commit 3b231f1e9990f4c21220d0a69733ce2105891ff9 upstream.

misc_open() installs a misc driver's file operations with fops_get(),
which pins file_operations::owner before replacing the file's f_op.  The
NSM misc device leaves nsm_dev_fops.owner unset, so opening /dev/nsm does
not take a module reference on the nsm driver.

If the driver is built as a module, an open file descriptor can therefore
survive rmmod of the module that provides its ioctl callbacks.  A later
ioctl through that descriptor can call into unloaded module text.

Set nsm_dev_fops.owner to THIS_MODULE so the misc core holds the module
while any /dev/nsm file descriptor is open, matching the lifetime
expectation for the installed file operations.

Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Link: https://patch.msgid.link/BE6951D13B5E5513+20260713055523.3193089-1-raoxu@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ce1fed11d18e163baf7f875152a33bf80f625c1a upstream.

nsm_dev_ioctl() jumps to the common out label even when the initial
copy_from_user() fails before nsm->lock has been taken.  The error path
then blindly unlocks a mutex that was never acquired.

This issue was found by our static analysis tool and then manually
reviewed against the current tree.

The grounded PoC kept the miscdevice ioctl entry and the pre-lock
copy_from_user(&raw, argp, _IOC_SIZE(cmd)) failure path by issuing
NSM_IOCTL_RAW with an invalid user pointer.  That failure reaches the
shared out label before mutex_lock(&nsm->lock).  Lockdep reported:

  WARNING: bad unlock balance detected!
  exploit/193 is trying to release lock (&global_nsm.lock) at:
  nsm_dev_ioctl+0x5f/0xcf [vuln_msv]
  but there are no more locks to release!
  no locks held by exploit/193.

Return immediately on the pre-lock copy_from_user() failure and keep the
common unlock label for the post-lock paths only.

Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Alexander Graf <graf@amazon.com>
Link: https://patch.msgid.link/20260617145350.513875-1-runyu.xiao@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f112ea910e554d58b4b39a4492b7d302f0f4204f upstream.

Fix couple of problems in mei_cl_bus_dev_release():

mei_cl_flush_queues() is running without lock.
bus->file_list access after mei_dev_bus_put(bus) can become a
use-after-free if this was the last reference to bus.

Protect queues cleanup and WARN traversal by device lock there
to avoid the concurrent access problems.
Move WARN traversal before mei_dev_bus_put(bus).

This file uses bus variable name for mei_device, adjust
code of mei_cl_bus_dev_release() to use bus variable too.

Cc: stable <stable@kernel.org>
Fixes: 35e8a426b16a ("mei: bus: Check for still connected devices in mei_cl_bus_dev_release()")
Reviewed-by: Menachem Adin <menachem.adin@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20260705151259.3054795-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The
caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero)
on this unprotected pointer. A concurrent MEM_UNMAP can free the map
between the lock release and the kref operation, resulting in a
use-after-free on the freed slab object.

Restore the take_ref parameter to fastrpc_map_lookup so the reference
is acquired atomically under fl->lock before the pointer is exposed to
the caller.

Fixes: 10df039834f8 ("misc: fastrpc: Skip reference for DMA handles")
Cc: stable@vger.kernel.org
Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260530204528.116920-5-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

A NULL pointer dereference was observed on Hawi at boot when the DSP
sends a glink message before fastrpc_rpmsg_probe() has completed
initialization:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178
  pc : _raw_spin_lock_irqsave+0x34/0x8c
  lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]
  ...
  Call trace:
   _raw_spin_lock_irqsave+0x34/0x8c (P)
   fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]
   qcom_glink_native_rx+0x538/0x6a4
   qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem]

The faulting address 0x178 corresponds to the lock variable inside
struct fastrpc_channel_ctx, confirming that cctx is NULL when
fastrpc_rpmsg_callback() attempts to take the spinlock.

There are two issues here. First, dev_set_drvdata() is called before
spin_lock_init() and idr_init(), leaving a window where the callback
can retrieve a valid cctx pointer but operate on an uninitialized
spinlock. Second, the rpmsg channel becomes live as soon as the driver
is bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata()
is called at all, resulting in dev_get_drvdata() returning NULL.

Fix both issues by moving all cctx initialization ahead of
dev_set_drvdata() so the structure is fully initialized before it
becomes visible to the callback, and add a NULL check in
fastrpc_rpmsg_callback() as a guard against any remaining window.

