perf_domain_lookup(ph, domain);
-+	if (IS_ERR(dom))
-+		return PTR_ERR(dom);
- 
- 	for (opp = dom->opp, idx = 0; idx < dom->opp_count; idx++, opp++) {
- 		opp_freq = opp->perf * dom->mult_factor;
-@@ -670,10 +703,16 @@ static int scmi_dvfs_est_power_get(const struct scmi_protocol_handle *ph,
- static bool scmi_fast_switch_possible(const struct scmi_protocol_handle *ph,
- 				      struct device *dev)
- {
-+	int domain;
- 	struct perf_dom_info *dom;
--	struct scmi_perf_info *pi = ph->get_priv(ph);
- 
--	dom = pi->dom_info + scmi_dev_domain_id(dev);
-+	domain = scmi_dev_domain_id(dev);
-+	if (domain < 0)
-+		return false;
-+
-+	dom = scmi_perf_domain_lookup(ph, domain);
-+	if (IS_ERR(dom))
-+		return false;
- 
- 	return dom->fc_info && dom->fc_info[PERF_FC_LEVEL].set_addr;
- }
diff --git a/android-mainline/series b/android-mainline/series
index 24ca8cd7..28035b20 100644
--- a/android-mainline/series
+++ b/android-mainline/series
@@ -1,8 +1,8 @@
 #
 # android-mainline patches
 #
-# Applies onto upstream 6c1b980a7e79e Linux v6.5-4808-g6c1b980a7e79e
-# Matches android-mainline 64b288250511c ("Merge 6c1b980a7e79 ("Merge tag 'dma-mapping-6.6-2023-08-29' of git://git.infradead.org/users/hch/dma-mapping") into android-mainline")
+# Applies onto upstream e7e9423db4594 Linux v6.5-9100-ge7e9423db4594
+# Matches android-mainline ea2c5c741ff8e ("Merge e7e9423db459 ("Merge tag 'v6.6-vfs.super.fixes.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs") into android-mainline")
 # Status: Tested
 #
 Revert-sched-core-Prevent-race-condition-between-cpuset-and-__sched_setscheduler.patch
@@ -38,8 +38,6 @@ FROMLIST-kheaders-dereferences-the-source-tree.patch
 FROMLIST-riscv-signal-fix-sigaltstack-frame-size-checking.patch
 FROMLIST-Revert-fuse-Apply-flags2-only-when-userspace-set-the-FUSE_INIT_EXT.patch
 FROMGIT-bpf-Fix-BTF_ID-symbol-generation-collision.patch
-UPSTREAM-firmware-arm_scmi-Harden-perf-domain-info-access.patch
-UPSTREAM-firmware-arm_scmi-Add-v3.2-perf-level-indexing-mode-support.patch
 UPSTREAM-Linux-6.6-rc1.patch
 _____ANNOTATION-binder-changes_____.patch
 ONHOLD-ANDROID-binder-add-support-for-RT-prio-inheritance.patch