Fixes: f6f9279f2bf0 ("misc: fastrpc: Add Qualcomm fastrpc basic driver model")
Cc: stable@vger.kernel.org
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260530204528.116920-4-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fastrpc_get_args() uses find_vma() to look up the VMA for a user-provided
pointer and compute a DMA address offset. When the address falls in a gap
before the returned VMA, (ptr & PAGE_MASK) - vma->vm_start underflows,
corrupting the DMA address sent to the DSP.

Replace find_vma() with vma_lookup(), which returns NULL when the address
is not contained within any VMA.

Cc: stable@vger.kernel.org
Fixes: 80f3afd72bd4 ("misc: fastrpc: consider address offset before sending to DSP")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260530204528.116920-3-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

There is a race between fastrpc_device_release() and the workqueue
that processes DSP responses. When the user closes the file descriptor,
fastrpc_device_release() frees the fastrpc_user structure. Concurrently,
an in-flight DSP invocation can complete and fastrpc_rpmsg_callback()
schedules context cleanup via schedule_work(&ctx->put_work). If the
workqueue runs fastrpc_context_free() in parallel with or after
fastrpc_device_release() has freed the user structure, it dereferences
the freed fastrpc_user. Depending on the state of the context at the
time of the race, any one of the following accesses can be hit:

 1. fastrpc_buf_free() calls fastrpc_ipa_to_dma_addr(buf->fl->cctx, ...)
    to strip the SID bits from the stored IOVA before passing the
    physical address to dma_free_coherent().

 2. fastrpc_free_map() reads map->fl->cctx->vmperms[0].vmid to
    reconstruct the source permission bitmask needed for the
    qcom_scm_assign_mem() call that returns memory from the DSP VM
    back to HLOS.

 3. fastrpc_free_map() acquires map->fl->lock to safely remove the
    map node from the fl->maps list.

The resulting use-after-free manifests as:

  pc : fastrpc_buf_free+0x38/0x80 [fastrpc]
  lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc]
  fastrpc_context_free+0xa8/0x1b0 [fastrpc]
  fastrpc_context_put_wq+0x78/0xa0 [fastrpc]
  process_one_work+0x180/0x450
  worker_thread+0x26c/0x388

Add kref-based reference counting to fastrpc_user. Have each invoke
context take a reference on the user at allocation time and release it
when the context is freed. Release the initial reference in
fastrpc_device_release() at file close. Move the teardown of the user
structure — freeing pending contexts, maps, mmaps, and the channel
context reference — into the kref release callback fastrpc_user_free(),
so that it runs only when the last reference is dropped, regardless of
whether that happens at device close or after the final in-flight
context completes.

Fixes: 6cffd79504ce ("misc: fastrpc: Add support for dmabuf exporter")
Cc: stable@kernel.org
Signed-off-by: Anandu Krishnan E <anandu.e@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260530204528.116920-2-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

After a kexec/kdump reboot, the macb Ethernet controller fails to
receive any packets, causing DHCP to hang indefinitely and the network
interface to be unusable despite link being up.

The root cause is that RP1's level-triggered MSI-X interrupt sources
(such as macb on hwirq 6) may have their internal state machines stuck
in the "waiting for IACK" state. This happens because the previous
kernel crashed before sending the acknowledgment for a pending level
interrupt.

In this stuck state, RP1 will not generate new MSI-X writes even though
the interrupt source remains asserted. Since no new MSI-X is sent, the
GIC never sees a new edge, the chained IRQ handler is never invoked,
and the interrupt is permanently lost.

Fix this by sending MSIX_CFG_IACK in rp1_irq_activate(). This
unconditionally resets the MSI-X state machine back to idle when a
child device requests its interrupt. If the interrupt source is still
asserted, RP1 will immediately issue a new MSI-X with the freshly
configured msg_addr/msg_data, and normal interrupt delivery resumes.

Writing IACK when the state machine is already idle (i.e., on a normal
cold boot) is harmless — it has no effect.

Fixes: 49d63971f963 ("misc: rp1: RaspberryPi RP1 misc driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
Link: https://patch.msgid.link/20260518073405.2115003-1-xiaolei.wang@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull char / misc / IIO / and others driver updates from Greg KH:
 "Here is the char/misc/iio and other smaller driver subsystem updates
  for 7.1-rc1. Lots of stuff in here, all tiny, but relevant for the
  different drivers they touch. Major points in here is:

   - the usual large set of new IIO drivers and updates for that
     subsystem (the large majority of this diffstat)

   - lots of comedi driver updates and bugfixes

   - coresight driver updates

   - interconnect driver updates and additions

   - mei driver updates

   - binder (both rust and C versions) updates and fixes

   - lots of other smaller driver subsystem updates and additions

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (405 commits)
  coresight: tpdm: fix invalid MMIO access issue
  mei: me: add nova lake point H DID
  mei: lb: add late binding version 2
  mei: bus: add mei_cldev_uuid
  w1: ds2490: drop redundant device reference
  bus: mhi: host: pci_generic: Add Telit FE912C04 modem support
  mei: csc: wake device while reading firmware status
  mei: csc: support controller with separate PCI device
  mei: convert PCI error to common errno
  mei: trace: print return value of pci_cfg_read
  mei: me: move trace into firmware status read
  mei: fix idle print specifiers
  mei: me: use PCI_DEVICE_DATA macro
  sonypi: Convert ACPI driver to a platform one
  misc: apds990x: fix all kernel-doc warnings
  most: usb: Use kzalloc_objs for endpoint address array
  hpet: Convert ACPI driver to a platform one
  misc: vmw_vmci: Fix spelling mistakes in comments
  parport: Remove completed item from to-do list
  char: remove unnecessary module_init/exit functions
  ...

Pull pci updates from Bjorn Helgaas:
 "Enumeration:

   - Allow TLP Processing Hints to be enabled for RCiEPs (George Abraham
     P)

   - Enable AtomicOps only if we know the Root Port supports them (Gerd
     Bayer)

   - Don't enable AtomicOps for RCiEPs since none of them need Atomic
     Ops and we can't tell whether the Root Complex would support them
     (Gerd Bayer)

   - Leave Precision Time Measurement disabled until a driver enables it
     to avoid PCIe errors (Mika Westerberg)

   - Make pci_set_vga_state() fail if bridge doesn't support VGA
     routing, i.e., PCI_BRIDGE_CTL_VGA is not writable, and return
     errors to vga_get() callers including userspace via
     /dev/vga_arbiter (Simon Richter)

   - Validate max-link-speed from DT in j721e, brcmstb, mediatek-gen3,
     rzg3s drivers (where the actual controller constraints are known),
     and remove validation from the generic OF DT accessor (Hans Zhang)

   - Remove pc110pad driver (no longer useful after 486 CPU support
     removed) and no_pci_devices() (pc110pad was the last user) (Dmitry
     Torokhov, Heiner Kallweit)

  Resource management:

   - Prevent assigning space to unimplemented bridge windows; previously
     we mistakenly assumed prefetchable window existed and assigned
     space and put a BAR there (Ahmed Naseef)

   - Avoid shrinking bridge windows to fit in the initial Root Port
     window; fixes one problem with devices with large BARs connected
     via switches, e.g., Thunderbolt (Ilpo Järvinen)

   - Pass full extent of empty space, not just the aligned space, to
     resource_alignf callback so free space before the requested
     alignment can be used (Ilpo Järvinen)

   - Place small resources before larger ones for better utilization of
     address space (Ilpo Järvinen)

   - Fix alignment calculation for resource size larger than align,
     e.g., bridge windows larger than the 1MB required alignment (Ilpo
     Järvinen)

  Reset:

   - Update slot handling so all ARI functions are treated as being in
     the same slot. They're all reset by Secondary Bus Reset, but
     previously drivers of ARI functions that appeared to be on a
     non-zero device weren't notified and fatal hardware errors could
     result (Keith Busch)

   - Make sysfs reset_subordinate hotplug safe to avoid spurious hotplug
     events (Keith Busch)

   - Hide Secondary Bus Reset ('bus') from sysfs reset_methods if masked
     by CXL because it has no effect (Vidya Sagar)

   - Avoid FLR for AMD NPU device, where it causes the device to hang
     (Lizhi Hou)

  Error handling:

   - Clear only error bits in PCIe Device Status to avoid accidentally
     clearing Emergency Power Reduction Detected (Shuai Xue)

   - Check for AER errors even in devices without drivers (Lukas Wunner)

   - Initialize ratelimit info so DPC and EDR paths log AER error
     information (Kuppuswamy Sathyanarayanan)

  Power control:

   - Add UPD720201/UPD720202 USB 3.0 xHCI Host Controller .compatible so
     generic pwrctrl driver can control it (Neil Armstrong)

  Hotplug:

   - Set LED_HW_PLUGGABLE for NPEM hotplug-capable ports so LED core
     doesn't complain when setting brightness fails because the endpoint
     is gone (Richard Cheng)

  Peer-to-peer DMA:

   - Allow wildcards in list of host bridges that support peer-to-peer
     DMA between hierarchy domains and add all Google SoCs (Jacob
     Moroni)

  Endpoint framework:

   - Advertise dynamic inbound mapping support in pci-epf-test and
     update host pci_endpoint_test to skip doorbell testing if not
     advertised by endpoint (Koichiro Den)

   - Return 0, not remaining timeout, when MHI eDMA ops complete so
     mhi_ep_ring_add_element() doesn't interpret non-zero as failure
     (Daniel Hodges)

   - Remove vntb and ntb duplicate resource teardown that leads to oops
     when .allow_link() fails or .drop_link() is called (Koichiro Den)

   - Disable vntb delayed work before clearing BAR mappings and
     doorbells to avoid oops caused by doing the work after resources
     have been torn down (Koichiro Den)

   - Add a way to describe reserved subregions within BARs, e.g.,
     platform-owned fixed register windows, and use it for the RK3588
     BAR4 DMA ctrl window (Koichiro Den)

   - Add BAR_DISABLED for BARs that will never be available to an EPF
     driver, and change some BAR_RESERVED annotations to BAR_DISABLED
     (Niklas Cassel)

   - Add NTB .get_dma_dev() callback for cases where DMA API requires a
     different device, e.g., vNTB devices (Koichiro Den)

   - Add reserved region types for MSI-X Table and PBA so Endpoint
     controllers can them as describe hardware-owned regions in a
     BAR_RESERVED BAR (Manikanta Maddireddy)

   - Make Tegra194/234 BAR0 programmable and remove 1MB size limit
     (Manikanta Maddireddy)

   - Expose Tegra BAR2 (MSI-X) and BAR4 (DMA) as 64-bit BAR_RESERVED
     (Manikanta Maddireddy)

   - Add Tegra194 and Tegra234 device table entries to pci_endpoint_test
     (Manikanta Maddireddy)

   - Skip the BAR subrange selftest if there are not enough inbound
     window resources to run the test (Christian Bruel)

  New native PCIe controller drivers:

   - Add DT binding and driver for Andes QiLai SoC PCIe host controller
     (Randolph Lin)

   - Add DT binding and driver for ESWIN PCIe Root Complex (Senchuan
     Zhang)

  Baikal T-1 PCIe controller driver:

   - Remove driver since it never quite became usable (Andy Shevchenko)

  Cadence PCIe controller driver:

   - Implement byte/word config reads with dword (32-bit) reads because
     some Cadence controllers don't support sub-dword accesses (Aksh
     Garg)

  CIX Sky1 PCIe controller driver:

   - Add 'power-domains' to DT binding for SCMI power domain (Gary Yang)

  Freescale i.MX6 PCIe controller driver:

   - Add i.MX94 and i.MX943 to fsl,imx6q-pcie-ep DT binding (Richard
     Zhu)

   - Delay instead of polling for L2/L3 Ready after PME_Turn_off when
     suspending i.MX6SX because LTSSM registers are inaccessible
     (Richard Zhu)

   - Separate PERST# assertion (for resetting endpoints) from core reset
     (for resetting the RC itself) to prepare for new DTs with PERST#
     GPIO in per-Root Port nodes (Sherry Sun)

   - Retain Root Port MSI capability on i.MX7D, i.MX8MM, and i.MX8MQ so
     MSI from downstream devices will work (Richard Zhu)

   - Fix i.MX95 reference clock source selection when internal refclk is
     used (Franz Schnyder)

  Freescale Layerscape PCIe controller driver:

   - Allow building as a removable module (Sascha Hauer)

  MediaTek PCIe Gen3 controller driver:

   - Use dev_err_probe() to simplify error paths and make deferred probe
     messages visible in /sys/kernel/debug/devices_deferred (Chen-Yu
     Tsai)

   - Power off device if setup fails (Chen-Yu Tsai)

   - Integrate new pwrctrl API to enable power control for WiFi/BT
     adapters on mainboard or in PCIe or M.2 slots (Chen-Yu Tsai)

  NVIDIA Tegra194 PCIe controller driver:

   - Poll less aggressively and non-atomically for PME_TO_Ack during
     transition to L2 (Vidya Sagar)

   - Disable LTSSM after transition to Detect on surprise link down to
     stop toggling between Polling and Detect (Manikanta Maddireddy)

   - Don't force the device into the D0 state before L2 when suspending
     or shutting down the controller (Vidya Sagar)

   - Disable PERST# IRQ only in Endpoint mode because it's not
     registered in Root Port mode (Manikanta Maddireddy)

   - Handle 'nvidia,refclk-select' as optional (Vidya Sagar)

   - Disable direct speed change in Endpoint mode so link speed change
     is controlled by the host (Vidya Sagar)

   - Set LTR values before link up to avoid bogus LTR messages with 0
     latency (Vidya Sagar)

   - Allow system suspend when the Endpoint link is down (Vidya Sagar)

   - Use DWC IP core version, not Tegra custom values, to avoid DWC core
     version check warnings (Manikanta Maddireddy)

   - Apply ECRC workaround to devices based on DesignWare 5.00a as well
     as 4.90a (Manikanta Maddireddy)

   - Disable PM Substate L1.2 in Endpoint mode to work around Tegra234
     erratum (Vidya Sagar)

   - Delay post-PERST# cleanup until core is powered on to avoid CBB
     timeout (Manikanta Maddireddy)

   - Assert CLKREQ# so switches that forward it to their downstream side
     can bring up those links successfully (Vidya Sagar)

   - Calibrate pipe to UPHY for Endpoint mode to reset stale PLL state
     from any previous bad link state (Vidya Sagar)

   - Remove IRQF_ONESHOT flag from Endpoint interrupt registration so
     DMA driver and Endpoint controller driver can share the interrupt
     line (Vidya Sagar)

   - Enable DMA interrupt to support DMA in both Root Port and Endpoint
     modes (Vidya Sagar)

   - Enable hardware link retraining after link goes down in Endpoint
     mode (Vidya Sagar)

   - Add DT binding and driver support for core clock monitoring (Vidya
     Sagar)

  Qualcomm PCIe controller driver:

   - Advertise 'Hot-Plug Capable' and set 'No Command Completed Support'
     since Qcom Root Ports support hotplug events like DL_Up/Down and
     can accept writes to Slot Control without delays between writes
     (Krishna Chaitanya Chundru)

  Renesas R-Car PCIe controller driver:

   - Mark Endpoint BAR0 and BAR2 as Resizable (Koichiro Den)

   - Reduce EPC BAR alignment requirement to 4K (Koichiro Den)

  Renesas RZ/G3S PCIe controller driver:

   - Add RZ/G3E to DT binding and to driver (John Madieu)

   - Assert (not deassert) resets in probe error path (John Madieu)

   - Assert resets in suspend path in reverse order they were deasserted
     during probe (John Madieu)

   - Rework inbound window algorithm to prevent mapping more than
     intended region and enforce alignment on size, to prepare for
     RZ/G3E support (John Madieu)

  Rockchip DesignWare PCIe controller driver:

   - Add tracepoints for PCIe controller LTSSM transitions and link rate
     changes (Shawn Lin)

   - Trace LTSSM events collected by the dw-rockchip debug FIFO (Shawn
     Lin)

  SOPHGO PCIe controller driver:

   - Disable ASPM L0s and L1 on Sophgo 2042 PCIe Root Ports that
     advertise support for them (Yao Zi)

  Synopsys DesignWare PCIe controller driver:

   - Continue with system suspend even if an Endpoint doesn't respond
     with PME_TO_Ack message (Manivannan Sadhasivam)

   - Set Endpoint MSI-X Table Size in the correct function of a
     multi-function device when configuring MSI-X, not in Function 0
     (Aksh Garg)

   - Set Max Link Width and Max Link Speed for all functions of a
     multi-function device, not just Function 0 (Aksh Garg)

   - Expose PCIe event counters in groups 5-7 in debugfs (Hans Zhang)

  Miscellaneous:

   - Warn only once about invalid ACS kernel parameter format (Richard
     Cheng)

   - Suppress FW_BUG warning when writing sysfs 'numa_node' with the
     current value (Li RongQing)

   - Drop redundant 'depends on PCI' from Kconfig (Julian Braha)"

* tag 'pci-v7.1-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (165 commits)
  PCI/P2PDMA: Add Google SoCs to the P2P DMA host bridge list
  PCI/P2PDMA: Allow wildcard Device IDs in host bridge list
  PCI: sg2042: Avoid L0s and L1 on Sophgo 2042 PCIe Root Ports
  PCI: cadence: Add flags for disabling ASPM capability for broken Root Ports
  PCI: tegra194: Add core monitor clock support
  dt-bindings: PCI: tegra194: Add monitor clock support
  PCI: tegra194: Enable hardware hot reset mode in Endpoint mode
  PCI: tegra194: Enable DMA interrupt
  PCI: tegra194: Remove IRQF_ONESHOT flag during Endpoint interrupt registration
  PCI: tegra194: Calibrate pipe to UPHY for Endpoint mode
  PCI: tegra194: Assert CLKREQ# explicitly by default
  PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
  PCI: tegra194: Disable L1.2 capability of Tegra234 EP
  PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
  PCI: tegra194: Use DWC IP core version
  PCI: tegra194: Free up Endpoint resources during remove()
  PCI: tegra194: Allow system suspend when the Endpoint link is not up
  PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode
  PCI: tegra194: Disable direct speed change for Endpoint mode
  PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"
  ...